Critical: thunderbird

Issue Overview: A malicious peer could have modified a COOKIE-ECHO chunk in a SCTP packet in a way that potentially resulted in a use-after-free. We presume that with enough effort it could have been exploited to run arbitrary code. CVE-2020-16044 Affected Packages: thunderbird Note: This advisor...

Important: sudo

Issue Overview: When sudo runs a command in shell mode, either via the -s or -i command line option, it escapes special characters in the command's arguments with a backslash. The sudoers policy plugin will then remove the escape characters from the arguments before evaluating the sudoers policy...

Amazon Linux 2 : dnsmasq (ALAS-2021-1587)

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1587 advisory. A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:replyquery if th...

Amazon Linux 2 : kernel (ALAS-2021-1588)

The version of kernel installed on the remote host is prior to 4.14.214-160.339. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1588 advisory. In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making...

Amazon Linux 2 : sudo (ALAS-2021-1590)

The version of sudo installed on the remote host is prior to 1.8.23-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1590 advisory. When sudo runs a command in shell mode, either via the -s or -i command line option, it escapes special characters in the command's...

Amazon Linux 2 : xorg-x11-server (ALAS-2021-1592)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1592 advisory. A flaw was found in the way the Xserver memory was not properly initialized. This issue leak parts of server memory to the X client. In cases where the Xorg server runs with elevated privileges,...

Amazon Linux 2 : python-rtslib (ALAS-2021-1589)

The version of python-rtslib installed on the remote host is prior to 2.1.74-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1589 advisory. A flaw was found in Open-iSCSI rtslib-fb through versions 2.1.72, where it has weak permissions for...

Important: xorg-x11-server

Issue Overview: A flaw was found in the way the Xserver memory was not properly initialized. This issue leak parts of server memory to the X client. In cases where the Xorg server runs with elevated privileges, this flaw results in a possible ASLR bypass. CVE-2020-14347 A flaw was found in the...

Amazon Linux 2 : xstream (ALAS-2021-1593)

The version of xstream installed on the remote host is prior to 1.3.1-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1593 advisory. A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list,...

Amazon Linux 2 : gd (ALAS-2021-1577)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1577 advisory. An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2 function of PHP's gd extension. A...

Amazon Linux 2 : chrony (ALAS-2021-1575)

The version of chrony installed on the remote host is prior to 3.5.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1575 advisory. A flaw was found in chrony when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup...

Amazon Linux 2 : libexif (ALAS-2021-1580)

The version of libexif installed on the remote host is prior to 0.6.22-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1580 advisory. A flaw was found in libexif. A possible out of bounds write, due ot an integer overflow, could lead to a remote code execution if ...

Amazon Linux 2 : net-snmp (ALAS-2021-1582)

The version of net-snmp installed on the remote host is prior to 5.7.2-49. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1582 advisory. A flaw was found in Net-SNMP through version 5.73, where an Improper Privilege Management issue occurs due to SNMP WRITE access t...

Medium: golang

Issue Overview: Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. CVE-2020-28362 Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. CVE-2020-28366 Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. CVE-2020-28367 Affected Packages: golang Note:...

Amazon Linux 2 : golang (ALAS-2021-1578)

The version of golang installed on the remote host is prior to 1.15.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1578 advisory. Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. CVE-2020-28362 Go before 1.14.12 and 1.15.x before...

Amazon Linux 2 : libuv (ALAS-2021-1581)

The version of libuv installed on the remote host is prior to 1.39.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1581 advisory. Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting...

Amazon Linux 2 : pacemaker (ALAS-2021-1583)

The version of pacemaker installed on the remote host is prior to 1.1.23-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1583 advisory. An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use...

Amazon Linux 2 : samba (ALAS-2021-1585)

The version of samba installed on the remote host is prior to 4.10.16-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1585 advisory. A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gai...

Medium: gd

Issue Overview: An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2 function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application,...

Important: libuv

Issue Overview: Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on t...