Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2021-1579)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.272.b10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1579 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux 2 : php-pear (ALAS-2021-1584)

The version of php-pear installed on the remote host is prior to 1.10.12-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1584 advisory. ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

Amazon Linux 2 : thunderbird (ALAS-2021-1586)

The version of thunderbird installed on the remote host is prior to 78.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1586 advisory. When drawing a transparent image on top of an unknown cross-origin image, the Skia library drawImage function took a...

Medium: kernel-livepatch-4.14.193-149.317

Issue Overview: A flaw was found in the Linux kernel. A local attacker, able to inject conntrack netlink configuration, could overflow a local buffer causing crashes or triggering the use of incorrect protocol numbers in ctnetlinkparsetuplefilter in net/netfilter/nfconntracknetlink.c. The highest...

Medium: kernel-livepatch-4.14.198-152.320

Issue Overview: A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel. Incorrect capability checks could alllow a local user with root priviledges but no capabilities to add or remove Rados Block Devices from the system. CVE-2020-25284 Affected...

Amazon Linux 2 : libX11 (ALAS-2020-1567)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1567 advisory. An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to caus...

Amazon Linux 2 : librepo (ALAS-2020-1568)

The version of librepo installed on the remote host is prior to 1.8.1-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1568 advisory. A flaw was found in librepo. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository...

Amazon Linux 2 : bind (ALAS-2020-1564)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1564 advisory. A flaw was found in bind. An assertion failure can occur when trying to verify a truncated response to a TSIG-signed...

Amazon Linux 2 : kernel (ALAS-2020-1566)

The version of kernel installed on the remote host is prior to 4.14.209-160.335. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1566 advisory. A use-after-free flaw was found in the debugfsremove function in the Linux kernel. The flaw could allow a local...

Important: librepo

Issue Overview: A flaw was found in librepo. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path...

Important: freetype

Issue Overview: Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2020-15999 Affected Packages: freetype Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository...

Amazon Linux 2 : xorg-x11-server (ALAS-2020-1571)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1571 advisory. A flaw was found in X.Org Server. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data...

Amazon Linux 2 : libvirt (ALAS-2020-1569)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1569 advisory. A double free memory issue was found to occur in the libvirt API responsible for requesting information about network interfaces o...

Amazon Linux 2 : qemu (ALAS-2020-1570)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1570 advisory. A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. The issue occurs in ipreass...

Amazon Linux 2 : thunderbird (ALAS-2020-1572)

The version of thunderbird installed on the remote host is prior to 78.4.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1572 advisory. The Mozilla Foundation Security Advisory describes this flaw as:Mozilla developer reported memory safety bugs present...

Amazon Linux 2 : freetype (ALAS-2020-1565)

The version of freetype installed on the remote host is prior to 2.8-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1565 advisory. Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap...

Amazon Linux 2 : openssl, openssl11 (ALAS-2020-1573)

The version of openssl installed on the remote host is prior to 1.0.2k-19. The version of openssl11 installed on the remote host is prior to 1.1.1c-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1573 advisory. A null pointer dereference flaw was found in openssl...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2020-1491)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.265.b01-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1491 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supporte...

Amazon Linux 2 : httpd (ALAS-2020-1490)

The version of httpd installed on the remote host is prior to 2.4.46-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1490 advisory. Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE A flaw was found in Apache httpd in...

Amazon Linux 2 : libvpx (ALAS-2020-1558)

The version of libvpx installed on the remote host is prior to 1.3.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1558 advisory. A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file t...