Amazon Linux AMI : httpd24 (ALAS-2014-309)

The logcookie function in modlogconfig.c in the modlogconfig module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service segmentation fault and daemon crash via a crafted cookie that is not properly handled during truncation. C Tenable Network Security, Inc...

Amazon Linux AMI : php54 (ALAS-2014-313)

A denial of service flaw was found in the way the File Information fileinfo extension handled indirect rules. A remote attacker could use this flaw to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU. C Tenable Network Security, Inc. The descriptive text and...

Amazon Linux AMI : kernel Privilege Escalation (ALAS-2013-190)

A flaw was found in the way index into perfsweventenabled array was sanitized. A local, unprivileged user could leverage this flaw to gain elevated privileges on the system. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon Linux AM...

Amazon Linux AMI : postgresql9 (ALAS-2014-306)

Multiple stack-based buffer overflow flaws were found in the date/time implementation of PostgreSQL. An authenticated database user could provide a specially crafted date/time value that, when processed, could cause PostgreSQL to crash or, potentially, execute arbitrary code with the permissions ...

Amazon Linux AMI : postgresql8 (ALAS-2014-305)

Multiple stack-based buffer overflow flaws were found in the date/time implementation of PostgreSQL. An authenticated database user could provide a specially crafted date/time value that, when processed, could cause PostgreSQL to crash or, potentially, execute arbitrary code with the permissions ...

Amazon Linux AMI : libtiff (ALAS-2014-307)

A heap-based buffer overflow and a use-after-free flaw were found in the tiff2pdf tool. An attacker could use these flaws to create a specially crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute arbitrary code. CVE-2013-1960 , CVE-2013-4232 Multiple buffer overflow flaws...

Amazon Linux AMI : file (ALAS-2014-304)

Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service infinite recursion, CPU consumption, and crash via a crafted indirect offset value in the magic of a file. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Amazon Linux AMI : mysql51 (ALAS-2014-298)

This update fixes several vulnerabilities in the MySQL database server. CVE-2014-0386 , CVE-2014-0393 , CVE-2014-0401 , CVE-2014-0402 , CVE-2014-0412 , CVE-2014-0437 , CVE-2013-5908 A buffer overflow flaw was found in the way the MySQL command line client tool mysql processed excessively long...

Amazon Linux AMI : socat (ALAS-2014-300)

Stack-based buffer overflow in socat 1.3.0.0 through 1.7.2.2 and 2.0.0-b1 through 2.0.0-b6 allows local users to cause a denial of service segmentation fault via a long server name in the PROXY-CONNECT address in the command line. C Tenable Network Security, Inc. The descriptive text and package...

Amazon Linux AMI : gnutls (ALAS-2014-301)

It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by...

Amazon Linux AMI : graphviz (ALAS-2014-296)

Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a 'badly formed number' and a 'long digit list.' Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphvi...

Amazon Linux AMI : graphviz-php (ALAS-2014-297)

Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a 'badly formed number' and a 'long digit list.' Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphvi...

Amazon Linux AMI : lighttpd (ALAS-2014-299)

Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service segmentation fault and crash via unspecified vectors that trigger FAMMonitorDirectory failures. lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easi...

Amazon Linux AMI : openldap (ALAS-2014-294)

The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service slapd crash by unbinding immediately after a search request, which triggers rwmconndestroy to free the session context while it is being used by...

Amazon Linux AMI : python26 (ALAS-2014-292)

Buffer overflow in the socket.recvfrominto function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string. C Tenable Network Security, Inc. The descriptive text and package checks in...

Amazon Linux AMI : kernel (ALAS-2014-289)

The pnrecvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a 1 recvfrom, 2 recvmmsg, ...

Amazon Linux AMI : curl (ALAS-2014-295)

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request. C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

Amazon Linux AMI : bind (ALAS-2014-287)

A denial of service flaw was found in the way BIND handled queries for NSEC3-signed zones. A remote attacker could use this flaw against an authoritative name server that served NCES3-signed zones by sending a specially crafted query, which, when processed, would cause named to crash. CVE-2014-05...

Amazon Linux AMI : openssl (ALAS-2014-273)

A flaw was found in the way OpenSSL determined which hashing algorithm to use when TLS protocol version 1.2 was enabled. This could possibly cause OpenSSL to use an incorrect hashing algorithm, leading to a crash of an application using the library. CVE-2013-6449 It was discovered that the Datagr...

Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2014-283)

An input validation flaw was discovered in the font layout engine in the 2D component. A specially crafted font file could trigger a Java Virtual Machine memory corruption when processed. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions...