Amazon Linux AMI : mutt (ALAS-2023-1865)

The version of mutt installed on the remote host is prior to 1.5.20-7.20091214hg736b6a.11. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1865 advisory. A flaw was found in mutt. When reading unencoded messages, mutt uses the line length from the untrusted input...

Amazon Linux AMI : amazon-ssm-agent (ALAS-2023-1866)

The version of amazon-ssm-agent installed on the remote host is prior to 3.2.1705.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1866 advisory. 2023-10-30: CVE-2023-24540 was added to this advisory. The x/crypto/ssh package before...

Amazon Linux AMI : apache-ivy (ALAS-2023-1863)

The version of apache-ivy installed on the remote host is prior to 2.2.0-5.2. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1863 advisory. Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software...

Amazon Linux AMI : nss-softokn (ALAS-2023-1858)

The version of nss-softokn installed on the remote host is prior to 3.53.1-6.48. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1858 advisory. new tlsfuzzer code can still detect timing issues in RSA operations CVE-2023-4421 Tenable has extracted the preceding...

Amazon Linux AMI : exim (ALAS-2023-1860)

The version of exim installed on the remote host is prior to 4.92-1.39. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1860 advisory. Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability NOTE:...

Amazon Linux AMI : libX11 (ALAS-2023-1859)

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1859 advisory. libX11: out-of-bounds memory access in XkbReadKeySyms CVE-2023-43785 libX11: integer overflow in XCreateImage leading t...

Amazon Linux AMI : ImageMagick (ALAS-2023-1856)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.30. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1856 advisory. A vulnerability was found in ImageMagick where heap use-after-free was found in coders/bmp.c. CVE-2023-5341 Tenable has...

Amazon Linux AMI : cups (ALAS-2023-1857)

The version of cups installed on the remote host is prior to 1.4.2-67.25. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1857 advisory. A vulnerability was found in OpenPrinting CUPS. The security flaw occurs due to failure in validating the length provided by an...

Amazon Linux AMI : cacti (ALAS-2023-1862)

The version of cacti installed on the remote host is prior to 1.1.19-5.23. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1862 advisory. Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions,...

Medium: java-17-amazon-corretto

Issue Overview: Memory corruption bug on JDK 21 and 20 when AVX-512 is enabled. CVE-2023-22025 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 20.0.2...

Medium: ImageMagick

Issue Overview: 2024-06-06: CVE-2021-20309 was added to this advisory. A flaw was found in ImageMagick, where a division by zero in WaveImage of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat fr...

Important: runc

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: runc Issue Correction: Run dnf update runc --releaseve...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2023-400)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-400 advisory. Memory corruption bug on JDK 21 and 20 when AVX-512 is enabled. CVE-2023-22025 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE component: JSSE. Supported...

Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2023-399)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-399 advisory. Memory corruption bug on JDK 21 and 20 when AVX-512 is enabled. CVE-2023-22025 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE component: JSSE. Supported...

Amazon Linux 2023 : giflib, giflib-devel, giflib-utils (ALAS2023-2023-386)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-386 advisory. giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c. CVE-2023-39742 Tenable has extracted the preceding description block directly from the tested product security...

Medium: vim

Issue Overview: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969. CVE-2023-5344 Affected Packages: vim Issue Correction: Run dnf update vim --releasever 2023.2.20231018 or dnf update --advisory ALAS2023-2023-378 --releasever 2023.2.20231018 to update your system. More...

Important: amazon-ssm-agent

Issue Overview: The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. CVE-2021-43565 A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to fail authentification with R...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-385)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-385 advisory. In the Linux kernel, the following vulnerability has been resolved: ceph: drop messages from MDS when unmounting CVE-2022-48628 A use-after-free vulnerability in the Linux kernel's netfilter:...

Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2023-398)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-398 advisory. Vulnerability in Oracle Java SE component: CORBA. Supported versions that are affected are Oracle Java SE: 8u381 and 8u381-perf. Easily exploitable vulnerability allows unauthenticated attacker...

Amazon Linux 2023 : docker (ALAS2023-2023-397)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-397 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...