Amazon Linux 2 : ImageMagick (ALAS-2023-2123)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2123 advisory. The upstream bug report describes this issue as follows:A vulnerability was found in ImageMagick =7.1.1, where heap-based...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2023-240)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-240 advisory. A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order,...

Amazon Linux 2 : iniparser (ALAS-2023-2124)

The version of iniparser installed on the remote host is prior to 3.1-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2124 advisory. iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparsergetlongint which misses check NULL for function...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2023-241)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-241 advisory. This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. Database owners have that right by default, and explicit grants may extend it to oth...

Amazon Linux AMI : cups (ALAS-2023-1777)

The version of cups installed on the remote host is prior to 1.4.2-67.22. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1777 advisory. A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection...

Amazon Linux 2023 : python3-tornado (ALAS2023-2023-239)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-239 advisory. Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access...

Amazon Linux AMI : ncurses (ALAS-2023-1778)

The version of ncurses installed on the remote host is prior to 5.7-4.20090207.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1778 advisory. ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security- relevant memory...

Amazon Linux 2 : protobuf-c (ALAS-2023-2142)

The version of protobuf-c installed on the remote host is prior to 1.0.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2142 advisory. protobuf-c before 1.4.1 has an unsigned integer overflow in parserequiredmember. CVE-2022-48468 Tenable has extracted the...

Amazon Linux 2 : gstreamer-plugins-base (ALAS-2023-2121)

The version of gstreamer-plugins-base installed on the remote host is prior to 0.10.36-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2121 advisory. Integer overflow leading to heap overwrite in FLAC image tag handling CVE-2023-37327 Tenable has extracted the...

Amazon Linux AMI : tomcat8 (ALAS-2023-1779)

The version of tomcat8 installed on the remote host is prior to 8.5.89-1.93. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1779 advisory. The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.8...

Amazon Linux 2 : webkitgtk4 (ALAS-2023-2141)

The version of webkitgtk4 installed on the remote host is prior to 2.38.5-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2141 advisory. Processing web content may lead to arbitrary code execution NOTE:...

Amazon Linux 2 : lynx (ALAS-2023-2145)

The version of lynx installed on the remote host is prior to 2.8.9-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2145 advisory. Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials...

Amazon Linux 2023 : python3-setuptools, python3-setuptools-wheel (ALAS2023-2023-245)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-245 advisory. Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression...

Amazon Linux AMI : c-ares (ALAS-2023-1780)

The version of c-ares installed on the remote host is prior to 1.17.2-1.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1780 advisory. A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allow...

Amazon Linux 2 : golang (ALAS-2023-2131)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2131 advisory. The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go...

Amazon Linux 2023 : libX11, libX11-common, libX11-devel (ALAS2023-2023-250)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-250 advisory. A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the...

Amazon Linux 2 : fribidi (ALAS-2023-2116)

The version of fribidi installed on the remote host is prior to 1.0.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2116 advisory. A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially...

Amazon Linux AMI : busybox (ALAS-2023-1786)

The version of busybox installed on the remote host is prior to 1.34.1-1.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1786 advisory. A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2023-235)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-235 advisory. A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data immediately befor...

Amazon Linux 2 : squashfs-tools (ALAS-2023-2152)

The version of squashfs-tools installed on the remote host is prior to 4.3-0.21.gitaae0aff4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2152 advisory. Integer overflow in the readfragmenttable4 function in unsquash-4.c in Squashfs and sasquatch allows...