Amazon Linux AMI : cifs-utils (ALAS-2023-1698)

The version of cifs-utils installed on the remote host is prior to 6.2-7.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1698 advisory. A stack-based buffer overflow issue was found in pifs-utils. Parsing the mount.cifs ip command-line argument can lead to local...

Amazon Linux 2 : vim (ALAS-2023-1975)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1975 advisory. A heap buffer overflow vulnerability was found in vim's inscomplinfercasegettext function of the src/insexpand.c file. This flaw occurs when vim tries to access uninitialized memory when completi...

Amazon Linux 2 : cpio (ALAS-2023-1972)

The version of cpio installed on the remote host is prior to 2.12-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1972 advisory. GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c dsfgetstr integer...

Amazon Linux 2 : thunderbird (ALAS-2023-1983)

The version of thunderbird installed on the remote host is prior to 102.8.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1983 advisory. 2024-02-15: CVE-2023-0616 was added to this advisory. If a MIME email combines OpenPGP and OpenPGP MIME data in a...

Amazon Linux AMI : freeradius (ALAS-2023-1699)

The version of freeradius installed on the remote host is prior to 2.2.6-7.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1699 advisory. When an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionarie...

Amazon Linux AMI : batik (ALAS-2023-1695)

The version of batik installed on the remote host is prior to 1.7-10.10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1695 advisory. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel...

Amazon Linux 2 : qt5-qtsvg (ALAS-2023-1968)

The version of qt5-qtsvg installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1968 advisory. Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend...

Amazon Linux 2 : cifs-utils (ALAS-2023-1978)

The version of cifs-utils installed on the remote host is prior to 6.2-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1978 advisory. A stack-based buffer overflow issue was found in pifs-utils. Parsing the mount.cifs ip command-line argument can lead to local...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2023-1697)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.362.b08-1.72. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1697 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Amazon Linux 2 : libdb (ALAS-2023-1965)

The version of libdb installed on the remote host is prior to 5.3.21-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1965 advisory. Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges ...

Amazon Linux AMI : git (ALAS-2023-1700)

The version of git installed on the remote host is prior to 2.38.4-1.80. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1700 advisory. Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36....

Amazon Linux 2 : xorg-x11-server (ALAS-2023-1982)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1982 advisory. 2024-05-23: CVE-2022-46343 was added to this advisory. 2024-05-23: CVE-2022-46341 was added to this advisory. 2024-05-23: CVE-2022-46344 was added to this advisory. 2024-05-23: CVE-2022-46340 was...

Amazon Linux 2 : freeradius (ALAS-2023-1970)

The version of freeradius installed on the remote host is prior to 3.0.26-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1970 advisory. The EAP-PWD function computepasswordelement leaks information about the password which allows an attacker to...

Amazon Linux 2 : openssl11 (ALAS-2023-1974)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1974 advisory. AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the...

Amazon Linux 2 : batik (ALAS-2023-1966)

The version of batik installed on the remote host is prior to 1.8-0.12.svn1230816. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1966 advisory. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the...

Amazon Linux 2 : cifs-utils, --advisory ALAS2-2023-1977 (ALAS-2023-1977)

The version of cifs-utils installed on the remote host is prior to 6.2-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1977 advisory. A flaw was found in cifs-utils. When verbose logging is enabled, invalid credentials file lines may be dumped to stderr. This may...

Amazon Linux 2 : sudo (ALAS-2023-1985)

The version of sudo installed on the remote host is prior to 1.8.23-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1985 advisory. In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user- provided environment variables...

Important: batik

Issue Overview: Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...

Medium: qt5-qtsvg

Issue Overview: Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend called from QPainterPath::addPath and QPathClipper::intersect. CVE-2021-45930 Affected Packages: qt5-qtsvg Note: This advisory is applicable to Amazon Lin...

Important: xorg-x11-server

Issue Overview: A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests.. This issue can lead to local privileges elevation on systems...