Amazon Linux 2 : qt5-qtbase (ALAS-2023-2036)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2036 advisory. When using the Qt SQL ODBC driver plugin, then it is possible to trigger a DOS with a specifically crafted string RESERVEDNOTE:...

Amazon Linux 2 : kernel (ALAS-2023-2035)

The version of kernel installed on the remote host is prior to 4.14.314-237.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2035 advisory. A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra ino...

Amazon Linux 2 : glib2 (ALAS-2023-2049)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2049 advisory. In GNOME GLib 2.56.1, gmarkupparsecontextendparse in gmarkup.c has a NULL pointer dereference. CVE-2018-16428 GNOME GLib...

Amazon Linux 2 : gd (ALAS-2023-2044)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2044 advisory. DISPUTED gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position is...

Amazon Linux 2 : libksba (ALAS-2023-2041)

The version of libksba installed on the remote host is prior to 1.3.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2041 advisory. Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE-2022-47629 Tenable has extracte...

Amazon Linux 2 : tomcat (ALAS-2023-2047)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2047 advisory. A privilege escalation flaw was found in Tomcat when the JMX Remote Lifecycle Listener was enabled. A local attacker...

Amazon Linux 2 : wireshark (ALAS-2023-2040)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2040 advisory. TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection ...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-032)

The version of kernel installed on the remote host is prior to 5.10.179-166.674. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-032 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-045)

The version of kernel installed on the remote host is prior to 5.4.242-155.348. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-045 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-018)

The version of kernel installed on the remote host is prior to 5.15.110-70.141. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-018 advisory. 2023-09-14: CVE-2023-2163 was added to this advisory. bpf: incorrect verifier pruning due to missing...

Medium: jdom

Issue Overview: An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. CVE-2021-33813 Affected Packages: jdom Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference...

Important: wireshark

Issue Overview: TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0412 Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet...

Medium: qt5-qtbase

Issue Overview: When using the Qt SQL ODBC driver plugin, then it is possible to trigger a DOS with a specifically crafted string RESERVED NOTE: https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin NOTE: https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d 6....

Medium: inkscape

Issue Overview: Inkscape 0.91 is vulnerable to an out-of-bounds read, which may allow an attacker to have access to unauthorized information. CVE-2021-42700 Inkscape version 0.91 can access an uninitialized pointer, which may allow an attacker to have access to unauthorized information...

Medium: openssl11

Issue Overview: A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers...

Important: gd

Issue Overview: DISPUTED gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and...

Important: glib2

Issue Overview: In GNOME GLib 2.56.1, gmarkupparsecontextendparse in gmarkup.c has a NULL pointer dereference. CVE-2018-16428 GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in gmarkupparsecontextparse in gmarkup.c, related to utf8str. CVE-2018-16429 Affected Packages: glib2 Note: This...

Important: libksba

Issue Overview: Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE-2022-47629 Affected Packages: libksba Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2...

Medium: kernel

Issue Overview: bpf: incorrect verifier pruning due to missing register precision taints, which may lead to out-of-band read/write access due to an incorrect verifier conclusion. CVE-2023-2163 A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the...

Important: kernel-livepatch-6.1.12-19.43

Issue Overview: In the Linux kernel before 6.1.13, there is a double free in net/mpls/afmpls.c upon an allocation failure for registering the sysctl table under a new location during the renaming of a device. CVE-2023-26545 Affected Packages: kernel-livepatch-6.1.12-19.43 Issue Correction: Please...