Medium: zsh

Issue Overview: A vulnerability was found in zsh in the parsecolorchar function of prompt.c file. This flaw allows an attacker to perform code execution if they control a command output inside the prompt, as stated by a %F%K argument. This occurs because of recursive PROMPTSUBST expansion...

Amazon Linux AMI : tomcat8 (ALAS-2022-1572)

The version of tomcat8 installed on the remote host is prior to 8.5.75-1.90. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1572 advisory. The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8,...

Amazon Linux 2 : thunderbird (ALAS-2022-1763)

The version of thunderbird installed on the remote host is prior to 91.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1763 advisory. The Mozilla Foundation Security Advisory describes this flaw as: It was possible to construct specific XSLT markup th...

Amazon Linux 2 : expat (ALAS-2022-1754)

The version of expat installed on the remote host is prior to 2.1.0-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1754 advisory. expat libexpat is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML...

Amazon Linux 2 : containerd (ALAS-2022-015) (deprecated)

This plugin has been deprecated following detection of an issue with overlapping filenames. Deprecated by al2ALASDOCKER-2022-015.nasl plugin ID 160407 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon Linux 2 Security Advisory...

Amazon Linux AMI : containerd (ALAS-2022-1568)

The version of containerd installed on the remote host is prior to 1.4.6-8.12. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1568 advisory. A bug was found in containerd where containers launched through containerd's CRI implementation with a specially-crafted image...

Amazon Linux 2 : zsh (ALAS-2022-1757)

The version of zsh installed on the remote host is prior to 5.8.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1757 advisory. A vulnerability was found in zsh in the parsecolorchar function of prompt.c file. This flaw allows an attacker to perform code executio...

Amazon Linux 2 : gegl (ALAS-2022-1755)

The version of gegl installed on the remote host is prior to 0.2.0-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1755 advisory. Due to the use of the system command in the Magick-Load op used by gegl an attacker is able to craft a command line path that is able...

Amazon Linux AMI : expat (ALAS-2022-1569)

The version of expat installed on the remote host is prior to 2.1.0-12.25. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1569 advisory. expat libexpat is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML...

Important: log4j

Issue Overview: A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSSink in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if JMSSink is deployed and has been configured to perform JNDI requests...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2022-1753)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.14+9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1753 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2022-1752)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.2+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1752 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Amazon Linux 2 : log4j (ALAS-2022-1750)

The version of log4j installed on the remote host is prior to 1.2.17-18. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1750 advisory. A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSSink in Log4j 1.x is vulnerable to...

Amazon Linux 2 : vim (ALAS-2022-1751)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1751 advisory. It was found that vim was vulnerable to use-after-free flaw in the way it was treating allocated lines in user functions. A specially crafted file could crash the vim process or possibly lead to...

Amazon Linux AMI : openssh (ALAS-2022-1565)

The version of openssh installed on the remote host is prior to 7.4p1-22.77. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1565 advisory. A flaw was found in OpenSSH. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges...

Amazon Linux AMI : vim (ALAS-2022-1567)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1567 advisory. 2024-02-14: CVE-2021-3778 was added to this advisory. 2024-02-14: CVE-2021-3875 was added to this advisory. 2024-02-14: CVE-2021-3872 was added to this advisory. A flaw was found in vim. A possibl...

Amazon Linux AMI : perl-Image-ExifTool (ALAS-2022-1566)

The version of perl-Image-ExifTool installed on the remote host is prior to 12.38-1.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1566 advisory. lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file = /|$/ check. CVE-2022-23935 Tenable has extracted...

Amazon Linux 2 : vim, --advisory ALAS2-2022-1743 (ALAS-2022-1743)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1743 advisory. vim is vulnerable to Heap-based Buffer Overflow CVE-2021-3903 A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a specially crafted file leading to a...

Amazon Linux 2 : openssh (ALAS-2022-1748)

The version of openssh installed on the remote host is prior to 7.4p1-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1748 advisory. A flaw was found in OpenSSH. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges...

Amazon Linux 2 : samba (ALAS-2022-1746)

The version of samba installed on the remote host is prior to 4.10.16-18. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1746 advisory. Out-of-bounds heap read/write vulnerability in VFS module vfsfruit allows code execution CVE-2021-44142 Tenable has...