Multi-vendor BIOS Security Vulnerabilities (February, 2024) - Lenovo Support US

No description provided...

The vulnerability of the microprogramming software of AMI MegaRAC SP-X controllers allows a perpetrator to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of the microprogramming software of AMI MegaRAC SP-X controllers relates to reading data outside the buffer in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of data...

Amazon Linux AMI : squid (ALAS-2024-1916)

The version of squid installed on the remote host is prior to 3.5.20-17.54. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1916 advisory. Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1...

Amazon Linux AMI : libtiff (ALAS-2024-1913)

The version of libtiff installed on the remote host is prior to 4.0.3-35.50. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1913 advisory. An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen API may allow a remote attacker to cause a...

Amazon Linux AMI : postfix (ALAS-2024-1914)

The version of postfix installed on the remote host is prior to 2.6.6-2.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1914 advisory. Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpddatarestrictions=rejectunauthpipelining and...

Amazon Linux AMI : cacti (ALAS-2024-1915)

The version of cacti installed on the remote host is prior to 1.1.19-6.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1915 advisory. Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection SQLi vulnerabili...

Amazon Linux AMI : sudo (ALAS-2024-1917)

The version of sudo installed on the remote host is prior to 1.8.23-10.58. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1917 advisory. 2024-02-23: CVE-2023-42465 was removed from this advisory. 2024-02-23: The severity of this advisory has been changed from importa...

Amazon Linux AMI : kernel (ALAS-2024-1912)

"The version of kernel installed on the remote host is prior to 4.14.336-179.557. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2024-1912 advisory. An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 netfilter:...

Amazon Linux AMI : runc (ALAS-2024-1911)

The version of runc installed on the remote host is prior to 1.1.11-1.1. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1911 advisory. AWS is aware of CVE-2024-21626, an issue affecting the runc component of several open source container management systems. Under...

AMI UEFI Firmware January 2024 EDK II Reference Vulnerabilities

Potential EDK II reference code vulnerabilities have been identified in certain HP PC products using AMI UEFI Firmware system BIOS, which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerabilities. AMI has released updates to mitigate the potential...

Amazon Linux AMI : tomcat8 (ALAS-2024-1909)

The version of tomcat8 installed on the remote host is prior to 8.5.96-1.96. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1909 advisory. Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.1...

Amazon Linux AMI : exim (ALAS-2024-1908)

The version of exim installed on the remote host is prior to 4.92-1.40. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1908 advisory. Exim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to...

Amazon Linux AMI : nss-softokn (ALAS-2024-1907)

The version of nss-softokn installed on the remote host is prior to 3.53.1-6.49. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1907 advisory. It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of t...

Amazon Linux AMI : perl-Spreadsheet-ParseExcel (ALAS-2024-1905)

The version of perl-Spreadsheet-ParseExcel installed on the remote host is prior to 0.5900-5.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1905 advisory. Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel i...

Amazon Linux AMI : kernel (ALAS-2024-1906)

The version of kernel installed on the remote host is prior to 4.14.336-178.554. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1906 advisory. An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue coul...

AMI MegaRAC Vulnerabilities - Lenovo Support US

No description provided...

CVE-2023-37297

AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability...

CVE-2023-37293

AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability...

CVE-2023-37294

AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability...

CVE-2023-34333

AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference via a local network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability...