Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2023-003)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2OPENSSL-SNAPSAFE-2023-003 advisory. Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-054 (ALASKERNEL-5.4-2023-054)

The version of kernel installed on the remote host is prior to 5.4.253-167.359. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-054 advisory. A use-after-free flaw was found in btrfssearchslot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This...

Amazon Linux AMI : ghostscript (ALAS-2023-1853)

The version of ghostscript installed on the remote host is prior to 8.70-24.32. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1853 advisory. A divide by zero issue discovered in epsprintpage in gdevepsn.c in Artifex Software GhostScript 9.50 allows remote attackers ...

Amazon Linux AMI : vim (ALAS-2023-1837)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1837 advisory. Use After Free in GitHub repository vim/vim prior to 9.0.1840. CVE-2023-4733 Use After Free in GitHub repository vim/vim prior to 9.0.1857. CVE-2023-4750 Use After Free in GitHub repository vim/vi...

Amazon Linux AMI : containerd (ALAS-2023-1849)

The version of containerd installed on the remote host is prior to 1.4.13-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1849 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the...

Amazon Linux AMI : libtiff (ALAS-2023-1847)

The version of libtiff installed on the remote host is prior to 4.0.3-35.47. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1847 advisory. A vulnerability was found in libtiff library. This security flaw causes a heap buffer overflow issue via TIFFTAGINKNAMES and...

Amazon Linux AMI : libtiff (ALAS-2023-1846)

The version of libtiff installed on the remote host is prior to 4.0.3-35.46. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1846 advisory. A NULL pointer dereference in TIFFClose is caused by a failure to open an output file non-existent path or a path that requires...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-027 (ALASKERNEL-5.15-2023-027)

The version of kernel installed on the remote host is prior to 5.15.133-86.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-027 advisory. An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds...

Amazon Linux AMI : poppler (ALAS-2023-1850)

The version of poppler installed on the remote host is prior to 0.26.5-43.26. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1850 advisory. An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service D...

Amazon Linux AMI : poppler (ALAS-2023-1852)

The version of poppler installed on the remote host is prior to 0.26.5-43.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1852 advisory. Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via craft...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-014)

The version of firefox installed on the remote host is prior to 102.15.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-014 advisory. Memory corruption in IPC CanvasTranslator CVE-2023-4573 Memory corruption in IPC ColorPickerShownCallback...

Amazon Linux AMI : ghostscript (ALAS-2023-1854)

The version of ghostscript installed on the remote host is prior to 8.70-24.31. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1854 advisory. A buffer overflow vulnerability in pcxwriterle in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a...

Amazon Linux AMI : ImageMagick (ALAS-2023-1844)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.29. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1844 advisory. A vulnerability was found in ImageMagick. This issue occurs as an undefined behavior, casting double to sizet in svg, mvg...

Amazon Linux 2 : djvulibre (ALASMATE-DESKTOP1.X-2023-003)

The version of djvulibre installed on the remote host is prior to 3.5.27-30. It is, therefore, affected by a vulnerability as referenced in the ALAS2MATE-DESKTOP1.X-2023-003 advisory. An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via...

Amazon Linux AMI : mutt (ALAS-2023-1836)

The version of mutt installed on the remote host is prior to 1.5.20-7.20091214hg736b6a.10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1836 advisory. Null pointer dereference when viewing a specially crafted email in Mutt 1.5.2 1.5.2 2.2.12 CVE-2023-4875...

Amazon Linux AMI : cacti (ALAS-2023-1842)

The version of cacti installed on the remote host is prior to 1.1.19-4.22. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1842 advisory. Cacti is an open source operational monitoring and fault management framework. A defect in the sqlsave function was discovered. Wh...

Amazon Linux AMI : golang (ALAS-2023-1848)

The version of golang installed on the remote host is prior to 1.20.8-1.47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1848 advisory. 2024-01-03: CVE-2023-24537 was added to this advisory. 2024-01-03: CVE-2023-29400 was added to this advisory. 2024-01-03...

Amazon Linux AMI : libtiff (ALAS-2023-1855)

The version of libtiff installed on the remote host is prior to 4.0.3-35.48. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1855 advisory. The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service invalid read and crash vi...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-040 (ALASKERNEL-5.10-2023-040)

The version of kernel installed on the remote host is prior to 5.10.196-185.743. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-040 advisory. An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bound...

Medium: libtiff

Issue Overview: libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage in tiffcrop cause heap-buffer-overflow and SEGV. CVE-2023-25433 A vulnerability was found in libtiff library. This security flaw causes a heap...