Amazon Linux 2 : nss-softokn (ALAS-2024-2456)

The version of nss-softokn installed on the remote host is prior to 3.90.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2456 advisory. Multiple NSS NIST curves were susceptible to a side-channel attack known as Minerva. This attack could potentially allow an...

Amazon Linux 2 : gstreamer1-plugins-bad-free (ALAS-2024-2454)

The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2454 advisory. GStreamer-SA-2024-0001: AV1 codec parser potential buffer overflow during tile list parsing NOTE:...

Amazon Linux AMI : kernel (ALAS-2024-1919)

The version of kernel installed on the remote host is prior to 4.14.336-179.559. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1919 advisory. A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privile...

A Hacker’s Mind is Out in Paperback

The paperback version of A Hackers Mind has just been published. Its the same book, only a cheaper format. But--and this is the real reason I am posting this--Amazon has significantly discounted the hardcover to $15 to get rid of its stock. This is much cheaper than I am selling it for, and cheap...

Amazon Web Services Detected

This is an informational notice that the scanner was able to detect that the target application is using an Amazon Web Services cloud service. No source data...

Medium: python-jinja2

Issue Overview: Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja xmlattr filter...

Low: redis6

Issue Overview: Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time,...

Amazon Linux 2023 : indent (ALAS2023-2024-504)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-504 advisory. A flaw was found in Indent. This issue may allow a local user to use a specially-crafted file to trigger a heap-based buffer overflow, which can lead to an application crash. CVE-2024-0911 Tenable has...

Amazon Linux 2 : pcre2 (ALAS-2024-2449)

The version of pcre2 installed on the remote host is prior to 10.23-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2449 advisory. Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts...

Amazon Linux 2 : thunderbird (ALAS-2024-2440)

The version of thunderbird installed on the remote host is prior to 115.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2440 advisory. An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitabl...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-048)

"The version of kernel installed on the remote host is prior to 5.10.209-198.812. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-048 advisory. 2024-12-05: CVE-2023-52683 was added to this advisory. 2024-12-05: CVE-2023-52693 was added to this...

Amazon Linux 2 : kernel (ALAS-2024-2443)

"The version of kernel installed on the remote host is prior to 4.14.336-255.557. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2443 advisory. An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 netfilter:...

Amazon Linux 2 : python-jinja2 (ALAS-2024-2436)

The version of python-jinja2 installed on the remote host is prior to 2.7.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2436 advisory. Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. I...

Amazon Linux 2023 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2023-2024-515)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-515 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allow...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2024-017)

The version of tomcat installed on the remote host is prior to 8.5.69-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2024-017 advisory. 2024-02-15: CVE-2021-30640 was added to this advisory. 2024-02-15: CVE-2021-33037 was added to this advisory. A...

Amazon Linux AMI : squid (ALAS-2024-1916)

The version of squid installed on the remote host is prior to 3.5.20-17.54. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1916 advisory. Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1...

Amazon Linux 2023 : redis6 (ALAS2023-2024-513)

The version of redis6 installed on the remote host is prior to 6.2.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-513 advisory. - Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its...

Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2024-512)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-512 advisory. Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 which was about the expression parameter...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-036)

"The version of kernel installed on the remote host is prior to 5.15.148-97.158. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-036 advisory. 2024-12-05: CVE-2023-52683 was added to this advisory. 2024-12-05: CVE-2023-52693 was added to this...

Amazon Linux AMI : sudo (ALAS-2024-1917)

The version of sudo installed on the remote host is prior to 1.8.23-10.58. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1917 advisory. 2024-02-23: CVE-2023-42465 was removed from this advisory. 2024-02-23: The severity of this advisory has been changed from importa...