Amazon Linux 2022 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2022-2022-209)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-209 advisory. A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the SProcRenderCompositeGlyphs function due to improper validation of the request length. CVE-2021-4008 A fla...

Amazon Linux 2022 : python3, python3-devel, python3-idle (ALAS2022-2023-273)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2023-273 advisory. Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non- default configuration. The Python multiprocessing library, when used with the forkserver...

Amazon Linux 2022 : cpio (ALAS2022-2023-263)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-263 advisory. GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c dsfgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is...

Amazon Linux 2022 : python3-unbound, unbound, unbound-anchor (ALAS2022-2023-265)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2023-265 advisory. NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the ghost domain names attack. The vulnerability works by targeting an Unbound instance. Unbound is queri...

Amazon Linux 2022 : containerd, containerd-stress (ALAS2022-2022-210)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-210 advisory. A bug was found in containerd where containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary...

Amazon Linux 2022 : python3-lxml (ALAS2022-2023-264)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-264 advisory. NULL Pointer Dereference allows attackers to cause a denial of service or application crash. This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier ar...

Amazon Linux 2022 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2022-2023-280)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2023-280 advisory. Enhance DTLS performance: DTLS does not avail itself of the HelloVerifyRequest message which opens opportunities for DoS. CVE-2023-21835 Better Banking of Sounds: JARSoundbankReader can load...

Amazon Linux 2022 : ruby3.1, ruby3.1-bundled-gems, ruby3.1-default-gems (ALAS2022-2023-262)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-262 advisory. The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP...

Amazon Linux 2022 : emacs, emacs-common, emacs-devel (ALAS2022-2023-277)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2023-277 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation o...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-041)

The version of kernel installed on the remote host is prior to 5.4.228-131.415. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-041 advisory. A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this...

Amazon Linux AMI : postgresql93 (ALAS-2023-1658)

The version of postgresql93 installed on the remote host is prior to 9.3.25-1.73. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1658 advisory. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a...

Amazon Linux AMI : cacti (ALAS-2023-1675)

The version of cacti installed on the remote host is prior to 1.1.19-2.20. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1675 advisory. A flaw was found in how Cacti grants authorization based on IP address which allows authentication bypass, and possibly arbitrary...

Amazon Linux AMI : vim (ALAS-2023-1664)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1664 advisory. The target's backtrace indicates that libc has detected a heap error or that the target was executing a heap function when it stopped. This could be due to heap corruption, passing a bad pointer to a heap...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2023-005)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0362.b08-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2023-005 advisory. Improve CORBA communication: CORBA deserialization can result in outbound network...

Amazon Linux AMI : php70-pecl-memcached (ALAS-2023-1673)

The version of php70-pecl-memcached installed on the remote host is prior to 3.2.0-1.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1673 advisory. PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection...

Amazon Linux 2 : unzip (ALAS-2023-1906)

The version of unzip installed on the remote host is prior to 6.0-57. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1906 advisory. A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null...

Amazon Linux AMI : postgresql95 (ALAS-2023-1660)

The version of postgresql95 installed on the remote host is prior to 9.5.24-1.83. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1660 advisory. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a...

Amazon Linux 2 : libpng (ALAS-2023-1904)

The version of libpng installed on the remote host is prior to 1.5.13-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1904 advisory. Integer underflow in the pngcheckkeyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x...

Amazon Linux AMI : php54-pecl-memcached (ALAS-2023-1670)

The version of php54-pecl-memcached installed on the remote host is prior to 2.1.0-3.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1670 advisory. PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injectio...

Amazon Linux 2 : krb5 (ALAS-2023-1915)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1915 advisory. Integer overflow vulnerabilities in PAC parsing CVE-2022-42898 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for...