Important: thunderbird

Issue Overview: Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file...

Amazon Linux 2 : libxml2 (ALAS-2023-2249)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2249 advisory. Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement function at /libxml2/SAX2.c...

Amazon Linux 2 : open-vm-tools (ALAS-2023-2250)

The version of open-vm-tools installed on the remote host is prior to 12.3.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2250 advisory. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor with man-in-the- middle MITM network...

Amazon Linux 2 : opensc (ALAS-2023-2262)

The version of opensc installed on the remote host is prior to 0.19.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2262 advisory. OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decodebitstring in libopensc/asn1.c...

Amazon Linux 2 : libjpeg-turbo (ALAS-2023-2254)

The version of libjpeg-turbo installed on the remote host is prior to 2.0.90-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2254 advisory. 2023-10-30: CVE-2020-17541 was added to this advisory. Libjpeg-turbo all version have a stack-based buffer overflow...

Amazon Linux 2 : gsl (ALAS-2023-2255)

The version of gsl installed on the remote host is prior to 1.15-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2255 advisory. A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2....

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-351)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-351 advisory. An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file. CVE-2022-40090 Tenable has extracted the preceding...

Medium: php

Issue Overview: A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly quoted string. With the implementation of sqlite3snprintf, it is possible to force the function to return a single apostrophe if the function is called...

Medium: php

Issue Overview: A flaw was found in php. The main cause of this vulnerability is improper input validation while parsing an Extensible Markup LanguageXML entity. A special character could allow an attacker to traverse directories. The highest threat from this vulnerability is confidentiality...

Medium: php

Issue Overview: A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly quoted string. With the implementation of sqlite3snprintf, it is possible to force the function to return a single apostrophe if the function is called...

Medium: php

Issue Overview: A flaw was found in PHP. The vulnerability occurs due to the malformed phpfilterfloat function and leads to a use-after-free vulnerability. This flaw allows an attacker to inject a malicious file, leading to a crash or a Segmentation fault. CVE-2021-21708 Affected Packages: php...

Amazon Linux 2 : php (ALASPHP8.0-2023-006)

The version of php installed on the remote host is prior to 8.0.20-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2023-006 advisory. A vulnerability was found in PHP due to an uninitialized array in pgqueryparams function. When using the Postgres databa...

Amazon Linux 2 : php (ALASPHP8.0-2023-009)

The version of php installed on the remote host is prior to 8.0.30-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2023-009 advisory. GHSA-76gg-c692-v2mw: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP NOTE: Fixe...

Amazon Linux 2 : php (ALASPHP8.2-2023-002)

The version of php installed on the remote host is prior to 8.2.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2023-002 advisory. GHSA-76gg-c692-v2mw: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP NOTE: Fixed...

Amazon Linux 2 : gcc10 (ALAS-2023-2244)

The version of gcc10 installed on the remote host is prior to 10.5.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2244 advisory. 2023-09-13: The severity of this advisory was corrected from low to medium. An issue was found in a defense in depth feature of the...

Amazon Linux 2 : php (ALASPHP8.1-2023-002)

The version of php installed on the remote host is prior to 8.1.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.1-2023-002 advisory. 2023-09-14: CVE-2023-0568 was added to this advisory. In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before...

Important: php

Issue Overview: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid...

Important: php

Issue Overview: GHSA-76gg-c692-v2mw: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP NOTE: Fixed in 8.2.7, 8.1.20, 8.0.29 NOTE: https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw NOTE:...

Important: php

Issue Overview: In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar function, the read outside allocated buffer will be used. This can lead ...

Amazon Linux 2 : php (ALASPHP8.1-2023-003)

The version of php installed on the remote host is prior to 8.1.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.1-2023-003 advisory. A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly...