Amazon Linux 2 : nasm (ALAS-2023-2029)

The version of nasm installed on the remote host is prior to 2.15.03-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2029 advisory. NASM v2.16 was discovered to contain a heap buffer overflow in the component quoteforpmake asm/nasm.c:856 CVE-2022-44370 Tenable has...

Amazon Linux 2 : tomcat (ALAS-2023-2020)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2020 advisory. 2023-05-11: CVE-2017-12616 was added to this advisory. When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 ...

Amazon Linux 2 : pcs (ALAS-2023-2022)

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2022 advisory. The Ruby on Rails advisory describes this vulnerability as follows: Carefully crafted input can cause header parsing in Rack to take ...

Amazon Linux 2 : libwebp (ALAS-2023-2031)

The version of libwebp installed on the remote host is prior to 0.3.0-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2031 advisory. A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. T...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2023-2025)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.7+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2025 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Amazon Linux 2 : xstream (ALAS-2023-2030)

The version of xstream installed on the remote host is prior to 1.3.1-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2030 advisory. XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability...

Amazon Linux 2 : ghostscript (ALAS-2023-2019)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2019 advisory. In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the...

Amazon Linux 2 : golang (ALAS-2023-2024)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2024 advisory. Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an...

Amazon Linux 2 : thunderbird (ALAS-2023-2028)

The version of thunderbird installed on the remote host is prior to 102.10.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2028 advisory. 2024-01-03: CVE-2023-1999 was added to this advisory. The Mozilla Foundation describes this issue as follows:OCSP...

Medium: docker

Issue Overview: A flaw was found in Moby. This flaw allows an attacker to bypass primary group restrictions due to a flaw in the supplementary group access setup. CVE-2022-36109 Docker version 20.10.15, build fd82621 is vulnerable to Insecure Permissions. Unauthorized users outside the Docker...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-044 (ALASKERNEL-5.4-2023-044)

The version of kernel installed on the remote host is prior to 5.4.241-150.347. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-044 advisory. A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-031 (ALASKERNEL-5.10-2023-031)

The version of kernel installed on the remote host is prior to 5.10.178-162.673. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-031 advisory. In the Linux kernel, the following vulnerability has been resolved: sysctl: Fix data-races in...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2023-006)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0372.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2023-006 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-017 (ALASKERNEL-5.15-2023-017)

The version of kernel installed on the remote host is prior to 5.15.108-65.141. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-017 advisory. An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restore...

Amazon Linux 2 : docker (ALASDOCKER-2023-024)

The version of docker installed on the remote host is prior to 20.10.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2023-024 advisory. A flaw was found in Moby. This flaw allows an attacker to bypass primary group restrictions due to a flaw in the...

Amazon Linux AMI : dbus (ALAS-2023-1730)

The version of dbus installed on the remote host is prior to 1.6.12-14.31. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1730 advisory. An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An...

Amazon Linux AMI : golang (ALAS-2023-1731)

The version of golang installed on the remote host is prior to 1.18.6-1.43. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1731 advisory. Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working...

Amazon Linux AMI : curl (ALAS-2023-1727)

The version of curl installed on the remote host is prior to 7.61.1-12.105. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1727 advisory. The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part o...

Amazon Linux AMI : tomcat8 (ALAS-2023-1732)

The version of tomcat8 installed on the remote host is prior to 8.5.87-1.92. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1732 advisory. The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47...

Amazon Linux AMI : jasper (ALAS-2023-1733)

The version of jasper installed on the remote host is prior to 1.900.1-21.12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1733 advisory. A flaw was found in the Jasper tool's jpc encoder. This flaw allows an attacker to craft input provided to Jasper,...