Amazon Linux 2 : php (ALASPHP8.0-2023-007)

The version of php installed on the remote host is prior to 8.0.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.0-2023-007 advisory. A flaw was found in PHP. The vulnerability occurs due to the malformed phpfilterfloat function and leads to a use-after-free...

Important: php

Issue Overview: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid...

Amazon Linux 2 : php (ALASPHP8.0-2023-008)

The version of php installed on the remote host is prior to 8.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2023-008 advisory. Several flaws has been found in php. The pdofirebase module does not check the length of the server version string in a...

Important: php

Issue Overview: GHSA-76gg-c692-v2mw: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP NOTE: Fixed in 8.2.7, 8.1.20, 8.0.29 NOTE: https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw NOTE:...

Amazon Linux 2 : openssl (ALAS-2023-2246)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2246 advisory. Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use t...

Important: php

Issue Overview: A vulnerability was found in PHP due to an uninitialized array in pgqueryparams function. When using the Postgres database extension, supplying invalid parameters to the parameterized query may lead to PHP attempting to free memory, using uninitialized data as pointers. This flaw...

Medium: php

Issue Overview: Several flaws has been found in php. The pdofirebase module does not check the length of the server version string in a response packet causing a stack buffer overflow, does not verify the data and uses the wrong type to cast length leading to a crash, and does not validate the...

Medium: php

Issue Overview: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress quines gzip files, resulting in an infinite loop. CVE-2022-31628 In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to...

Amazon Linux 2 : php (ALASPHP8.0-2023-005)

The version of php installed on the remote host is prior to 8.0.24-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2023-005 advisory. In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress quines gzip...

Amazon Linux 2 : php (ALASPHP8.0-2023-004)

The version of php installed on the remote host is prior to 8.0.25-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2023-004 advisory. In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont function in gd extension, it is possible to...

Important: php

Issue Overview: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid...

Amazon Linux 2 : php (ALASPHP8.0-2023-001)

The version of php installed on the remote host is prior to 8.0.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.0-2023-001 advisory. A flaw was found in php. The main cause of this vulnerability is improper input validation while parsing an Extensible Markup...

Amazon Linux 2 : php (ALASPHP8.2-2023-001)

The version of php installed on the remote host is prior to 8.2.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2023-001 advisory. 2023-09-14: CVE-2023-0568 was added to this advisory. In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before...

Amazon Linux 2 : php (ALASPHP8.0-2023-003)

The version of php installed on the remote host is prior to 8.0.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.0-2023-003 advisory. A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly...

Amazon Linux AMI : poppler (ALAS-2023-1821)

The version of poppler installed on the remote host is prior to 0.26.5-43.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1821 advisory. In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service application crashes with...

Amazon Linux AMI : python38 (ALAS-2023-1816)

The version of python38 installed on the remote host is prior to 3.8.5-1.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1816 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It...

Amazon Linux AMI : ruby20 (ALAS-2023-1824)

The version of ruby20 installed on the remote host is prior to 2.0.0.648-2.42. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1824 advisory. An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. ...

Amazon Linux AMI : ca-certificates (ALAS-2023-1817)

The version of ca-certificates installed on the remote host is prior to 2018.2.22-65.1.31. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1817 advisory. Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while...

Amazon Linux AMI : clamav (ALAS-2023-1820)

The version of clamav installed on the remote host is prior to 0.103.9-1.55. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1820 advisory. A vulnerability in the filesystem image parser for Hierarchical File System Plus HFS+ of ClamAV could allow an unauthenticated,...

Amazon Linux AMI : krb5 (ALAS-2023-1818)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1818 advisory. lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because...