Amazon Linux 2 : libfastjson (ALAS-2023-2079)

The version of libfastjson installed on the remote host is prior to 0.99.4-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2079 advisory. A flaw was found in json-c. In printbufmemappend, certain crafted values can overflow the memory allowing an attacker to write...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-190)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-190 advisory. An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved...

Amazon Linux 2 : dnsmasq (ALAS-2023-2069)

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2069 advisory. An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 becau...

Amazon Linux 2 : sysstat (ALAS-2023-2068)

The version of sysstat installed on the remote host is prior to 10.1.5-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2068 advisory. sysstat through 12.7.2 allows a multiplication integer overflow in checkoverflow in common.c. NOTE: this issue exists because of ...

Amazon Linux 2023 : byacc (ALAS2023-2023-204)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-204 advisory. When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory use after free. CVE-2021-33641 When a file is...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-184)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-184 advisory. There is a potential deadlock in the eBPF subsystem in the Linux kernel. The default sysctl configuration kernel.unprivilegedbpfdisabled on Amazon Linux does not allow unprivileged users to use...

Amazon Linux 2023 : libfastjson, libfastjson-devel (ALAS2023-2023-205)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-205 advisory. A flaw was found in json-c. In printbufmemappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundary. The highest threat from this vulnerability is to...

Amazon Linux 2 : curl (ALAS-2023-2070)

The version of curl installed on the remote host is prior to 8.0.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2070 advisory. The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part of thi...

Amazon Linux 2023 : dnsmasq, dnsmasq-utils (ALAS2023-2023-192)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-192 advisory. An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. CVE-2023-28450 Tenable has extracted the...

Amazon Linux 2023 : sysstat (ALAS2023-2023-191)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-191 advisory. sysstat through 12.7.2 allows a multiplication integer overflow in checkoverflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. CVE-2023-33204 Tenable has extracte...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-193)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-193 advisory. The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and telnet options for the...

Amazon Linux 2023 : libcap, libcap-devel, libcap-static (ALAS2023-2023-195)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-195 advisory. libcap is vulnerable to a denial of service caused by the error handling in wrappthreadcreate function, which will cause memory to be leaked in the case of an error. CVE-2023-2602 Tenable has extracted...

Amazon Linux 2 : glusterfs (ALAS-2023-2071)

The version of glusterfs installed on the remote host is prior to 3.12.2-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2071 advisory. In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read. CVE-2023-26253...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-194)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-194 advisory. NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2609 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. CVE-2023-2610 Tenable has...

Amazon Linux 2 : openssl (ALAS-2023-2073)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2073 advisory. A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509...

Amazon Linux 2023 : libtasn1, libtasn1-devel, libtasn1-tools (ALAS2023-2023-201)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-201 advisory. GNU Libtasn1 before 4.19.0 has an ETYPEOK off-by-one array size check that affects asn1encodesimpleder. CVE-2021-46848 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux 2 : squid (ALAS-2023-2081)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2081 advisory. An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receivi...

Amazon Linux 2 : xmlrpc (ALAS-2023-2080)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2080 advisory. An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC aka ws-xmlrpc library. A malicious XML-RPC server could target a XML-RPC clie...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-189)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-189 advisory. 2024-05-09: CVE-2022-33196 was added to this advisory. Insufficient granularity of access control in out-of-band management in some IntelR Atom and Intel Xeon Scalable Processors may allow a...

Important: perl-CPAN

Issue Overview: HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31484 Affected Packages: perl-CPAN Issue Correction: Run dnf update perl-CPAN --releasever...