Amazon Linux AMI : cups (ALAS-2023-1828)

The version of cups installed on the remote host is prior to 1.4.2-67.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1828 advisory. An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey...

Amazon Linux AMI : ImageMagick (ALAS-2023-1831)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1831 advisory. A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the...

Important: firefox

Issue Overview: The Mozilla Foundation Security Advisory describes this flaw as: An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages. This bug only affects Firefox for Linux. Other operating systems are...

Important: postgresql

Issue Overview: This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. Database owners have that right by default, and explicit grants may extend it to other users. CVE-2023-2454 While CVE-2016-2193 fixed most interaction between row...

Medium: gsl

Issue Overview: A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2.5 and 2.6. Processing a maliciously crafted input data for gslstatsquantilefromsorteddata of the library may lead to unexpected application...

Important: libssh2

Issue Overview: An issue was discovered in function libssh2packetadd in libssh2 1.10.0 allows attackers to access out of bounds memory. CVE-2020-22218 Affected Packages: libssh2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference...

Important: ghostscript

Issue Overview: Buffer Overflow vulnerability in cljmediasize function in devices/gdevclj.c in Artifex Ghostscript 9.50 allows remote attackers to cause a denial of service or other unspecified impacts via opening of crafted PDF document. CVE-2020-21890 Affected Packages: ghostscript Note: This...

Medium: libxml2

Issue Overview: Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service DoS via supplying a crafted XML file. CVE-2023-39615 Affected Packages: libxml2 Note...

Medium: libtiff

Issue Overview: An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file. CVE-2022-40090 Affected Packages: libtiff Issue Correction: Run dnf update libtiff --releasever 2023.2.20230920 or dnf update --advisory...

Amazon Linux 2 : shadow-utils (ALAS-2023-2247)

The version of shadow-utils installed on the remote host is prior to 4.1.5.1-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2247 advisory. A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fai...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-349)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-349 advisory. KVM: arm64: Prevent unconditional donation of unmapped regions from the hostNOTE: https://source.android.com/docs/security/bulletin/2023-08-01NOTE:...

Amazon Linux 2023 : gdk-pixbuf2, gdk-pixbuf2-devel, gdk-pixbuf2-modules (ALAS2023-2023-352)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-352 advisory. GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12. CVE-2021-44648...

Amazon Linux 2 : libssh2 (ALAS-2023-2257)

The version of libssh2 installed on the remote host is prior to 1.4.3-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2257 advisory. An issue was discovered in function libssh2packetadd in libssh2 1.10.0 allows attackers to access out of bounds memory...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2023-346)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-346 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now...

Amazon Linux 2 : qt5-qtbase (ALAS-2023-2252)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2252 advisory. Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory...

Amazon Linux 2023 : gsl, gsl-devel (ALAS2023-2023-353)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-353 advisory. A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2.5 and 2.6. Processing a maliciously crafted input data for...

Amazon Linux 2023 : open-vm-tools, open-vm-tools-desktop, open-vm-tools-devel (ALAS2023-2023-350)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-350 advisory. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor with man-in-the- middle MITM network positioning between vCenter server and the virtual machine may be able to bypass...

Amazon Linux 2 : ghostscript (ALAS-2023-2261)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2261 advisory. A buffer overflow vulnerability in pcxwriterle in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remo...

Important: open-vm-tools

Issue Overview: VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor with man-in-the-middle MITM network positioning between vCenter server and the virtual machine may be able to bypass SAML token signature verification, to perform VMware Tools Guest Operations...

Medium: qt5-qtbase

Issue Overview: Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. CVE-2022-25634 An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion...