Amazon Linux 2 : git (ALAS-2020-1416)

The version of git installed on the remote host is prior to 2.23.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1416 advisory. Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an...

Amazon Linux 2 : telnet (ALAS-2020-1422)

The version of telnet installed on the remote host is prior to 0.17-65. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1422 advisory. utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data...

Amazon Linux 2 : ipmitool (ALAS-2020-1420)

The version of ipmitool installed on the remote host is prior to 1.8.18-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1420 advisory. It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN...

Amazon Linux 2 : icu (ALAS-2020-1418)

The version of icu installed on the remote host is prior to 50.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1418 advisory. An issue was discovered in International Components for Unicode ICU for C/C++ through 66.1. An integer overflow, leading to a heap-based...

Important: http-parser

Issue Overview: HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed CVE-2019-15605 Affected Packages: http-parser Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference...

Important: ipmitool

Issue Overview: It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run...

Important: icu

Issue Overview: An issue was discovered in International Components for Unicode ICU for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend function in common/unistr.cpp. CVE-2020-10531 Affected Packages: icu Note: This advisory ...

Amazon Linux 2 : python-virtualenv (ALAS-2020-1413)

The version of python-virtualenv installed on the remote host is prior to 15.1.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1413 advisory. urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirec...

Amazon Linux 2 : libvncserver (ALAS-2020-1411)

The version of libvncserver installed on the remote host is prior to 0.9.9-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1411 advisory. Integer Overflow or Wraparound leads to Heap-based Buffer Overflow CVE-2019-15690 Tenable has extracted the preceding...

Amazon Linux 2 : xerces-c (ALAS-2020-1415)

The version of xerces-c installed on the remote host is prior to 3.1.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1415 advisory. A use-after-free vulnerability was found in xerces-c in the way an XML document is processed via the SAX API. Applications that...

Amazon Linux 2 : python-pillow (ALAS-2020-1412)

The version of python-pillow installed on the remote host is prior to 2.0.0-20.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1412 advisory. A flaw was discovered in the way the python-pillow may allocate a large amount of memory or require a lo...

Amazon Linux 2 : thunderbird (ALAS-2020-1414)

The version of thunderbird installed on the remote host is prior to 68.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1414 advisory. The Mozilla Foundation Security Advisory describes this flaw as: When removing data about an origin whose tab was...

Important: python-pillow

Issue Overview: A flaw was discovered in the way the python-pillow may allocate a large amount of memory or require a long time while processing specially crafted image files, possibly causing a denial of service. Applications that use the library to process untrusted files may be vulnerable to...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2020-1410)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.7+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1410 advisory. Further information about this update can be found in the Corretto 11 change log...

Amazon Linux 2 : git (ALAS-2020-1409)

The version of git installed on the remote host is prior to 2.23.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1409 advisory. With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a...

Important: git

Issue Overview: With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a wrong host. The attack has been made impossible by forbidding a newline character in any value passed via the credential protocol. CVE-2020-5260...

Important: java-11-amazon-corretto

Issue Overview: Further information about this update can be found in the Corretto 11 change log https://github.com/corretto/corretto-11/blob/develop/CHANGELOG.md Affected Packages: java-11-amazon-corretto Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

Amazon Linux 2 : qemu (ALAS-2020-1407)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1407 advisory. tcpemu in tcpsubr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMUIR...

Amazon Linux 2 : kernel (ALAS-2020-1405)

The version of kernel installed on the remote host is prior to 4.14.173-137.228. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1405 advisory. 2023-11-29: CVE-2020-27418 was added to this advisory. A stack buffer overflow issue was found in the getrawsocket...

Amazon Linux 2 : thunderbird (ALAS-2020-1408)

The version of thunderbird installed on the remote host is prior to 68.5.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1408 advisory. When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents...