Amazon Linux 2 : nasm (ALAS-2023-2277)

The version of nasm installed on the remote host is prior to 2.15.03-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2277 advisory. A Use After Free vulnerability in function newToken in asm/preproc.c in nasm 2.14.02 allows attackers to cause a denial of...

Amazon Linux 2 : mdadm (ALAS-2023-2275)

The version of mdadm installed on the remote host is prior to 4.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2275 advisory. Buffer overflow in some IntelR SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enab...

Amazon Linux 2 : bind (ALAS-2023-2273)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2273 advisory. The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursi...

Amazon Linux 2 : flac (ALAS-2023-2283)

The version of flac installed on the remote host is prior to 1.3.0-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2283 advisory. Buffer Overflow vulnerability in function bitwritergrow in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted...

Amazon Linux 2 : vim (ALAS-2023-2266)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2266 advisory. vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service DoS via the exbufferall method. CVE-2021-3236 Use After Free in GitHub repository vim/vim...

Amazon Linux 2 : poppler (ALAS-2023-2282)

The version of poppler installed on the remote host is prior to 0.26.5-43. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2282 advisory. Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted...

Medium: ecs-init

Issue Overview: No CVE was issued for this update. Affected Packages: ecs-init Note: This advisory is applicable to Amazon Linux 2 - Ecs Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue...

Important: firefox

Issue Overview: Memory corruption in IPC CanvasTranslator CVE-2023-4573 Memory corruption in IPC ColorPickerShownCallback CVE-2023-4574 Memory corruption in IPC FilePickerShownCallback CVE-2023-4575 XLL file extensions were downloadable without warnings. CVE-2023-4581 Memory safety bug...

Medium: containerd

Issue Overview: 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192...

Medium: djvulibre

Issue Overview: An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero. CVE-2021-46310 Affected Packages: djvulibre Note: This advisory is applicable to Amazon Linux 2 - Mate-desktop1.x Extra. Visit this page to learn more abo...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2023-361)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-361 advisory. A vulnerability was found in OpenPrinting CUPS. The security flaw occurs due to failure in validating the length provided by an attacker-crafted CUPS document, possibly leading to a heap-based buffer...

Amazon Linux 2023 : pmix, pmix-devel, pmix-pmi (ALAS2023-2023-363)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-363 advisory. OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0. CVE-2023-41915 Tenable has...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2023-372)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-372 advisory. The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending o...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-364)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-364 advisory. LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-367)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-367 advisory. The html/template package does not properly handle HTML-like comment tokens, nor hashbang ! comment tokens, in contexts. This may cause the template parser to improperly interpret the contents ...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-356)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-356 advisory. An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in readdescriptors in drivers/usb/core/sysfs.c. CVE-2023-37453 nftables...

Amazon Linux 2023 : jbigkit, jbigkit-devel, jbigkit-libs (ALAS2023-2023-376)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-376 advisory. A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attac...

Amazon Linux 2023 : snakeyaml, snakeyaml-javadoc (ALAS2023-2023-375)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-375 advisory. Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2023-374)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-374 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Amazon Linux 2023 : mutt (ALAS2023-2023-357)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-357 advisory. Null pointer dereference when viewing a specially crafted email in Mutt 1.5.2 1.5.2 1.5.2 2.2.12 CVE-2023-4874 Null pointer dereference when composing from a spe...