Amazon Linux 2 : libmicrohttpd (ALAS-2023-2135)

The version of libmicrohttpd installed on the remote host is prior to 0.9.33-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2135 advisory. GNU libmicrohttpd before 0.9.76 allows remote DoS Denial of Service due to improper parsing of a multipart/form-data boundar...

Amazon Linux 2 : zstd (ALAS-2023-2140)

The version of zstd installed on the remote host is prior to 1.5.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2140 advisory. In zstd, supplying an empty string as an argument to either --output-dir-flat or --output-dir-mirror may cause a buffer overrun...

Amazon Linux 2023 : python3-wheel, python3-wheel-wheel (ALAS2023-2023-261)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-261 advisory. An issue discovered in Python Packaging Authority PyPA Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. CVE-2022-40898 Tenable ha...

Amazon Linux 2 : libcap (ALAS-2023-2136)

The version of libcap installed on the remote host is prior to 2.54-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2136 advisory. libcap is vulnerable to a denial of service caused by the error handling in wrappthreadcreate function, which will cause memory to be...

Amazon Linux 2 : open-vm-tools (ALAS-2023-2139)

The version of open-vm-tools installed on the remote host is prior to 12.2.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2139 advisory. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the...

Amazon Linux 2 : libzapojit (ALAS-2023-2144)

The version of libzapojit installed on the remote host is prior to 0.0.3-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2144 advisory. In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-037 (ALASKERNEL-5.10-2023-037)

The version of kernel installed on the remote host is prior to 5.10.184-175.749. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-037 advisory. A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-255)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-255 advisory. LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from source...

Amazon Linux 2 : python-pillow (ALAS-2023-2118)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2118 advisory. The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service ReDoS via the...

Amazon Linux 2 : mc (ALAS-2023-2147)

The version of mc installed on the remote host is prior to 4.8.29-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2147 advisory. An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is...

Amazon Linux 2023 : jackson-core (ALAS2023-2023-248)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-248 advisory. An issue was discovered jackson-databind thru 2.15.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-35116 Tenable h...

Amazon Linux 2023 : python3-requests, python3-requests+security, python3-requests+socks (ALAS2023-2023-236)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-236 advisory. A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy- Authorization headers to destination servers, specifically during redirects to an HTTPS origin. This...

Amazon Linux 2023 : open-vm-tools, open-vm-tools-desktop, open-vm-tools-devel (ALAS2023-2023-259)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-259 advisory. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. CVE-2023-20867 Tenable ha...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2023-2137)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.20+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2137 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product...

Amazon Linux 2 : pidgin (ALAS-2023-2115)

The version of pidgin installed on the remote host is prior to 2.10.11-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2115 advisory. An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to...

Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2023-256)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-256 advisory. 2023-07-20: The severity level was changed from low to medium. Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u371. Difficult to...

Amazon Linux AMI : golang (ALAS-2023-1784)

The version of golang installed on the remote host is prior to 1.18.6-1.45. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1784 advisory. The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a g...

Amazon Linux 2023 : libzstd, libzstd-devel, libzstd-static (ALAS2023-2023-244)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-244 advisory. In zstd, supplying an empty string as an argument to either --output-dir-flat or --output-dir-mirror may cause a buffer overrun. CVE-2022-4899 Tenable has extracted the preceding description block...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2023-2138)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.8+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2138 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product ...

Amazon Linux AMI : python-imaging (ALAS-2023-1787)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1787 advisory. Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the crafted image file approach, related to an Insecure Sign Extension issue affecting the ImagingNew in Storage.c...