Amazon Linux 2 : ipa (ALAS-2020-1519)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1519 advisory. jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed...

Amazon Linux 2 : tigervnc (ALAS-2020-1552)

The version of tigervnc installed on the remote host is prior to 1.8.0-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1552 advisory. TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack...

Amazon Linux 2 : samba (ALAS-2020-1544)

The version of samba installed on the remote host is prior to 4.10.16-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1544 advisory. All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with log...

Amazon Linux 2 : libtiff (ALAS-2020-1532)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1532 advisory. TIFFCheckMalloc and TIFFCheckRealloc in tifaux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they...

Amazon Linux 2 : ImageMagick (ALAS-2020-1497)

The version of ImageMagick installed on the remote host is prior to 6.9.10.68-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1497 advisory. ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c,...

Amazon Linux 2 : hunspell (ALAS-2020-1518)

The version of hunspell installed on the remote host is prior to 1.3.2-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1518 advisory. Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx. CVE-2019-16707 Tenable has...

Amazon Linux 2 : libwmf, --advisory ALAS2-2020-1533 (ALAS-2020-1533)

The version of libwmf installed on the remote host is prior to 0.2.8.4-44. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1533 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C...

Amazon Linux 2 : qt5-qtbase (ALAS-2020-1543)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1543 advisory. 2023-08-03: CVE-2020-24742 was added to this advisory. Files placed by attacker can influence the working directory and...

Amazon Linux 2 : python-pillow (ALAS-2020-1542)

The version of python-pillow installed on the remote host is prior to 2.0.0-21.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1542 advisory. An out-of-bounds read was discovered in python-pillow in the way it decodes FLI images. An application that uses...

Amazon Linux 2 : spice-gtk (ALAS-2020-1546)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1546 advisory. Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system. Both the SPICE client spice-gtk and server are affected by these flaws. These fla...

Important: squid

Issue Overview: A flaw was found in squid. Due to incorrect data validation, a HTTP Request Smuggling attack against HTTP and HTTPS traffic is possible leading to cache poisoning. The highest threat from this vulnerability is to data confidentiality and integrity. CVE-2020-15810 A flaw was found ...

Medium: libtiff

Issue Overview: TIFFCheckMalloc and TIFFCheckRealloc in tifaux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash. CVE-2019-14973 tifgetimage.c in...

Low: mod_auth_openidc

Issue Overview: An open redirect flaw was discovered in modauthopenidc, where it handles logout redirection. The module does not correctly validate the URL, allowing a URL with leading slashes to bypass the protection checks. A victim user may be tricked into visiting a trusted vulnerable web sit...

Medium: NetworkManager

Issue Overview: A flaw was found in nmcli, where the command-line interface to the NetworkManager did not accept the 802-1x.ca-path and 802-1x.phase2-ca-path settings when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and an...

Amazon Linux 2 : avahi (ALAS-2020-1502)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1502 advisory. avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not...

Amazon Linux 2 : libguestfs-winsupport (ALAS-2020-1522)

The version of libguestfs-winsupport installed on the remote host is prior to 7.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1522 advisory. An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running...

Low: avahi

Issue Overview: avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service traffic amplification and may cause information leakage by obtaining potentially...

Low: hunspell

Issue Overview: Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx. CVE-2019-16707 Affected Packages: hunspell Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2...

Medium: openldap

Issue Overview: In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service daemon crash. CVE-2020-12243 Affected Packages: openldap Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

Medium: OpenEXR

Issue Overview: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp. CVE-2020-11761 An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and...