Amazon Linux 2 : glibc (ALAS-2022-1767)

The version of glibc installed on the remote host is prior to 2.26-58. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1767 advisory. A stack based buffer-overflow vulnerability was found in the deprecated compatibility function svcunixcreate in the sunrpc's...

Amazon Linux AMI : openssl (ALAS-2022-1575)

The version of openssl installed on the remote host is prior to 1.0.2k-16.156. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1575 advisory. The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime...

Amazon Linux 2 : openssl, openssl11 (ALAS-2022-1766)

The version of openssl installed on the remote host is prior to 1.0.2k-24. The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1766 advisory. The BNmodsqrt function, which computes a modular...

Amazon Linux AMI : expat (ALAS-2022-1573)

The version of expat installed on the remote host is prior to 2.1.0-12.27. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1573 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML...

Amazon Linux 2 : expat (ALAS-2022-1764)

The version of expat installed on the remote host is prior to 2.1.0-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1764 advisory. A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML...

Critical: expat

Issue Overview: A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This issue is dependent on how invalid UTF-8 is handled inside the XML processor...

Amazon Linux AMI : cyrus-sasl (ALAS-2022-1574)

The version of cyrus-sasl installed on the remote host is prior to 2.1.23-13.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1574 advisory. A flaw was found in the SQL plugin shipped with Cyrus SASL. Failure to properly escape the SQL input allows a remote attacke...

Amazon Linux 2 : containerd (ALAS-2022-016) (deprecated)

This plugin has been deprecated following detection of an issue with overlapping filenames. Deprecated by al2ALASDOCKER-2022-016.nasl plugin ID 160406 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon Linux 2 Security Advisory...

Medium: containerd

Issue Overview: containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to...

Medium: containerd

Issue Overview: containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to...

Amazon Linux AMI : kernel (ALAS-2022-1571)

The version of kernel installed on the remote host is prior to 4.14.268-139.500. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1571 advisory. Amazon Linux has been made aware of a potential Branch Target Injection BTI issue sometimes referred to as Spectre...

Amazon Linux 2 : expat (ALAS-2022-1759)

The version of expat installed on the remote host is prior to 2.1.0-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1759 advisory. An integer overflow was found in expat. The issue occurs in storeRawNames by abusing the mbuffer expansion logic to allow allocation...

Amazon Linux AMI : expat (ALAS-2022-1570)

The version of expat installed on the remote host is prior to 2.1.0-12.26. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1570 advisory. An integer overflow was found in expat. The issue occurs in storeRawNames by abusing the mbuffer expansion logic to allow...

Amazon Linux 2 : cyrus-sasl (ALAS-2022-1758)

The version of cyrus-sasl installed on the remote host is prior to 2.1.26-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1758 advisory. A flaw was found in the SQL plugin shipped with Cyrus SASL. Failure to properly escape the SQL input allows a remote attacker ...

Amazon Linux 2 : docker (ALAS-2022-017) (deprecated)

This plugin has been deprecated following detection of an issue with overlapping filenames. Deprecated by al2ALASDOCKER-2022-017.nasl plugin ID 160411 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon Linux 2 Security Advisory...

Important: cyrus-sasl

Issue Overview: A flaw was found in the SQL plugin shipped with Cyrus SASL. Failure to properly escape the SQL input allows a remote attacker to execute arbitrary SQL commands. This issue can lead to the escalation of privileges. CVE-2022-24407 Affected Packages: cyrus-sasl Note: This advisory is...

Important: gegl

Issue Overview: Due to the use of the system command in the Magick-Load op used by gegl an attacker is able to craft a command line path that is able to lead to the execution of arbitrary shell commands that impacts availability, confidentiality and integrity. CVE-2021-45463 Affected Packages: ge...

Amazon Linux 2 : microcode_ctl (ALAS-2022-1762)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1762 advisory. 2024-05-09: CVE-2021-33117 was added to this advisory. A flaw was found in microcode. Under complex microarchitectural...

Important: kernel

Issue Overview: Amazon Linux has been made aware of a potential Branch Target Injection BTI issue sometimes referred to as Spectre variant 2. This is a known cross-domain transient execution attack where a third party may seek to cause a disclosure gadget to be speculatively executed after an...

Amazon Linux 2 : kernel, --advisory ALAS2-2022-1761 (ALAS-2022-1761)

The version of kernel installed on the remote host is prior to 4.14.268-205.500. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1761 advisory. A buffer overflow flaw in the Linux kernel BPF subsystem was found in the way users run BPF with long jump over an...