Amazon Linux AMI : tomcat8 (ALAS-2023-1779)

The version of tomcat8 installed on the remote host is prior to 8.5.89-1.93. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1779 advisory. The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.8...

Amazon Linux 2 : qemu, --advisory ALAS2-2023-2148 (ALAS-2023-2148)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2148 advisory. A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including...

Amazon Linux 2 : protobuf-c (ALAS-2023-2142)

The version of protobuf-c installed on the remote host is prior to 1.0.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2142 advisory. protobuf-c before 1.4.1 has an unsigned integer overflow in parserequiredmember. CVE-2022-48468 Tenable has extracted the...

Amazon Linux 2 : grub2 (ALAS-2023-2146)

The version of grub2 installed on the remote host is prior to 2.06-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2146 advisory. A flaw was found in grub 2, where a crafted 16-bit grayscale PNG image may lead to an out-of-bounds write. This flaw allows ...

Amazon Linux 2 : ImageMagick (ALAS-2023-2123)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2123 advisory. The upstream bug report describes this issue as follows:A vulnerability was found in ImageMagick =7.1.1, where heap-based...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2023-240)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-240 advisory. A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order,...

Amazon Linux 2023 : libX11, libX11-common, libX11-devel (ALAS2023-2023-250)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-250 advisory. A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the...

Amazon Linux 2 : flatpak (ALAS-2023-2134)

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2134 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8,...

Amazon Linux 2023 : python3-tornado (ALAS2023-2023-239)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-239 advisory. Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access...

Amazon Linux AMI : cups (ALAS-2023-1777)

The version of cups installed on the remote host is prior to 1.4.2-67.22. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1777 advisory. A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection...

Amazon Linux 2 : iniparser (ALAS-2023-2124)

The version of iniparser installed on the remote host is prior to 3.1-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2124 advisory. iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparsergetlongint which misses check NULL for function...

Amazon Linux 2 : python-tornado (ALAS-2023-2132)

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2132 advisory. Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a use...

Amazon Linux 2 : c-ares (ALAS-2023-2127)

The version of c-ares installed on the remote host is prior to 1.10.0-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2127 advisory. Denial of Service. An issue in c-ares was found where a 0-byte UDP payload can cause a Denial of Service CVE-2023-32067. Tenable ha...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-251)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-251 advisory. A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and write...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2023-241)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-241 advisory. This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. Database owners have that right by default, and explicit grants may extend it to oth...

Amazon Linux AMI : ncurses (ALAS-2023-1778)

The version of ncurses installed on the remote host is prior to 5.7-4.20090207.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1778 advisory. ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security- relevant memory...

Amazon Linux 2 : bind (ALAS-2023-2112)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2112 advisory. A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be severely diminished by...

Amazon Linux 2 : gstreamer-plugins-base (ALAS-2023-2121)

The version of gstreamer-plugins-base installed on the remote host is prior to 0.10.36-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2121 advisory. Integer overflow leading to heap overwrite in FLAC image tag handling CVE-2023-37327 Tenable has extracted the...

Medium: cups

Issue Overview: A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data immediately before the connection closed, resulting in a use-after-free in cupsdAcceptClient in...

Medium: libmicrohttpd

Issue Overview: GNU libmicrohttpd before 0.9.76 allows remote DoS Denial of Service due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHDcreatepostprocessor method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0'...