Amazon Linux AMI : php56 (ALAS-2023-1879)

The version of php56 installed on the remote host is prior to 5.6.40-1.144. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1879 advisory. In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause...

Amazon Linux AMI : libxml2 (ALAS-2023-1874)

The version of libxml2 installed on the remote host is prior to 2.9.1-6.6.44. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1874 advisory. libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in...

Amazon Linux AMI : shadow-utils (ALAS-2023-1873)

The version of shadow-utils installed on the remote host is prior to 4.1.4.2-13.11. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1873 advisory. A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password...

Amazon Linux AMI : python27 (ALAS-2023-1876)

The version of python27 installed on the remote host is prior to 2.7.18-2.148. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1876 advisory. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It...

Amazon Linux AMI : libXpm (ALAS-2023-1875)

The version of libXpm installed on the remote host is prior to 3.5.10-2.12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1875 advisory. A vulnerability was found in libX11 due to an infinite loop within the PutSubImage function. This flaw allows a local us...

Amazon Linux AMI : expat (ALAS-2023-1882)

The version of expat installed on the remote host is prior to 2.1.0-15.34. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1882 advisory. Expat aka libexpat before 2.4.4 has an integer overflow in the doProlog function. CVE-2022-23990 Tenable has extracted the precedi...

Amazon Linux AMI : python27 (ALAS-2023-1880)

The version of python27 installed on the remote host is prior to 2.7.18-2.149. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1880 advisory. An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity...

Amazon Linux AMI : squid (ALAS-2023-1872)

The version of squid installed on the remote host is prior to 3.5.20-17.50. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1872 advisory. Due to a buffer overflow bug Squid is vulnerable to a Denial of Service attack against HTTP Digest Authentication CVE-2023-46847...

Amazon Linux AMI : tomcat8 (ALAS-2023-1861)

The version of tomcat8 installed on the remote host is prior to 8.5.93-1.94. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1861 advisory. Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the...

Amazon Linux AMI : ghostscript (ALAS-2023-1867)

The version of ghostscript installed on the remote host is prior to 8.70-24.33. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1867 advisory. A buffer overflow vulnerability in epscprintpage in devices/gdevepsc.c of Artifex Software GhostScript v9.50 allows a remote...

Amazon Linux AMI : apache-ivy (ALAS-2023-1863)

The version of apache-ivy installed on the remote host is prior to 2.2.0-5.2. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1863 advisory. Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software...

Amazon Linux AMI : amazon-ssm-agent (ALAS-2023-1866)

The version of amazon-ssm-agent installed on the remote host is prior to 3.2.1705.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1866 advisory. 2023-10-30: CVE-2023-24540 was added to this advisory. The x/crypto/ssh package before...

Amazon Linux AMI : mutt (ALAS-2023-1865)

The version of mutt installed on the remote host is prior to 1.5.20-7.20091214hg736b6a.11. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1865 advisory. A flaw was found in mutt. When reading unencoded messages, mutt uses the line length from the untrusted input...

Amazon Linux AMI : ImageMagick (ALAS-2023-1856)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.30. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1856 advisory. A vulnerability was found in ImageMagick where heap use-after-free was found in coders/bmp.c. CVE-2023-5341 Tenable has...

Amazon Linux AMI : cups (ALAS-2023-1857)

The version of cups installed on the remote host is prior to 1.4.2-67.25. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1857 advisory. A vulnerability was found in OpenPrinting CUPS. The security flaw occurs due to failure in validating the length provided by an...

Amazon Linux AMI : cacti (ALAS-2023-1862)

The version of cacti installed on the remote host is prior to 1.1.19-5.23. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1862 advisory. Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions,...

Amazon Linux AMI : libX11 (ALAS-2023-1859)

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1859 advisory. libX11: out-of-bounds memory access in XkbReadKeySyms CVE-2023-43785 libX11: integer overflow in XCreateImage leading t...

Amazon Linux AMI : nginx (ALAS-2023-1870)

The version of nginx installed on the remote host is prior to 1.18.0-1.45. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1870 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux AMI : tomcat8 (ALAS-2023-1868)

The version of tomcat8 installed on the remote host is prior to 8.5.94-1.95. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1868 advisory. Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from...

Amazon Linux AMI : golang (ALAS-2023-1871)

The version of golang installed on the remote host is prior to 1.20.10-1.48. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1871 advisory. Line directives //line can be used to bypass the restrictions on //go:cgo directives, allowing blocked linker and...