Amazon Linux AMI : expat (ALAS-2022-1654)

The version of expat installed on the remote host is prior to 2.1.0-15.32. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1654 advisory. A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while...

Amazon Linux 2022 : cyrus-sasl (ALAS2022-2022-234)

The version of cyrus-sasl installed on the remote host is prior to 2.1.27-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-234 advisory. - In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE...

Amazon Linux 2022 : ImageMagick (ALAS2022-2022-215)

The version of ImageMagick installed on the remote host is prior to 6.9.12.64-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-215 advisory. - A vulnerability was found in ImageMagick-7.0.11-5, where executing a crafted file with the convert command, AS...

Amazon Linux 2022 : zlib (ALAS2022-2022-252)

The version of zlib installed on the remote host is prior to 1.2.11-33. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-252 advisory. - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra...

Amazon Linux AMI : rsync (ALAS-2022-1640)

The version of rsync installed on the remote host is prior to 3.0.6-12.14. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1640 advisory. An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating ex: when compressing if the input ha...

Amazon Linux AMI : samba (ALAS-2022-1642)

The version of samba installed on the remote host is prior to 4.10.16-20.62. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1642 advisory. It was found that the Kerberos Key Distribution Center KDC delegation feature, Service for User S4U, did not sufficient...

Amazon Linux 2022 : util-linux (ALAS2022-2022-218)

The version of util-linux installed on the remote host is prior to 2.37.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-218 advisory. - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to...

Amazon Linux AMI : rubygem-nokogiri (ALAS-2022-1648)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1648 advisory. A flaw was found in the rubygem-nokogiri package. This flaw allows malicious users to change partial contents or configurations on the system. Additionally, this vulnerability can also cause a limited deni...

Amazon Linux 2022 : git (ALAS2022-2022-236)

The version of git installed on the remote host is prior to 2.37.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-236 advisory. - Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on...

Amazon Linux AMI : libksba (ALAS-2022-1649)

The version of libksba installed on the remote host is prior to 1.3.5-1.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1649 advisory. A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be...

Amazon Linux AMI : libtiff (ALAS-2022-1644)

The version of libtiff installed on the remote host is prior to 4.0.3-35.42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1644 advisory. A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main function. This flaw allows an attacker to pass a...

Amazon Linux AMI : python36 (ALAS-2022-1652)

The version of python36 installed on the remote host is prior to 3.6.12-1.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1652 advisory. The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows...

Amazon Linux AMI : git (ALAS-2022-1653)

The version of git installed on the remote host is prior to 2.38.1-1.77. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1653 advisory. Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5,...

Amazon Linux AMI : python38 (ALAS-2022-1651)

The version of python38 installed on the remote host is prior to 3.8.5-1.6. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1651 advisory. The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows...

Amazon Linux AMI : libtiff (ALAS-2022-1647)

The version of libtiff installed on the remote host is prior to 4.0.3-35.40. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1647 advisory. A flaw was found in libtiffs tiffcrop utility that has a uint32t underflow that can lead to an out-of- bounds read and write. Th...

Amazon Linux 2022 : python-waitress (ALAS2022-2022-235)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-235 advisory. - Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the...

Amazon Linux 2022 : samba (ALAS2022-2022-224)

The version of samba installed on the remote host is prior to 4.16.2-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-224 advisory. - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the...

Amazon Linux AMI : expat (ALAS-2022-1655)

The version of expat installed on the remote host is prior to 2.1.0-15.33. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1655 advisory. In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in...

Amazon Linux 2022 : mariadb105 (ALAS2022-2022-245)

The version of mariadb105 installed on the remote host is prior to 10.5.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-245 advisory. - MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepareinplaceaddvirtual at...

Amazon Linux 2022 : expat (ALAS2022-2022-259)

The version of expat installed on the remote host is prior to 2.4.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-259 advisory. - libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. CVE-2022-40674 Note that Nessus has not teste...