Amazon Linux 2023 : librsvg2, librsvg2-devel, librsvg2-tools (ALAS2023-2023-295)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-295 advisory. A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files on the local filesystem outside of the expected area, as demonstrat...

Amazon Linux 2023 : jsoup, jsoup-javadoc (ALAS2023-2023-315)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-315 advisory. jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting XSS safety. jsoup may incorrectly sanitize HTML including javascript: URL expressions, which could allow...

Amazon Linux 2023 : runc (ALAS2023-2023-311)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-311 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2023-307)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-307 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fi...

Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2023-303)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-303 advisory. GHSA-76gg-c692-v2mw: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP NOTE: Fixed in 8.2.7, 8.1.20, 8.0.29NOTE: https://github.com/php/php-...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-302)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-302 advisory. ASP.NET and Visual Studio Security Feature Bypass Vulnerability CVE-2023-33170 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-314)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-314 advisory. 2024-05-09: CVE-2022-3597 was added to this advisory. LibTIFF 4.4.0 has an out-of-bounds write in TIFFmemcpy in libtiff/tifunix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-298)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-298 advisory. A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tiffax3.c, resulting in a denial of service...

Amazon Linux 2023 : nerdctl (ALAS2023-2023-313)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-313 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject...

Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2023-301)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-301 advisory. A vulnerability was found in ImageMagick. This issue occurs as an undefined behavior, casting double to sizet in svg, mvg and other coders. CVE-2023-34151 Tenable has extracted the preceding description...

Amazon Linux 2023 : haproxy (ALAS2023-2023-293)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-293 advisory. HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers,...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-304)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-304 advisory. The use of Module.load can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Please note that at the time this CVE was issued, the policy...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2023-308)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-308 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fi...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2023-312)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-312 advisory. On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or...

Amazon Linux 2023 : gawk, gawk-all-langpacks, gawk-devel (ALAS2023-2023-292)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-292 advisory. A heap out-of-bounds read flaw was found in builtin.c in the gawk package which may result in a crash of the software. CVE-2023-4156 Tenable has extracted the preceding description block directly from t...

Amazon Linux 2023 : nerdctl (ALAS2023-2023-309)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-309 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fi...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-300)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-300 advisory. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-299)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-299 advisory. An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfssetea in...

Amazon Linux AMI : openldap (ALAS-2023-1804)

The version of openldap installed on the remote host is prior to 2.4.40-16.37. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1804 advisory. A vulnerability was found in openldap that can cause a null pointer dereference in the bermemallocx function. CVE-2023-2953...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2023-1809)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.252.b09-2.51. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1809 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Scripting...