Medium: p11-kit

Issue Overview: An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc. CVE-2020-29361 An issue was...

Medium: cloud-init

Issue Overview: A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'. CVE-2019-0816 Affected Packages: cloud-init Note: This advisory is applicabl...

Medium: golang

Issue Overview: In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field. CVE-2021-3114 Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerab...

Amazon Linux 2 : kernel (ALAS-2021-1600)

The version of kernel installed on the remote host is prior to 4.14.219-161.340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1600 advisory. 2024-05-23: CVE-2023-1390 was added to this advisory. A use-after-free flaw was found in kernel/trace/ringbuffer.c...

Amazon Linux 2 : php-pear (ALAS-2021-1602)

The version of php-pear installed on the remote host is prior to 1.10.12-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1602 advisory. Tar.php in ArchiveTar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic...

Amazon Linux 2 : python, python3 (ALAS-2021-1611)

The version of python installed on the remote host is prior to 2.7.18-1. The version of python3 installed on the remote host is prior to 3.7.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1611 advisory. A flaw was found in python. A stack-based buffer overflow...

Amazon Linux 2 : openssl (ALAS-2021-1608)

The version of openssl installed on the remote host is prior to 1.0.2k-19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1608 advisory. OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both...

Amazon Linux 2 : glibc (ALAS-2021-1605)

The version of glibc installed on the remote host is prior to 2.26-41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1605 advisory. The iconv program in the GNU C Library aka glibc or libc6 2.31 and earlier, when invoked with multiple suffixes in the...

Amazon Linux 2 : unzip (ALAS-2021-1604)

The version of unzip installed on the remote host is prior to 6.0-43. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1604 advisory. Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service infinite loop via empty bzip2 data in a ZIP archive...

Amazon Linux 2 : glibc (ALAS-2021-1599)

The version of glibc installed on the remote host is prior to 2.26-40. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1599 advisory. A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequence could cause glibc to read beyond t...

Amazon Linux 2 : ghostscript (ALAS-2021-1598)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1598 advisory. Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers...

Amazon Linux 2 : thunderbird (ALAS-2021-1603)

The version of thunderbird installed on the remote host is prior to 78.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1603 advisory. The Mozilla Foundation Security Advisory describes these flaws as: During the plaintext phase of the STARTTLS...

Amazon Linux 2 : ImageMagick (ALAS-2021-1596)

The version of ImageMagick installed on the remote host is prior to 6.9.10.68-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1596 advisory. A flaw was found in ImageMagick. The -authenticate option is mishandled allowing user-controlled password set for a PDF fil...

Amazon Linux 2 : cloud-init (ALAS-2021-1595)

The version of cloud-init installed on the remote host is prior to 19.3-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1595 advisory. A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use...

Amazon Linux 2 : perl (ALAS-2021-1610)

The version of perl installed on the remote host is prior to 5.16.3-299. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1610 advisory. Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers...

Amazon Linux 2 : golang (ALAS-2021-1609)

The version of golang installed on the remote host is prior to 1.15.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1609 advisory. In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an...

Important: kernel-livepatch-4.14.209-160.339

Issue Overview: A flaw was found in the Linux kernel's implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to...

Important: kernel-livepatch-4.14.209-160.335

Issue Overview: A flaw was found in the Linux kernel's implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to...

Amazon Linux 2 : targetcli (ALAS-2021-1591)

The version of targetcli installed on the remote host is prior to 2.1.53-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1591 advisory. An access flaw was found in targetcli, where the /etc/target and underneath backup directory/files were world-readable. This fla...

Critical: thunderbird

Issue Overview: A malicious peer could have modified a COOKIE-ECHO chunk in a SCTP packet in a way that potentially resulted in a use-after-free. We presume that with enough effort it could have been exploited to run arbitrary code. CVE-2020-16044 Affected Packages: thunderbird Note: This advisor...