Amazon Linux 2 : gstreamer-plugins-base (ALAS-2024-2407)

The version of gstreamer-plugins-base installed on the remote host is prior to 0.10.36-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2407 advisory. A flaw was found in gstreamer-plugins-base where an out-of-bounds read when handling certain ID3v2 tags is...

Medium: jetty

Issue Overview: For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. Thi...

Amazon Linux 2 : python-urllib3 (ALAS-2024-2387)

The version of python-urllib3 installed on the remote host is prior to 1.25.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2387 advisory. urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-019)

The version of firefox installed on the remote host is prior to 115.5.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-019 advisory. On some systems--depending on the graphics settings and drivers--it was possible to force an out-of-bounds read an...

Amazon Linux 2 : jetty (ALAS-2024-2394)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2394 advisory. Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a...

Amazon Linux AMI : vim (ALAS-2024-1902)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2024-1902 advisory. Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be...

Amazon Linux 2 : snakeyaml (ALAS-2024-2403)

The version of snakeyaml installed on the remote host is prior to 1.11-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2403 advisory. Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is runnin...

Amazon Linux 2 : squid (ALAS-2024-2381)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2381 advisory. Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug...

Amazon Linux 2 : net-snmp (ALAS-2024-2402)

The version of net-snmp installed on the remote host is prior to 5.7.2-49. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2402 advisory. handleipv6IpForwarding in agent/mibgroup/ip-mib/ipscalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that...

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2024-006)

The version of java-11-openjdk installed on the remote host is prior to 11.0.21.0.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2JAVA-OPENJDK11-2024-006 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE component: JSSE...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-045)

The version of kernel installed on the remote host is prior to 5.10.205-195.804. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-045 advisory. A race condition leading to a use-after-free issue was found in the QXL driver in the Linux kernel...

Important: bluez

Issue Overview: bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution CVE-2023-45866 Affected Packages: bluez Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL...

Amazon Linux 2 : libXpm (ALAS-2024-2389)

The version of libXpm installed on the remote host is prior to 3.5.12-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2389 advisory. A vulnerability was found in libX11 due to an infinite loop within the PutSubImage function. This flaw allows a local user to consu...

Medium: dmidecode

Issue Overview: Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. CVE-2023-30630 Affected Packages: dmidecode Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Vis...

Amazon Linux 2 : squid (ALAS-2024-2382)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2382 advisory. 2024-02-29: CVE-2024-25617 was added to this advisory. 2024-02-29: CVE-2023-49285 was removed from this advisory. 2024-02-29: The...

Amazon Linux 2 : perl-HTTP-Daemon (ALAS-2024-2405)

The version of perl-HTTP-Daemon installed on the remote host is prior to 6.01-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2405 advisory. HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which cou...

Amazon Linux 2 : kernel (ALAS-2024-2391)

The version of kernel installed on the remote host is prior to 4.14.334-252.552. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2391 advisory. 2024-12-05: CVE-2023-52809 was added to this advisory. 2024-12-05: CVE-2023-52759 was added to this advisory...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2024-2397)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.392.b08-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2397 advisory. Vulnerability in Oracle Java SE component: CORBA. Supported versions that are affected are Oracle Java...

Amazon Linux AMI : kernel (ALAS-2024-1899)

The version of kernel installed on the remote host is prior to 4.14.334-177.552. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2024-1899 advisory. 2024-07-03: CVE-2023-52813 was added to this advisory. 2024-06-07: CVE-2023-52881 was added to this advisory...

Amazon Linux 2 : dmidecode (ALAS-2024-2395)

The version of dmidecode installed on the remote host is prior to 3.2-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2395 advisory. Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of...