Amazon Linux 2023 : perl-CPAN, perl-CPAN-tests (ALAS2023-2023-182)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-182 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31484 Tenable has...

Amazon Linux 2023 : libwayland-client, libwayland-cursor, libwayland-egl (ALAS2023-2023-203)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-203 advisory. An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the...

Amazon Linux 2023 : ldb-tools, libldb, libldb-devel (ALAS2023-2023-187)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-187 advisory. Access controlled AD LDAP attributes can be discovered CVE-2023-0614 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not...

Amazon Linux 2 : pcre (ALAS-2023-2082)

The version of pcre installed on the remote host is prior to 8.32-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2082 advisory. PCRE before 8.38 mishandles the : and \ substrings in character classes, which allows remote attackers to cause a denial of...

Amazon Linux 2023 : gnuplot-common, gnuplot-latex, gnuplot-minimal (ALAS2023-2023-202)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-202 advisory. A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and application crash. CVE-2021-44917 Tenable has extracted the...

Amazon Linux 2 : python-pillow (ALAS-2023-2083)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2083 advisory. Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in ...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-197)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-197 advisory. Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version between 4.0.0 to 4.0.5, by default, is susceptible to a heap-based buffer overflow, and...

Amazon Linux 2023 : cloud-init (ALAS2023-2023-196)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-196 advisory. Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege. CVE-2023-1786 Tenable...

Amazon Linux 2023 : libwebp, libwebp-devel, libwebp-java (ALAS2023-2023-185)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-185 advisory. A double-free in libwebp could have led to memory corruption and a potentially exploitable crash. CVE-2023-1999 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-190)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-190 advisory. An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved...

Amazon Linux 2 : dnsmasq (ALAS-2023-2069)

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2069 advisory. An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 becau...

Amazon Linux 2 : libfastjson (ALAS-2023-2079)

The version of libfastjson installed on the remote host is prior to 0.99.4-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2079 advisory. A flaw was found in json-c. In printbufmemappend, certain crafted values can overflow the memory allowing an attacker to write...

Amazon Linux 2023 : freetype, freetype-demos, freetype-devel (ALAS2023-2023-188)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-188 advisory. A segmentation fault was found in the FreeType library. This flaw allows an attacker to attempt access to a memory location in a way that could cause an application to halt or crash, leading to...

Amazon Linux 2023 : c-ares, c-ares-devel (ALAS2023-2023-198)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-198 advisory. A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cau...

Amazon Linux 2 : flatpak (ALAS-2023-2076)

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2076 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 a...

Amazon Linux 2 : OpenEXR (ALAS-2023-2078)

The version of OpenEXR installed on the remote host is prior to 1.7.1-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2078 advisory. A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by...

Amazon Linux 2 : curl (ALAS-2023-2070)

The version of curl installed on the remote host is prior to 8.0.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2070 advisory. The curl advisory describes this issue as follows: curl supports communicating using the TELNET protocol and as a part of thi...

Amazon Linux 2023 : libfastjson, libfastjson-devel (ALAS2023-2023-205)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-205 advisory. A flaw was found in json-c. In printbufmemappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundary. The highest threat from this vulnerability is to...

Amazon Linux 2023 : byacc (ALAS2023-2023-204)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-204 advisory. When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory use after free. CVE-2021-33641 When a file is...

Amazon Linux 2 : sysstat (ALAS-2023-2068)

The version of sysstat installed on the remote host is prior to 10.1.5-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2068 advisory. sysstat through 12.7.2 allows a multiplication integer overflow in checkoverflow in common.c. NOTE: this issue exists because of ...