Low: containerd

Issue Overview: No CVE associated with this advisory Affected Packages: containerd Note: This advisory is applicable to Amazon Linux 2 - Docker Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories...

Amazon Linux 2 : thunderbird (ALAS-2024-2417)

The version of thunderbird installed on the remote host is prior to 115.6.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2417 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function...

Amazon Linux AMI : tomcat8 (ALAS-2024-1909)

The version of tomcat8 installed on the remote host is prior to 8.5.96-1.96. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1909 advisory. Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.1...

Amazon Linux 2 : postfix (ALAS-2024-2420)

The version of postfix installed on the remote host is prior to 2.10.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2420 advisory. Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpddatarestrictions=rejectunauthpipelining and...

Amazon Linux 2023 : python3-pycryptodomex, python3-pycryptodomex-selftest (ALAS2023-2024-494)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-494 advisory. PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. CVE-2023-52323 Tenable has extracted the preceding description block directl...

Amazon Linux 2 : webkitgtk4, --advisory ALAS2-2024-2427 (ALAS-2024-2427)

The version of webkitgtk4 installed on the remote host is prior to 2.42.3-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2427 advisory. Impact: Visiting a website that frames malicious content may lead to UI spoofing. Description: The issue was addressed...

Amazon Linux 2 : dbus (ALAS-2024-2428)

The version of dbus installed on the remote host is prior to 1.10.24-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2428 advisory. D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon...

Amazon Linux 2 : wireshark (ALAS-2024-2416)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2416 advisory. GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-493)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-493 advisory. When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 Packet Too Big PTB message to the sender. The sender caches this updated Maximum Transmission Unit MTU so...

Amazon Linux 2 : rust (ALAS-2024-2426)

The version of rust installed on the remote host is prior to 1.68.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2426 advisory. Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not esca...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2024-499)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-499 advisory. 2024-08-09: CVE-2023-47108 was removed from this advisory. 2024-08-09: The severity of this advisory has been changed from Important to Medium.2024-04-10: CVE-2023-39326 was added to this advisory...

Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2024-486)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-486 advisory. A vulnerability that allows an attacker to execute arbitrary java code from the javascript engine even though the option --no-java was set. CVE-2024-20918 With carefully crafted custom bytecode...

Amazon Linux 2023 : haproxy (ALAS2023-2024-496)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-496 advisory. HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a pathend rule,...

Amazon Linux 2 : traceroute (ALAS-2024-2423)

The version of traceroute installed on the remote host is prior to 2.0.22-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2423 advisory. In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. CVE-2023-46316...

Amazon Linux 2 : qt5-qtbase (ALAS-2024-2421)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2421 advisory. An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, a...

Important: firefox

Issue Overview: A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is...

Amazon Linux 2 : ghostscript (ALAS-2024-2422)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2422 advisory. An issue was discovered in the function gdevprnopenprinterseekable in Artifex Ghostscript through 10.02.0 allows remote attacker...

Important: kernel

Issue Overview: An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information. CVE-2023-6606 A use-after-free flaw was found in the netfilter subsystem of...

Amazon Linux 2023 : postfix, postfix-cdb, postfix-ldap (ALAS2023-2024-495)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-495 advisory. Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpddatarestrictions=rejectunauthpipelining and smtpddiscardehlokeywords=chunking or certain other options that exist in recent...

Amazon Linux AMI : apache-ivy (ALAS-2024-1910)

The version of apache-ivy installed on the remote host is prior to 2.2.0-5.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1910 advisory. When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied pattern...