Amazon Linux 2023 : redis6 (ALAS2023-2024-513)

The version of redis6 installed on the remote host is prior to 6.2.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-513 advisory. - Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-036)

"The version of kernel installed on the remote host is prior to 5.15.148-97.158. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-036 advisory. 2024-12-05: CVE-2023-52683 was added to this advisory. 2024-12-05: CVE-2023-52693 was added to this...

Amazon Linux AMI : cacti (ALAS-2024-1915)

The version of cacti installed on the remote host is prior to 1.1.19-6.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1915 advisory. Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection SQLi vulnerabili...

Amazon Linux 2023 : polkit, polkit-devel, polkit-libs (ALAS2023-2024-508)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-508 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make...

Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2024-505)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-505 advisory. The upstream report describes this issue as follows: When installing a maliciously created Ansible role using 'ansible-galaxy role install', arbitrary files the user has access to can be...

Amazon Linux 2023 : pam, pam-devel (ALAS2023-2024-502)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-502 advisory. A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with /tmp mounted as a polyinstantiated dir can place a FIFO there, and a subsequent attem...

Amazon Linux 2 : sudo (ALAS-2024-2447)

The version of sudo installed on the remote host is prior to 1.8.23-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2447 advisory. 2024-02-22: CVE-2023-42465 was removed from this advisory. 2024-02-22: The severity of this advisory has been changed from important...

Amazon Linux 2 : wireshark (ALAS-2024-2441)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2441 advisory. IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injecti...

Amazon Linux 2 : kernel (ALAS-2024-2448)

The version of kernel installed on the remote host is prior to 4.14.305-227.531. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2448 advisory. A memory corruption flaw was found in the Linux kernel's human interface device HID subsystem in how a user inserts a...

Low: indent

Issue Overview: A flaw was found in Indent. This issue may allow a local user to use a specially-crafted file to trigger a heap-based buffer overflow, which can lead to an application crash. CVE-2024-0911 Affected Packages: indent Issue Correction: Run dnf update indent --releasever 2023.3.202402...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-037)

The version of kernel installed on the remote host is prior to 5.15.93-55.139. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-037 advisory. A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol L2TP. A missing lock when clearing...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-059)

"The version of kernel installed on the remote host is prior to 5.4.268-181.368. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-059 advisory. 2024-12-05: CVE-2023-52683 was added to this advisory. 2024-12-05: CVE-2023-52679 was added to this...

Amazon Linux 2 : nss (ALAS-2024-2442)

The version of nss installed on the remote host is prior to 3.90.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2442 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord...

Amazon Linux 2 : snakeyaml (ALAS-2024-2450)

The version of snakeyaml installed on the remote host is prior to 1.11-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2450 advisory. Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user...

Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2024-514)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-514 advisory. 2024-02-26: The severity of this advisory has been changed from important to low. Sudo before 1.9.15 might allow row hammer attacks for authentication bypass or privilege escalation because application...

Amazon Linux AMI : libtiff (ALAS-2024-1913)

The version of libtiff installed on the remote host is prior to 4.0.3-35.50. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1913 advisory. An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen API may allow a remote attacker to cause a...

Amazon Linux 2 : cri-tools (ALAS-2024-2446)

The version of cri-tools installed on the remote host is prior to 1.29.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2446 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read ma...

Amazon Linux 2 : indent (ALAS-2024-2439)

The version of indent installed on the remote host is prior to 2.2.11-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2439 advisory. A flaw was found in Indent. This issue may allow a local user to use a specially-crafted file to trigger a heap-based buffer...

Amazon Linux 2 : squid (ALAS-2024-2433)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2433 advisory. Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial...

Amazon Linux 2 : python3-jinja2 (ALAS-2024-2437)

The version of python3-jinja2 installed on the remote host is prior to 2.7.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2437 advisory. Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. ...