Amazon Linux AMI : mod24_auth_mellon (ALAS-2023-1765)

The version of mod24authmellon installed on the remote host is prior to 0.14.0-2.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1765 advisory. A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attack...

Amazon Linux AMI : postgresql92 (ALAS-2023-1759)

The version of postgresql92 installed on the remote host is prior to 9.2.24-3.69. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1759 advisory. This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser...

Amazon Linux AMI : freetype (ALAS-2023-1764)

The version of freetype installed on the remote host is prior to 2.3.11-19.16. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1764 advisory. A segmentation fault was found in FreeType's FTRequestSize function in the ftobjs.c file. This flaw allows an attacker to acce...

Amazon Linux 2023 : libcap, libcap-devel, libcap-static (ALAS2023-2023-195)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-195 advisory. libcap is vulnerable to a denial of service caused by the error handling in wrappthreadcreate function, which will cause memory to be leaked in the case of an error. CVE-2023-2602 Tenable has extracted...

Amazon Linux 2023 : sysstat (ALAS2023-2023-191)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-191 advisory. sysstat through 12.7.2 allows a multiplication integer overflow in checkoverflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. CVE-2023-33204 Tenable has extracte...

Amazon Linux 2 : mod_auth_mellon (ALAS-2023-2077)

The version of modauthmellon installed on the remote host is prior to 0.14.0-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2077 advisory. A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attacker t...

Amazon Linux 2 : git (ALAS-2023-2072)

The version of git installed on the remote host is prior to 2.40.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2072 advisory. Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5,...

Amazon Linux 2 : OpenEXR (ALAS-2023-2078)

The version of OpenEXR installed on the remote host is prior to 1.7.1-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2078 advisory. A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-199)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-199 advisory. RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file CVE-2023-1992 LISP dissector large loop in Wiresha...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-190)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-190 advisory. An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved...

Amazon Linux 2 : rsync (ALAS-2023-2074)

The version of rsync installed on the remote host is prior to 3.1.2-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2074 advisory. A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the inflate.c function via a large...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2023-193)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-193 advisory. The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and telnet options for the...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2023-186)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-186 advisory. A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service. CVE-2023-1667 A vulnerability...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-184)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-184 advisory. There is a potential deadlock in the eBPF subsystem in the Linux kernel. The default sysctl configuration kernel.unprivilegedbpfdisabled on Amazon Linux does not allow unprivileged users to use...

Amazon Linux 2 : dnsmasq (ALAS-2023-2069)

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2069 advisory. An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 becau...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-194)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-194 advisory. NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2609 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. CVE-2023-2610 Tenable has...

Amazon Linux 2023 : perl-CPAN, perl-CPAN-tests (ALAS2023-2023-182)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-182 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31484 Tenable has...

Amazon Linux 2023 : snakeyaml, snakeyaml-javadoc (ALAS2023-2023-200)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-200 advisory. Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser t...

Amazon Linux 2 : poppler (ALAS-2023-2075)

The version of poppler installed on the remote host is prior to 0.26.5-43. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2075 advisory. A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service DoS via a...

Amazon Linux 2023 : c-ares, c-ares-devel (ALAS2023-2023-198)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-198 advisory. A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cau...