Amazon Linux AMI : libtiff (ALAS-2024-1913)

The version of libtiff installed on the remote host is prior to 4.0.3-35.50. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1913 advisory. An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen API may allow a remote attacker to cause a...

Amazon Linux 2 : snakeyaml (ALAS-2024-2450)

The version of snakeyaml installed on the remote host is prior to 1.11-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2450 advisory. Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user...

Amazon Linux 2 : nss (ALAS-2024-2442)

The version of nss installed on the remote host is prior to 3.90.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2442 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-059)

"The version of kernel installed on the remote host is prior to 5.4.268-181.368. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-059 advisory. 2024-12-05: CVE-2023-52683 was added to this advisory. 2024-12-05: CVE-2023-52679 was added to this...

Amazon Linux 2 : squid (ALAS-2024-2433)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2433 advisory. Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial...

Amazon Linux 2023 : pam, pam-devel (ALAS2023-2024-502)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-502 advisory. A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with /tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attem...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2024-507)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-507 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make...

Amazon Linux 2 : sudo (ALAS-2024-2447)

The version of sudo installed on the remote host is prior to 1.8.23-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2447 advisory. 2024-02-22: CVE-2023-42465 was removed from this advisory. 2024-02-22: The severity of this advisory has been changed from important...

Amazon Linux 2023 : jasper, jasper-devel, jasper-libs (ALAS2023-2024-511)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-511 advisory. An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code. CVE-2023-51257 Tenable has extracted the preceding description block directl...

Amazon Linux 2023 : systemd, systemd-boot-unsigned, systemd-container (ALAS2023-2024-509)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-509 advisory. systemd-resolved accepts records of DNSSEC-signed domains even when they have no signature, allowing man- in-the-middles or the upstream DNS resolver to manipulate records. CVE-2023-7008 Tenable has...

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2024-007)

The version of java-11-openjdk installed on the remote host is prior to 11.0.22.0.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2024-007 advisory. A vulnerability that allows an attacker to execute arbitrary java code from the javascript engi...

Amazon Linux 2023 : python3-jinja2 (ALAS2023-2024-503)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-503 advisory. Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML...

Amazon Linux 2 : python-pillow (ALAS-2024-2444)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2444 advisory. Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a differe...

Amazon Linux 2 : redis (ALASREDIS6-2024-009)

The version of redis installed on the remote host is prior to 6.2.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2024-009 advisory. Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2024-037)

The version of containerd installed on the remote host is prior to 1.7.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2024-037 advisory. 2024-02-15: CVE-2023-39326 was added to this advisory. 2024-02-15: CVE-2023-47108 was added to this...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2024-516)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-516 advisory. Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote...

Amazon Linux AMI : kernel (ALAS-2024-1912)

"The version of kernel installed on the remote host is prior to 4.14.336-179.557. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2024-1912 advisory. An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 netfilter:...

Amazon Linux 2 : vim (ALAS-2024-2452)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2452 advisory. 2024-02-29: CVE-2023-48706 was added to this advisory. Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a :s command for the very firs...

Amazon Linux 2 : php (ALASPHP8.0-2024-010)

The version of php installed on the remote host is prior to 8.0.24-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2024-010 advisory. 2024-02-15: CVE-2022-31629 was added to this advisory. 2024-02-15: CVE-2022-31628 was added to this advisory. In PHP...

Amazon Linux 2 : containerd (ALASDOCKER-2024-037)

The version of containerd installed on the remote host is prior to 1.7.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2024-037 advisory. 2024-02-15: CVE-2023-39326 was added to this advisory. 2024-02-15: CVE-2023-47108 was added to this advisory. The...