Amazon Linux 2 : ghostscript (ALAS-2024-2422)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2422 advisory. An issue was discovered in the function gdevprnopenprinterseekable in Artifex Ghostscript through 10.02.0 allows remote attacker...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2024-492)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-492 advisory. It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2024-498)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-498 advisory. 2024-02-29: CVE-2023-47108 was added to this advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2024-487)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-487 advisory. GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file CVE-2024-0208 IEEE 1609.2 dissector crash in...

Amazon Linux AMI : nss-softokn (ALAS-2024-1907)

The version of nss-softokn installed on the remote host is prior to 3.53.1-6.49. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1907 advisory. It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of t...

Important: kernel

Issue Overview: An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. CVE-2023-6606 A use-after-free flaw was found in the netfilter subsystem of...

Important: firefox

Issue Overview: A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is...

Important: kernel

Issue Overview: An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. CVE-2023-6606 A use-after-free flaw was found in the netfilter subsystem of...

Important: kernel

Issue Overview: An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. CVE-2023-6606 Affected Packages: kernel Note: This advisory is applicable t...

Important: postgresql

Issue Overview: Certain aggregate function calls receiving "unknown"-type arguments could disclose bytes of server memory from the end of the "unknown"-type value to the next zero byte. One typically gets an "unknown"-type value via a string literal having no type designation. We have not confirm...

Low: containerd

Issue Overview: No CVE associated with this advisory Affected Packages: containerd Note: This advisory is applicable to Amazon Linux 2 - Nitro-enclaves Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ section for the difference between AL2 Core and AL2 Extras...

Amazon Linux 2 : c-ares (ALAS-2024-2429)

The version of c-ares installed on the remote host is prior to 1.10.0-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2429 advisory. When cross-compiling c-ares and using the autotools build system, CARESRANDOMFILE will not be set, as seen when cross compiling...

Amazon Linux 2 : vsftpd (ALAS-2024-2431)

The version of vsftpd installed on the remote host is prior to 3.0.2-25. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2431 advisory. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using...

Amazon Linux 2023 : lemon, sqlite, sqlite-analyzer (ALAS2023-2024-490)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-490 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make...

Amazon Linux 2 : GraphicsMagick (ALASGRAPHICSMAGICK1.3-2023-001)

The version of GraphicsMagick installed on the remote host is prior to 1.3.38-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2GRAPHICSMAGICK1.3-2023-001 advisory. In GraphicsMagick, a heap buffer overflow was found when parsing MIFF. CVE-2022-1270 Tenable has extracted...

Amazon Linux 2 : webkitgtk4 (ALAS-2024-2425)

The version of webkitgtk4 installed on the remote host is prior to 2.42.4-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2425 advisory. The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, iOS 17.2...

Amazon Linux 2 : kernel (ALAS-2024-2418)

The version of kernel installed on the remote host is prior to 4.14.336-253.554. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2418 advisory. An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue cou...

Amazon Linux AMI : kernel (ALAS-2024-1906)

The version of kernel installed on the remote host is prior to 4.14.336-178.554. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1906 advisory. An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue coul...

Amazon Linux AMI : perl-Spreadsheet-ParseExcel (ALAS-2024-1905)

The version of perl-Spreadsheet-ParseExcel installed on the remote host is prior to 0.5900-5.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1905 advisory. Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel i...

Amazon Linux AMI : exim (ALAS-2024-1908)

The version of exim installed on the remote host is prior to 4.92-1.40. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1908 advisory. Exim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to...