Amazon Linux 2 : wayland (ALAS-2023-2103)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2103 advisory. An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the...

Amazon Linux 2 : openldap (ALAS-2023-2095)

The version of openldap installed on the remote host is prior to 2.4.44-25. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2095 advisory. A vulnerability was found in openldap that can cause a null pointer dereference in the bermemallocx function. CVE-2023-2953...

Amazon Linux 2 : kernel (ALAS-2023-2108)

The version of kernel installed on the remote host is prior to 4.14.318-241.531. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2108 advisory. An issue was found in the Linux kernel's IPv6 TCP connection tracking code, which could lead to high CPU usage with certain...

Amazon Linux 2 : yajl (ALAS-2023-2101)

The version of yajl installed on the remote host is prior to 2.0.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2101 advisory. yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer...

Amazon Linux 2 : perl-Pod-Perldoc (ALAS-2023-2094)

The version of perl-Pod-Perldoc installed on the remote host is prior to 3.20-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2094 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configurati...

Amazon Linux 2 : mod_security (ALAS-2023-2098)

The version of modsecurity installed on the remote host is prior to 2.9.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2098 advisory. In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the...

Amazon Linux 2 : qt5-qtsvg (ALAS-2023-2092)

The version of qt5-qtsvg installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2092 advisory. In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont munitsPerEm...

Amazon Linux 2 : glib2 (ALAS-2023-2107)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2107 advisory. PCRE before 8.38 mishandles the : and \ substrings in character classes, which allows remote attackers to cause a denial of...

Amazon Linux 2 : flac (ALAS-2023-2106)

The version of flac installed on the remote host is prior to 1.3.0-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2106 advisory. An out-of-bounds write vulnerability was found in libFlak. The vulnerability occurs due to a missing bounds check. This flaw allows a...

Amazon Linux 2 : python-pillow (ALAS-2023-2105)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2105 advisory. An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number o...

Amazon Linux 2 : qpdf (ALAS-2023-2104)

The version of qpdf installed on the remote host is prior to 5.0.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2104 advisory. QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in PlASCII85Decoder::write called from PlAESPDF::flush...

Amazon Linux 2 : opensc (ALAS-2023-2102)

The version of opensc installed on the remote host is prior to 0.19.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2102 advisory. A heap use after free issue was found in Opensc before version 0.22.0 in scfilevalid. CVE-2021-42779 A use after return...

Amazon Linux 2 : qpdf (ALAS-2023-2099)

The version of qpdf installed on the remote host is prior to 5.0.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2099 advisory. QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerability allows...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-035)

The version of kernel installed on the remote host is prior to 5.10.184-175.731. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.10-2023-035 advisory. An issue was found in the Linux kernel's IPv6 TCP connection tracking code, which could lead to high CPU usage wi...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-047 (ALASKERNEL-5.4-2023-047)

The version of kernel installed on the remote host is prior to 5.4.247-161.349. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-047 advisory. A flaw was found in the x86 KVM subsystem in kvmstealtimesetpreempted in arch/x86/kvm/x86.c in the Linux...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-021 (ALASKERNEL-5.15-2023-021)

The version of kernel installed on the remote host is prior to 5.15.117-72.142. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-021 advisory. In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-022)

The version of kernel installed on the remote host is prior to 5.15.117-73.143. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.15-2023-022 advisory. An issue was found in the Linux kernel's IPv6 TCP connection tracking code, which could lead to high CPU usage wit...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-048)

The version of kernel installed on the remote host is prior to 5.4.247-162.350. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2023-048 advisory. An issue was found in the Linux kernel's IPv6 TCP connection tracking code, which could lead to high CPU usage with...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-233)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-233 advisory. An issue was found in the Linux kernel's IPv6 TCP connection tracking code, which could lead to high CPU usage with certain traffic patterns. CVE-2023-1206 Tenable has extracted the preceding descriptio...

Important: kernel-livepatch-4.14.311-233.529

Issue Overview: An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores an XFS image after failure with a dirty log journal. This flaw allows a local user to crash or potentially escalate their privileges on the system. CVE-2023-2124...