Amazon Linux AMI : curl (ALAS-2023-1727)

The version of curl installed on the remote host is prior to 7.61.1-12.105. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1727 advisory. The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part o...

Important: jasper

Issue Overview: A flaw was found in the Jasper tool's jpc encoder. This flaw allows an attacker to craft input provided to Jasper, causing an arbitrary out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. CVE-2020-27828 ...

Important: liblouis

Issue Overview: Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the loulogFile function at logginc.c endpoint. CVE-2023-26767 Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of...

Important: emacs

Issue Overview: org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters. CVE-2023-28617 Affected Packages: emacs Note: This advisory is applicable to Amazon...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2023-161)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-161 advisory. By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS...

Amazon Linux 2 : mysql-connector-java (ALAS-2023-2017)

The version of mysql-connector-java installed on the remote host is prior to 5.1.25-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2017 advisory. Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are...

Amazon Linux 2 : golang, --advisory ALAS2-2023-2015 (ALAS-2023-2015)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2015 advisory. Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparseable...

Amazon Linux 2 : jasper (ALAS-2023-2018)

The version of jasper installed on the remote host is prior to 1.900.1-33. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2018 advisory. A flaw was found in the Jasper tool's jpc encoder. This flaw allows an attacker to craft input provided to Jasper, causi...

Amazon Linux 2 : liblouis (ALAS-2023-2013)

The version of liblouis installed on the remote host is prior to 2.6.2-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2013 advisory. Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the...

Amazon Linux 2 : emacs (ALAS-2023-2012)

The version of emacs installed on the remote host is prior to 27.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2012 advisory. org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a fi...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-160)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-160 advisory. A flaw was found in the Linux kernel Traffic Control TC subsystem. Using a specific networking configuration redirecting egress packets to ingress using TC action mirred a local unprivileged us...

Amazon Linux 2 : ImageMagick (ALAS-2023-2014)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2014 advisory. A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation...

Amazon Linux 2 : pki-core (ALAS-2023-2016)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2016 advisory. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending...

Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2023-158)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-158 advisory. A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution...

Amazon Linux 2023 : libpkgconf, libpkgconf-devel, pkgconf (ALAS2023-2023-159)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-159 advisory. In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconftupleparse. For example, a .pc file containing a few hundred byte...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-030)

The version of kernel installed on the remote host is prior to 5.10.29-27.126. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.10-2023-030 advisory. An issue was discovered in fs/iouring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial o...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-016 (ALASKERNEL-5.15-2023-016)

The version of kernel installed on the remote host is prior to 5.15.106-64.140. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-016 advisory. A flaw was found in the Linux kernel Traffic Control TC subsystem. Using a specific networking...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-029 (ALASKERNEL-5.10-2023-029)

The version of kernel installed on the remote host is prior to 5.10.177-158.645. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-029 advisory. A use-after-free vulnerability was found in nfs42sscopen in fs/nfs/nfs4file.c in the Linux kernel. This...

Important: kernel-livepatch-5.10.173-154.642

Issue Overview: dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference. CVE-2023-28466 Affected Packages: kernel-livepatch-5.10.173-154.642 Issue Correction: Please ensur...

Important: kernel-livepatch-5.10.167-147.601

Issue Overview: kernel: Type confusion in picknextrtentity, which can result in memory corruption. CVE-2023-1077 dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference...