Amazon Linux 2 : kernel (ALAS-2020-1566)

The version of kernel installed on the remote host is prior to 4.14.209-160.335. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1566 advisory. A use-after-free flaw was found in the debugfsremove function in the Linux kernel. The flaw could allow a local...

Amazon Linux 2 : bind (ALAS-2020-1564)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1564 advisory. A flaw was found in bind. An assertion failure can occur when trying to verify a truncated response to a TSIG-signed...

Amazon Linux 2 : libvirt (ALAS-2020-1569)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1569 advisory. A double free memory issue was found to occur in the libvirt API responsible for requesting information about network interfaces o...

Amazon Linux 2 : thunderbird (ALAS-2020-1572)

The version of thunderbird installed on the remote host is prior to 78.4.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1572 advisory. The Mozilla Foundation Security Advisory describes this flaw as:Mozilla developer reported memory safety bugs present...

Important: librepo

Issue Overview: A flaw was found in librepo. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path...

Amazon Linux 2 : openssl, openssl11 (ALAS-2020-1573)

The version of openssl installed on the remote host is prior to 1.0.2k-19. The version of openssl11 installed on the remote host is prior to 1.1.1c-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1573 advisory. A null pointer dereference flaw was found in openssl...

Amazon Linux 2 : librepo (ALAS-2020-1568)

The version of librepo installed on the remote host is prior to 1.8.1-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1568 advisory. A flaw was found in librepo. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository...

Amazon Linux 2 : libX11 (ALAS-2020-1567)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1567 advisory. An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to caus...

Amazon Linux 2 : qemu (ALAS-2020-1570)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1570 advisory. A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. The issue occurs in ipreass...

Amazon Linux 2 : xorg-x11-server (ALAS-2020-1571)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1571 advisory. A flaw was found in X.Org Server. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data...

Important: freetype

Issue Overview: Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2020-15999 Affected Packages: freetype Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository...

Amazon Linux 2 : freetype (ALAS-2020-1565)

The version of freetype installed on the remote host is prior to 2.8-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1565 advisory. Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2020-1491)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.265.b01-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1491 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supporte...

Amazon Linux 2 : httpd (ALAS-2020-1490)

The version of httpd installed on the remote host is prior to 2.4.46-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1490 advisory. Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE A flaw was found in Apache httpd in...

Amazon Linux 2 : oniguruma (ALAS-2020-1560)

The version of oniguruma installed on the remote host is prior to 5.9.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1560 advisory. In Oniguruma 6.9.5rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one...

Medium: oniguruma

Issue Overview: In Oniguruma 6.9.5rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one byte in concatoptexactstr in src/regcomp.c . CVE-2020-26159 Affected Packages: oniguruma Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Amazon Linux 2 : golang (ALAS-2020-1554)

The version of golang installed on the remote host is prior to 1.15.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1554 advisory. Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Typ...

Amazon Linux 2 : libvirt (ALAS-2020-1557)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1557 advisory. A flaw was found in the way the libvirtd daemon issued the 'suspend' command to a QEMU guest-agent running inside a guest...

Amazon Linux 2 : nspr, nss-softokn, nss-util, nss (ALAS-2020-1559)

The version of nspr installed on the remote host is prior to 4.25.0-2. The version of nss installed on the remote host is prior to 3.53.1-3. The version of nss-softokn installed on the remote host is prior to 3.53.1-6. The version of nss- util installed on the remote host is prior to 3.53.1-1. It...

Medium: nspr, nss-softokn, nss-util, nss

Issue Overview: When importing a curve25519 private key in PKCS8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services NSS library. This could lead to information disclosure. This vulnerability affects Firefox ESR 60.8, Firefox 68, and...