Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2023-175)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-175 advisory. Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. CVE-2022-23772 cmd/go in Go before 1.16.14 and 1.17.x...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-169)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-169 advisory. An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores an XFS image after failure with a dirty log journal. This flaw allows a local user to...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2023-167)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-167 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,...

Medium: pcs

Issue Overview: The Ruby on Rails advisory describes this vulnerability as follows: Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack virtually all...

Important: tomcat

Issue Overview: When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request. CVE-2017-12616 When using the RemoteIpFilter with...

Important: kernel

Issue Overview: A use-after-free flaw was found in vhostnetsetbackend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem. CVE-2023-1838...

Amazon Linux 2 : tomcat (ALAS-2023-2020)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2020 advisory. 2023-05-11: CVE-2017-12616 was added to this advisory. When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 ...

Amazon Linux 2 : pcs (ALAS-2023-2022)

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2022 advisory. The Ruby on Rails advisory describes this vulnerability as follows: Carefully crafted input can cause header parsing in Rack to take ...

Amazon Linux 2 : libwebp (ALAS-2023-2031)

The version of libwebp installed on the remote host is prior to 0.3.0-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2031 advisory. A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. T...

Amazon Linux 2 : nasm (ALAS-2023-2029)

The version of nasm installed on the remote host is prior to 2.15.03-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2029 advisory. NASM v2.16 was discovered to contain a heap buffer overflow in the component quoteforpmake asm/nasm.c:856 CVE-2022-44370 Tenable has...

Amazon Linux 2 : kernel, --advisory ALAS2-2023-2027 (ALAS-2023-2027)

The version of kernel installed on the remote host is prior to 4.14.313-235.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2027 advisory. A use-after-free flaw was found in vhostnetsetbackend in drivers/vhost/net.c in virtio network subcomponent in the...

Important: nasm

Issue Overview: NASM v2.16 was discovered to contain a heap buffer overflow in the component quoteforpmake asm/nasm.c:856 CVE-2022-44370 Affected Packages: nasm Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2023-2026)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.19+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2026 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Amazon Linux 2 : openldap (ALAS-2023-2033)

The version of openldap installed on the remote host is prior to 2.4.44-25. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2033 advisory. An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relyi...

Amazon Linux 2 : screen (ALAS-2023-2023)

The version of screen installed on the remote host is prior to 4.1.0-0.27.20120314git3c2946. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2023 advisory. socket.c in GNU Screen through 4.9.0, when installed setuid or setgid the default on platforms such as Arch Lin...

Amazon Linux 2 : ldns (ALAS-2023-2032)

The version of ldns installed on the remote host is prior to 1.6.16-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2032 advisory. When ldns version 1.7.1 verifies a zone file, the ldnsrrnewfrmstrinternal function has a heap out of bounds read vulnerability. An...

Amazon Linux 2 : ghostscript (ALAS-2023-2019)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2019 advisory. In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the...

Amazon Linux 2 : golang (ALAS-2023-2024)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2024 advisory. Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an...

Important: xstream

Issue Overview: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new...

Low: screen

Issue Overview: socket.c in GNU Screen through 4.9.0, when installed setuid or setgid the default on platforms such as Arch Linux and FreeBSD, allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process. CVE-2023-24626 Affected...