Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2024-2397)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.392.b08-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2397 advisory. Vulnerability in Oracle Java SE component: CORBA. Supported versions that are affected are Oracle Java...

Amazon Linux 2 : ncurses (ALAS-2024-2412)

The version of ncurses installed on the remote host is prior to 6.0-8.20170212. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2412 advisory. There is a heap-based buffer over-read in the ncfindentry function in tinfo/comphash.c in the terminfo library in...

Amazon Linux 2 : avahi (ALAS-2024-2392)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2392 advisory. A reachable assertion was found in avahialternativehostname. CVE-2023-38473 Tenable has extracted the preceding description block...

Amazon Linux 2 : xorg-x11-server (ALAS-2024-2378)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2378 advisory. A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local...

Amazon Linux 2 : ecs-init (ALASECS-2024-032)

The version of ecs-init installed on the remote host is prior to 1.75.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-032 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject...

Amazon Linux 2 : virtuoso-opensource (ALAS-2024-2383)

The version of virtuoso-opensource installed on the remote host is prior to 7.2.11-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2383 advisory. An issue in the boxdiv function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of...

Medium: djvulibre

Issue Overview: An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero. CVE-2021-46312 Affected Packages: djvulibre Note: This advisory is applicable to Amazon Linux 2 - Mate-desktop1.x Extra. Visit this page to learn mo...

Medium: ncurses

Issue Overview: NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component ncwrapentry. CVE-2023-50495 Affected Packages: ncurses Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2...

Important: libsass

Issue Overview: Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::hasrealparentref function. CVE-2022-26592 Stack overflow vulnerability in astselectors.cpp in function Sass::CompoundSelector::hasrealparentref in libsass:3.6.5-8-g210218, which can be exploited by attackers t...

Medium: avahi

Issue Overview: A reachable assertion was found in avahialternativehostname. CVE-2023-38473 Affected Packages: avahi Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run...

Medium: libXpm

Issue Overview: A vulnerability was found in libX11 due to an infinite loop within the PutSubImage function. This flaw allows a local user to consume all available system resources and cause a denial of service condition. CVE-2023-43786 Affected Packages: libXpm Note: This advisory is applicable ...

Amazon Linux 2 : resteasy-base (ALAS-2024-2398)

The version of resteasy-base installed on the remote host is prior to 3.0.6-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2398 advisory. A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are...

Amazon Linux 2 : libuv (ALAS-2024-2410)

The version of libuv installed on the remote host is prior to 1.39.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2410 advisory. Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uvidnatoascii is used to convert strings to ASCI...

Amazon Linux 2 : binutils (ALAS-2024-2401)

The version of binutils installed on the remote host is prior to 2.29.1-31. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2401 advisory. A memory consumption issue in getdata function in binutils/nm.c in GNU nm before 2.34 allows attackers to cause a denia...

Medium: avahi

Issue Overview: A reachable assertion was found in avahirdataparse. CVE-2023-38472 Affected Packages: avahi Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum upda...

Amazon Linux 2 : xmlgraphics-commons (ALAS-2024-2411)

The version of xmlgraphics-commons installed on the remote host is prior to 1.5-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2411 advisory. Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input...

Amazon Linux 2 : ecs-init (ALASECS-2024-031)

The version of ecs-init installed on the remote host is prior to 1.79.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-031 advisory. Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This...

Amazon Linux AMI : squid (ALAS-2024-1901)

The version of squid installed on the remote host is prior to 3.5.20-17.53. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1901 advisory. Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-018)

The version of firefox installed on the remote host is prior to 115.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-018 advisory. The WebGL DrawElementsInstanced method was susceptible to a heap buffer overflow when used on systems with the Mes...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-057)

The version of kernel installed on the remote host is prior to 5.4.265-176.364. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-057 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: double hook...