Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2023-034)

The version of containerd installed on the remote host is prior to 1.6.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2023-034 advisory. In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2...

Medium: docker

Issue Overview: The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Image Specification, the manifest and index documents were not self-describing and documents with a single digest could be interpreted as either a manife...

Amazon Linux 2 : docker (ALASECS-2023-025)

The version of docker installed on the remote host is prior to 20.10.7-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-025 advisory. The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI...

Amazon Linux 2 : containerd (ALASECS-2023-022)

The version of containerd installed on the remote host is prior to 1.6.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-022 advisory. In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-017)

The version of firefox installed on the remote host is prior to 115.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-017 advisory. A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportu...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-030)

The version of kernel installed on the remote host is prior to 5.15.137-91.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-030 advisory. 2024-06-06: CVE-2023-52476 was added to this advisory. An issue was discovered in the Linux kernel before...

Medium: containerd

Issue Overview: A flaw was found in containerd where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host's filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to...

Amazon Linux 2 : containerd (ALASECS-2023-029)

The version of containerd installed on the remote host is prior to 1.4.6-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-029 advisory. A flaw was found in containerd where pulling and extracting a specially-crafted container image can result in Unix file...

Amazon Linux 2 : kernel (ALAS-2023-2340)

The version of kernel installed on the remote host is prior to 4.14.328-248.540. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2340 advisory. 2024-06-06: CVE-2023-52477 was added to this advisory. A race condition between two functions, lmLogClose and txEn...

Amazon Linux 2 : thunderbird (ALAS-2023-2334)

The version of thunderbird installed on the remote host is prior to 115.4.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2334 advisory. The Mozilla Foundation Security Advisory describes this flaw as: It was possible for certain browser prompts and...

Medium: vim

Issue Overview: Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function gagrowinner in in the file src/alloc.c at line 748, which is freed in the file src/exdocmd.c in the function docmdline at line 1010 and then used again in src/cmdhist...

Medium: amazon-efs-utils

Issue Overview: efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to mount file systems, the mount helper allocates a local port for stunnel to...

Amazon Linux 2023 : amazon-efs-utils (ALAS2023-2023-437)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-437 advisory. efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to...

Amazon Linux 2 : ctags (ALAS-2023-2343)

The version of ctags installed on the remote host is prior to 5.8-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2343 advisory. A flaw was found in Exuberant Ctags in the way it handles the -o option. This option specifies the tag filename. A crafted tag filenam...

Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2023-433)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-433 advisory. Out-of-bounds Read vulnerability in modmacro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. CVE-2023-31122 A flaw was found in httpd. This flaw allows an attacker...

Amazon Linux 2 : microcode_ctl (ALAS-2023-2341)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2341 advisory. An issue was found in redundant REX instruction prefix values affecting third generation Intel Xeon Scalable Icelake processors...

Amazon Linux 2 : amazon-efs-utils (ALAS-2023-2342)

The version of amazon-efs-utils installed on the remote host is prior to 1.35.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2342 advisory. efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-436)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-436 advisory. 2024-03-27: CVE-2023-23908 was added to this advisory. An issue was found in redundant REX instruction prefix values affecting third generation Intel Xeon Scalable Icelake processors. The issue...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-431)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-431 advisory. Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function gagrowinner in in the file src/alloc.c at line 748, which is freed in the file...

Amazon Linux 2 : ruby (ALAS-2023-2345)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2345 advisory. A flaw was found in ruby, where the date object was found to be vulnerable to a regular expression denial of service ReDoS during...