Amazon Linux 2023 : bluez, bluez-cups, bluez-deprecated (ALAS2023-2023-212)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-212 advisory. A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-209)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-209 advisory. html/template: improper sanitization of CSS values Angle brackets were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a...

Amazon Linux 2 : vim (ALAS-2023-2085)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2085 advisory. NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2609 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. CVE-2023-2610 Tenable has...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-211)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-211 advisory. In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. CVE-2022-48425 Tenable has extracted the preceding description bloc...

Amazon Linux 2 : python-pillow (ALAS-2023-2087)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2087 advisory. An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invali...

Amazon Linux 2 : webkitgtk4 (ALAS-2023-2088)

The version of webkitgtk4 installed on the remote host is prior to 2.38.5-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2088 advisory. 2024-08-28: CVE-2022-22620 was added to this advisory. 2024-08-14: CVE-2022-32893 was added to this advisory. A logic...

Medium: xmlrpc

Issue Overview: XML external entity XXE vulnerability in the Apache XML-RPC aka ws-xmlrpc library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery SSRF attacks via a crafted DTD. CVE-2016-5002 Affected Packages: xmlrpc Note: This advisory is...

Medium: python-pillow

Issue Overview: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size. CVE-2021-25290 Affected Packages: python-pillow Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the differen...

Important: vim

Issue Overview: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2609 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. CVE-2023-2610 Affected Packages: vim Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit...

Amazon Linux AMI : freetype (ALAS-2023-1764)

The version of freetype installed on the remote host is prior to 2.3.11-19.16. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1764 advisory. A segmentation fault was found in FreeType's FTRequestSize function in the ftobjs.c file. This flaw allows an attacker to acce...

Amazon Linux AMI : mod_security (ALAS-2023-1763)

The version of modsecurity installed on the remote host is prior to 2.8.0-5.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1763 advisory. In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web...

Amazon Linux AMI : pcre (ALAS-2023-1767)

The version of pcre installed on the remote host is prior to 8.21-7.9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1767 advisory. Heap-based buffer overflow in the findfixedlength function in pcrecompile.c in PCRE before 8.38 allows remote attackers to...

Amazon Linux AMI : openssl (ALAS-2023-1762)

The version of openssl installed on the remote host is prior to 1.0.2k-16.163. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1762 advisory. A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.50...

Amazon Linux AMI : postgresql92 (ALAS-2023-1759)

The version of postgresql92 installed on the remote host is prior to 9.2.24-3.69. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1759 advisory. This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser...

Amazon Linux AMI : vim (ALAS-2023-1761)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1761 advisory. Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. CVE-2023-2426 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2609 Integer...

Amazon Linux AMI : golang (ALAS-2023-1760)

The version of golang installed on the remote host is prior to 1.18.6-1.44. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1760 advisory. html/template: improper sanitization of CSS values Angle brackets were not considered dangerous characters when inserted...

Amazon Linux AMI : squid (ALAS-2023-1766)

The version of squid installed on the remote host is prior to 3.5.20-17.48. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1766 advisory. Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in...

Amazon Linux AMI : dnsmasq (ALAS-2023-1758)

The version of dnsmasq installed on the remote host is prior to 2.76-16.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1758 advisory. An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232...

Amazon Linux AMI : mod24_auth_mellon (ALAS-2023-1765)

The version of mod24authmellon installed on the remote host is prior to 0.14.0-2.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1765 advisory. A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attack...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2023-186)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-186 advisory. A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service. CVE-2023-1667 A vulnerability...