Amazon Linux 2 : dnsmasq (ALAS-2020-1469)

The version of dnsmasq installed on the remote host is prior to 2.76-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1469 advisory. A flaw was found in the default configuration of dnsmasq, as shipped with Fedora and Red Hat Enterprise Linux, where it listens on...

Amazon Linux 2 : python-rsa (ALAS-2020-1470)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1470 advisory. Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses...

Medium: python-rsa

Issue Overview: Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior...

Amazon Linux 2 : kernel (ALAS-2020-1465)

The version of kernel installed on the remote host is prior to 4.14.186-146.268. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1465 advisory. An issue where a provided address with accessok is not checked was discovered in i915gemexecbuffer2ioctl in...

Amazon Linux 2 : libxml2 (ALAS-2020-1466)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1466 advisory. A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval function of libxml2 through 2.9.8 when...

Amazon Linux 2 : qemu, --advisory ALAS2-2020-1467 (ALAS-2020-1467)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1467 advisory. In libslirp 4.1.0, as used in QEMU 4.2.0, tcpsubr.c misuses snprintf return values, leading to a buffer overflow in later code...

Amazon Linux 2 : thunderbird (ALAS-2020-1468)

The version of thunderbird installed on the remote host is prior to 68.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1468 advisory. The Mozilla Foundation Security Advisory describes this flaw as: If Thunderbird is configured to use STARTTLS for an...

Important: qemu

Issue Overview: In libslirp 4.1.0, as used in QEMU 4.2.0, tcpsubr.c misuses snprintf return values, leading to a buffer overflow in later code. CVE-2020-8608 Affected Packages: qemu Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference...

Amazon Linux 2 : net-snmp (ALAS-2020-1454)

The version of net-snmp installed on the remote host is prior to 5.7.2-48. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1454 advisory. snmpoidcompare in snmplib/snmpapi.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticate...

Amazon Linux 2 : file (ALAS-2020-1452)

The version of file installed on the remote host is prior to 5.11-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1452 advisory. The docorenote function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service out-of-bounds rea...

Amazon Linux 2 : patch (ALAS-2020-1457)

The version of patch installed on the remote host is prior to 2.7.1-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1457 advisory. In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and...

Amazon Linux 2 : java-11-amazon-corretto, --advisory ALAS2-2020-1464 (ALAS-2020-1464)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.8+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1464 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Support...

Amazon Linux 2 : qt (ALAS-2020-1458)

The version of qt installed on the remote host is prior to 4.8.5-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1458 advisory. An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp...

Amazon Linux 2 : ntp (ALAS-2020-1455)

The version of ntp installed on the remote host is prior to 4.2.6p5-29. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1455 advisory. ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service daemon exit or...

Amazon Linux 2 : thunderbird (ALAS-2020-1462)

The version of thunderbird installed on the remote host is prior to 68.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1462 advisory. Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed...

Amazon Linux 2 : lftp (ALAS-2020-1453)

The version of lftp installed on the remote host is prior to 4.4.8-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1453 advisory. It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of...

Amazon Linux 2 : advancecomp (ALAS-2020-1450)

The version of advancecomp installed on the remote host is prior to 1.15-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1450 advisory. In AdvanceCOMP 2.1, pngcompress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which...

Amazon Linux 2 : taglib (ALAS-2020-1460)

The version of taglib installed on the remote host is prior to 1.8-8.20130218git. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1460 advisory. The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause informatio...

Amazon Linux 2 : curl (ALAS-2020-1451)

The version of curl installed on the remote host is prior to 7.61.1-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1451 advisory. command line arguments lead to local file overwrite CVE-2020-8177 Tenable has extracted the preceding description block directly fro...

Amazon Linux 2 : texlive (ALAS-2020-1461)

The version of texlive installed on the remote host is prior to 2012-38.20130427r30134. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1461 advisory. An issue was discovered in t1checkunusualcharstring functions in writet1.c files in TeX Live before 2018-09-21. A...