Amazon Linux AMI : dbus (ALAS-2023-1730)

The version of dbus installed on the remote host is prior to 1.6.12-14.31. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1730 advisory. An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An...

CVE-2023-28863

AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity...

CVE-2023-28863

Summary: CVE-2023-28863 affects AMI MegaRAC SPx12/SPx13 IPMI implementations. The issue is Insufficient Verification of Data Authenticity in IPMI 2.0 negotiation, allowing an attacker with network access to bypass negotiated integrity/confidentiality. Affected platforms include iSeries variants (...

CVE-2023-28863

AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity...

Amazon Linux AMI : sssd (ALAS-2023-1723)

The version of sssd installed on the remote host is prior to 1.16.4-21.27. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1723 advisory. A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and...

Amazon Linux AMI : openvpn (ALAS-2023-1719)

The version of openvpn installed on the remote host is prior to 2.4.12-1.43. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1719 advisory. OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of...

Amazon Linux AMI : microcode_ctl (ALAS-2023-1715)

The version of microcodectl installed on the remote host is prior to 2.1-47.41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1715 advisory. 2024-02-14: CVE-2022-38090 was added to this advisory. 2024-02-01: CVE-2022-21216 was added to this advisory...

Amazon Linux AMI : exim (ALAS-2023-1722)

The version of exim installed on the remote host is prior to 4.92-1.36. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1722 advisory. The STARTTLS feature in Exim through 4.94.2 allows response injection buffering during MTA SMTP sending. CVE-2021-38371 Tenable has...

Amazon Linux AMI : yasm (ALAS-2023-1724)

The version of yasm installed on the remote host is prior to 1.2.0-1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1724 advisory. An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasmexprgetintnum in libyasm/expr.c...

Amazon Linux AMI : python-babel (ALAS-2023-1720)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1720 advisory. Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files containing serialized Python objects via directory traversal, leading to code execution. CVE-2021-42771 Tenable has...

Amazon Linux AMI : gd (ALAS-2023-1721)

The version of gd installed on the remote host is prior to 2.0.35-11.11. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1721 advisory. DISPUTED gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position ...

Amazon Linux AMI : vim (ALAS-2023-1716)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1716 advisory. A heap buffer overflow vulnerability was found in vim's inscomplinfercasegettext function of the src/insexpand.c file. This flaw occurs when vim tries to access uninitialized memory when completin...

Amazon Linux AMI : db4 (ALAS-2023-1726)

The version of db4 installed on the remote host is prior to 4.7.25-22.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1726 advisory. Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges ...

Amazon Linux AMI : python38 (ALAS-2023-1714)

The version of python38 installed on the remote host is prior to 3.8.5-1.9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1714 advisory. An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing...

Amazon Linux AMI : ghostscript (ALAS-2023-1725)

The version of ghostscript installed on the remote host is prior to 8.70-24.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1725 advisory. A heap-based buffer over write vulnerability was found in GhostScript's lp8000printpage function in gdevlp8k.c file. An...

Amazon Linux AMI : python-twisted-web (ALAS-2023-1717)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1717 advisory. A flaw was found in python-twisted. This vulnerability occurs due to the parsing of illegal constructs in the twisted.web.http module. The illegal constructs include '+/-' in the Content-Length...

Amazon Linux AMI : python27 (ALAS-2023-1713)

The version of python27 installed on the remote host is prior to 2.7.18-2.145. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1713 advisory. An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processin...

Amazon Linux AMI : emacs (ALAS-2023-1712)

The version of emacs installed on the remote host is prior to 24.3-20.25. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1712 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,...

Amazon Linux AMI : dnsmasq (ALAS-2020-1458)

The version of dnsmasq installed on the remote host is prior to 2.76-16.16. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1458 advisory. A flaw was found in the Dnsmasq application where a remote attacker can trigger a memory leak by sending specially crafted DHCP...

Amazon Linux AMI : tar (ALAS-2023-1704)

The version of tar installed on the remote host is prior to 1.26-31.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1704 advisory. GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitati...