Amazon Linux 2 : vte291 (ALAS-2024-2610)

The version of vte291 installed on the remote host is prior to 0.52.2-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2610 advisory. GNOME VTE before 0.76.3 allows an attacker to cause a denial of service memory consumption via a window resize escape sequence, a...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2024-014)

The version of tomcat installed on the remote host is prior to 9.0.91-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2024-014 advisory. Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processin...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-079)

The version of kernel installed on the remote host is prior to 5.4.274-187.369. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-079 advisory. In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleti...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-067)

The version of kernel installed on the remote host is prior to 5.10.216-204.855. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-067 advisory. In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify a...

Amazon Linux 2 : squid (ALAS-2024-2609)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2609 advisory. Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI...

Amazon Linux 2 : kernel, --advisory ALAS2-2024-2615 (ALAS-2024-2615)

The version of kernel installed on the remote host is prior to 4.14.345-262.561. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2615 advisory. In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars...

Amazon Linux 2 : ghostscript (ALAS-2024-2614)

The version of ghostscript installed on the remote host is prior to 9.54.0-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2614 advisory. Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure observable in a constructed BaseFont name in t...

Amazon Linux 2 : httpd (ALAS-2024-2606)

The version of httpd installed on the remote host is prior to 2.4.62-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2606 advisory. A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-077 (ALASKERNEL-5.4-2024-077)

The version of kernel installed on the remote host is prior to 5.4.278-191.377. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-077 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug...

Amazon Linux 2 : emacs (ALAS-2024-2608)

The version of emacs installed on the remote host is prior to 27.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2608 advisory. In Emacs before 29.3, Gnus treats inline MIME contents as trusted. CVE-2024-30203 In Emacs before 29.3, LaTeX preview is...

Amazon Linux 2 : kernel (ALAS-2024-2613)

The version of kernel installed on the remote host is prior to 4.14.349-266.564. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2613 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlanroutev6outbound helper...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-048)

The version of kernel installed on the remote host is prior to 5.15.158-103.164. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-048 advisory. In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify a...

Amazon Linux 2 : gtk3 (ALAS-2024-2602)

The version of gtk3 installed on the remote host is prior to 3.22.30-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2602 advisory. gtk3: gtk2: Library injection from CWD CVE-2024-6655 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux 2 : bind (ALAS-2024-2616)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2616 advisory. Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname of any RTYPE...

Security Bulletin: The IBM QRadar SIEM Amazon Web Services protocol is vulnerable to access restriction bypass and sensitive information exposure (CVE-2020-8908, CVE-2023-2976)

Summary Google Guava is used by IBM QRadar SIEM Amazon Web Services protocol, and it has known vulnerabilities. The issues have been addressed in an update. Vulnerability Details CVEID:CVE-2020-8908 DESCRIPTION: Guava could allow a remote authenticated attacker to bypass security restrictions,...

JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. JetBrains TeamCity suffers from a cross-site...

Important: dotnet6.0

Issue Overview: .NET and Visual Studio Denial of Service Vulnerability CVE-2024-38095 Affected Packages: dotnet6.0 Issue Correction: Run dnf update dotnet6.0 --releasever 2023.5.20240805 or dnf update --advisory ALAS2023-2024-685 --releasever 2023.5.20240805 to update your system. More informatio...

Medium: tpm2-tools

Issue Overview: tpm2-tools: arbitrary quote data may go undetected by tpm2checkquote CVE-2024-29038 tpm2-tools: pcr selection value is not compared with the attest CVE-2024-29039 Affected Packages: tpm2-tools Issue Correction: Run dnf update tpm2-tools --releasever 2023.5.20240805 or dnf update...

Medium: mod_http2

Issue Overview: Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. CVE-2024-36387 Affected Packages: modhttp2 Issue Correction: Run dnf update modhttp2 --releasever 2023.5.202408...

Medium: ghostscript

Issue Overview: NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=5ae2e320d69a7d0973011796bd388cd5befa1a43 ghostpdl-10.03.1 NOTE:...