Amazon Linux AMI : ghostscript (ALAS-2023-1734)

The version of ghostscript installed on the remote host is prior to 8.70-24.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1734 advisory. In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : Ruby vulnerabilities (USN-6055-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6055-1 advisory. It was discovered that Ruby incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a...

Amazon Linux AMI : libwebp (ALAS-2023-1740)

The version of libwebp installed on the remote host is prior to 0.3.0-10.8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1740 advisory. A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign...

Amazon Linux 2023 : openldap, openldap-clients, openldap-compat (ALAS2023-2023-177)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-177 advisory. In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion ... NOTE: https://bugs.openldap.org/showbug.cgi?id=9454NOTE: trunk:...

Debian DSA-5397-1 : wpewebkit - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5397 advisory. - Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

Oracle Linux 7 : docker-engine (ELSA-2019-4598)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2019-4598 advisory. - Docker Engine before 18.09 allows attackers to cause a denial of service dockerd memory consumption via a large integer in a --cpuset-mems or --cpuset-cpus...

GLSA-202305-12 : sudo: Root Privilege Escalation

The remote host is affected by the vulnerability described in GLSA-202305-12 sudo: Root Privilege Escalation - In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user- provided environment variables SUDOEDITOR, VISUAL, and EDITOR, allowing a local attack...

Amazon Linux 2023 : gnutls, gnutls-c++, gnutls-dane (ALAS2023-2023-171)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-171 advisory. A timing side-channel vulnerability was found in RSA ClientKeyExchange messages in GnuTLS. This side- channel may be sufficient to recover the key encrypted in the RSA ciphertext across a network in a...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2023-162)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-162 advisory. In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode,...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-169)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-169 advisory. An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores an XFS image after failure with a dirty log journal. This flaw allows a local user to...

Amazon Linux 2 : tomcat (ALAS-2023-2020)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2020 advisory. 2023-05-11: CVE-2017-12616 was added to this advisory. When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 ...

Amazon Linux 2 : libwebp (ALAS-2023-2031)

The version of libwebp installed on the remote host is prior to 0.3.0-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2031 advisory. A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. T...

SUSE SLES15: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2023:2077-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2077-1 advisory. Update to version 2.38.6 bsc1210731: - CVE-2022-0108: Fixed information leak. - CVE-2022-32885: Fixed arbitrary code...

GitLab 8.6 < 15.9.6 / 15.10 < 15.10.5 / 15.11 < 15.11.1 (CVE-2023-1178)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.6.2.5)

The version of AOS installed on the remote host is prior to 6.6.2.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.6.2.5 advisory. - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2023-044 (ALASKERNEL-5.4-2023-044)

The version of kernel installed on the remote host is prior to 5.4.241-150.347. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-044 advisory. A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows...

FreeBSD : cloud-init -- sensitive data exposure in cloud-init logs (02562a78-e6b7-11ed-b0ce-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 02562a78-e6b7-11ed-b0ce-b42e991fc52e advisory. - Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use th...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-031 (ALASKERNEL-5.10-2023-031)

The version of kernel installed on the remote host is prior to 5.10.178-162.673. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-031 advisory. In the Linux kernel, the following vulnerability has been resolved: sysctl: Fix data-races in...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current netatalk Multiple Vulnerabilities (SSA:2023-121-01)

The version of netatalk installed on the remote host is prior to 3.1.12 / 3.1.15. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-121-01 advisory. - This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk...

FreeBSD : h2o -- Malformed HTTP/1.1 causes Out-of-Memory Denial of Service (4da51989-5a8b-4eb9-b442-46d94ec0802d)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4da51989-5a8b-4eb9-b442-46d94ec0802d advisory. - H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to...