Medium: containerd

Issue Overview: A flaw was found in containerd where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host's filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-030)

The version of kernel installed on the remote host is prior to 5.15.137-91.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-030 advisory. 2024-06-06: CVE-2023-52476 was added to this advisory. An issue was discovered in the Linux kernel before...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-017)

The version of firefox installed on the remote host is prior to 115.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-017 advisory. A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportu...

Medium: vim

Issue Overview: Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function gagrowinner in in the file src/alloc.c at line 748, which is freed in the file src/exdocmd.c in the function docmdline at line 1010 and then used again in src/cmdhist...

Amazon Linux 2 : thunderbird (ALAS-2023-2334)

The version of thunderbird installed on the remote host is prior to 115.4.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2334 advisory. The Mozilla Foundation Security Advisory describes this flaw as: It was possible for certain browser prompts and...

Medium: amazon-efs-utils

Issue Overview: efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to mount file systems, the mount helper allocates a local port for stunnel to...

Amazon Linux 2 : ctags (ALAS-2023-2343)

The version of ctags installed on the remote host is prior to 5.8-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2343 advisory. A flaw was found in Exuberant Ctags in the way it handles the -o option. This option specifies the tag filename. A crafted tag filenam...

Amazon Linux 2023 : amazon-efs-utils (ALAS2023-2023-437)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-437 advisory. efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to...

Amazon Linux 2 : kernel (ALAS-2023-2340)

The version of kernel installed on the remote host is prior to 4.14.328-248.540. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2340 advisory. 2024-06-06: CVE-2023-52477 was added to this advisory. A race condition between two functions, lmLogClose and txEn...

Medium: re2c

Issue Overview: A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/deadrules.cc. CVE-2022-23901 Affected Packages: re2c Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2023-436)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-436 advisory. 2024-03-27: CVE-2023-23908 was added to this advisory. An issue was found in redundant REX instruction prefix values affecting third generation Intel Xeon Scalable Icelake processors. The issue...

Amazon Linux 2 : re2c (ALAS-2023-2344)

The version of re2c installed on the remote host is prior to 3.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2344 advisory. A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/deadrules.cc. CVE-2022-23901 Tenable has extracted the...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-431)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-431 advisory. Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function gagrowinner in in the file src/alloc.c at line 748, which is freed in the file...

Amazon Linux 2 : nerdctl (ALAS-2023-2339)

The version of nerdctl installed on the remote host is prior to 1.6.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2339 advisory. 2024-02-01: CVE-2023-3978 was added to this advisory. The HTTP/2 protocol allows a denial of service server resource...

Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2023-433)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-433 advisory. Out-of-bounds Read vulnerability in modmacro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. CVE-2023-31122 A flaw was found in httpd. This flaw allows an attacker...

Amazon Linux 2 : ruby (ALAS-2023-2345)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2345 advisory. A flaw was found in ruby, where the date object was found to be vulnerable to a regular expression denial of service ReDoS during...

Amazon Linux 2 : amazon-efs-utils (ALAS-2023-2342)

The version of amazon-efs-utils installed on the remote host is prior to 1.35.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2342 advisory. efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the...

Amazon Linux 2 : microcode_ctl (ALAS-2023-2341)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2341 advisory. An issue was found in redundant REX instruction prefix values affecting third generation Intel Xeon Scalable Icelake processors...

Amazon Linux 2 : qt5-qtimageformats (ALAS-2023-2337)

The version of qt5-qtimageformats installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2337 advisory. Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of...

Amazon Linux 2023 : python3-twisted, python3-twisted+tls (ALAS2023-2023-432)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-432 advisory. Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously...