Amazon Linux 2 : libsndfile (ALAS-2020-1435)

The version of libsndfile installed on the remote host is prior to 1.0.25-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1435 advisory. A stack-based buffer overflow in psfmemset in common.c in libsndfile 1.0.28 allows remote attackers to cause a denial of servi...

Amazon Linux 2 : mod_auth_mellon (ALAS-2020-1436)

The version of modauthmellon installed on the remote host is prior to 0.14.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1436 advisory. modauthmellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // afte...

Amazon Linux 2 : zsh (ALAS-2020-1439)

The version of zsh installed on the remote host is prior to 5.7.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1439 advisory. In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwri...

Amazon Linux 2 : kernel (ALAS-2020-1440)

The version of kernel installed on the remote host is prior to 4.14.177-139.253. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1440 advisory. A flaw was found in the Linux kernel's implementation of the BFQ IO scheduler. This flaw allows a local user able ...

Amazon Linux 2 : wireshark (ALAS-2020-1438)

The version of wireshark installed on the remote host is prior to 1.10.14-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1438 advisory. In Wireshark 2.6.0 to 2.6.2, 2.4.0 to 2.4.8, and 2.2.0 to 2.2.16, the Radiotap dissector could crash. This was...

Medium: mod_auth_mellon

Issue Overview: modauthmellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL. CVE-2019-13038 Affected Packages: modauthmellon Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit thi...

Important: fribidi

Issue Overview: A buffer overflow in the fribidigetparembeddinglevelsex function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered b...

Amazon Linux 2 : fribidi (ALAS-2020-1434)

The version of fribidi installed on the remote host is prior to 1.0.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1434 advisory. A buffer overflow in the fribidigetparembeddinglevelsex function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an...

Amazon Linux 2 : python, --advisory ALAS2-2020-1432 (ALAS-2020-1432)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1432 advisory. http.cookiejar.DefaultPolicy.domainreturnok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain:...

Amazon Linux 2 : xorg-x11-server (ALAS-2020-1433)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1433 advisory. It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions and XGetFontPath functions to produce an invalid list of elements that in turn make...

Amazon Linux 2 : python-twisted-web (ALAS-2020-1428)

The version of python-twisted-web installed on the remote host is prior to 12.1.0-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1428 advisory. In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a...

Amazon Linux 2 : bind (ALAS-2020-1426)

The version of bind installed on the remote host is prior to 9.11.4-9.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1426 advisory. An assertion failure was found in BIND, which checks the validity of messages containing TSIG resource records. This flaw...

Amazon Linux 2 : unbound (ALAS-2020-1430)

The version of unbound installed on the remote host is prior to 1.6.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1430 advisory. infinite loop via malformed DNS answers received from upstream servers CVE-2020-12663 insufficient control of network...

Important: unbound

Issue Overview: infinite loop via malformed DNS answers received from upstream servers CVE-2020-12663 insufficient control of network message volume leads to DoS CVE-2020-12662 Affected Packages: unbound Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ secti...

Amazon Linux 2 : kernel (ALAS-2020-1425)

The version of kernel installed on the remote host is prior to 4.14.177-139.254. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1425 advisory. A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem. This flaw occurs while importing the...

Amazon Linux 2 : java-1.7.0-openjdk (ALAS-2020-1424)

The version of java-1.7.0-openjdk installed on the remote host is prior to 1.7.0.261-2.6.22.2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1424 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux 2 : ipa (ALAS-2020-1423)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1423 advisory. A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function berscanf was used in some component...

Important: ipa

Issue Overview: A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function berscanf was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2020-1421)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.252.b09-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1421 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux 2 : http-parser (ALAS-2020-1417)

The version of http-parser installed on the remote host is prior to 2.7.1-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1417 advisory. HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed...