Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-034)

The version of kernel installed on the remote host is prior to 5.4.209-116.363. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-034 advisory. An out-of-bounds write flaw was found in the Linux kernel's framebuffer-based console driver functionality...

Amazon Linux AMI : 389-ds-base (ALAS-2022-1629)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-16.69. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1629 advisory. A double free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker cou...

Amazon Linux AMI : gnupg2 (ALAS-2022-1630)

The version of gnupg2 installed on the remote host is prior to 2.0.28-2.35. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1630 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-019)

The version of kernel installed on the remote host is prior to 5.10.135-122.509. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-019 advisory. - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2022-006)

The version of kernel installed on the remote host is prior to 5.15.57-29.131. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-006 advisory. A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary...

Amazon Linux AMI : varnish (ALAS-2022-1632)

The version of varnish installed on the remote host is prior to 4.0.5-3.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1632 advisory. A flaw was found in Varnish. This flaw allows an attacker to carry out a request smuggling attack on HTTP/1 connections on Varnis...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2022-1631)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.342.b07-0.68. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1631 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Amazon Linux 2 : kernel (ALAS-2022-1833)

The version of kernel installed on the remote host is prior to 4.14.290-217.505. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1833 advisory. An out-of-bounds write flaw was found in the Linux kernel's framebuffer-based console driver functionality in the...

Medium: gnupg2

Issue Overview: A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in g10/cpr.c. This flaw allows a malicious actor to bypass access control. CVE-2022-34903 Affected Packages: gnupg2 Note: This advisory is applicable to...

Amazon Linux 2 : gnupg2 (ALAS-2022-1834)

The version of gnupg2 installed on the remote host is prior to 2.0.22-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1834 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in...

The vulnerability of the TIFFFetchStripThing() function in the LibTIFF library on Amazon Linux systems allows a hacker to trigger a service failure.

The vulnerability of the TIFFFetchStripThing function in the LibTIFF library is related to the use of uninitialized resources during the processing of TIFF files. Exploiting this vulnerability could allow an attacker to cause service failures...

Amazon Linux 2 : golang, --advisory ALAS2-2022-1830 (ALAS-2022-1830)

The version of golang installed on the remote host is prior to 1.18.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1830 advisory. A null pointer dereference vulnerability was found in golang. When using the library's ssh server without specifying an...

Amazon Linux 2 : openssl11 (ALAS-2022-1832)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1832 advisory. A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passe...

Medium: openssl

Issue Overview: A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command executed through the shell. Some operating systems distribute this script in a manner where it ...

Medium: openssl11

Issue Overview: A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command executed through the shell. Some operating systems distribute this script in a manner where it ...

Amazon Linux AMI : git (ALAS-2022-1623)

The version of git installed on the remote host is prior to 2.37.1-1.76. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1623 advisory. A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system...

Amazon Linux AMI : kernel (ALAS-2022-1624)

The version of kernel installed on the remote host is prior to 4.14.287-148.504. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1624 advisory. There are use-after-free vulnerabilities caused by timer handler in net/rose/rosetimer.c of linux that allow...

Amazon Linux AMI : 389-admin (ALAS-2022-1619)

The version of 389-admin installed on the remote host is prior to 1.1.46-5.14. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1619 advisory. A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then inste...

Amazon Linux AMI : tomcat8 (ALAS-2022-1627)

The version of tomcat8 installed on the remote host is prior to 8.5.81-1.91. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1627 advisory. A flaw was found in the tomcat package. When a web application sends a WebSocket message concurrently with the WebSocke...

Amazon Linux AMI : 389-ds-base (ALAS-2022-1620)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-9.67. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1620 advisory. A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then...