Amazon Linux 2 : kernel (ALAS-2020-1465)

The version of kernel installed on the remote host is prior to 4.14.186-146.268. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1465 advisory. An issue where a provided address with accessok is not checked was discovered in i915gemexecbuffer2ioctl in...

Amazon Linux 2 : libxml2 (ALAS-2020-1466)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1466 advisory. A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval function of libxml2 through 2.9.8 when...

Important: qemu

Issue Overview: In libslirp 4.1.0, as used in QEMU 4.2.0, tcpsubr.c misuses snprintf return values, leading to a buffer overflow in later code. CVE-2020-8608 Affected Packages: qemu Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference...

Amazon Linux 2 : file (ALAS-2020-1452)

The version of file installed on the remote host is prior to 5.11-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1452 advisory. The docorenote function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service out-of-bounds rea...

Amazon Linux 2 : lftp (ALAS-2020-1453)

The version of lftp installed on the remote host is prior to 4.4.8-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1453 advisory. It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of...

Amazon Linux 2 : patch (ALAS-2020-1457)

The version of patch installed on the remote host is prior to 2.7.1-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1457 advisory. In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and...

Amazon Linux 2 : samba (ALAS-2020-1459)

The version of samba installed on the remote host is prior to 4.10.4-11. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1459 advisory. A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server...

Amazon Linux 2 : net-snmp (ALAS-2020-1454)

The version of net-snmp installed on the remote host is prior to 5.7.2-48. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1454 advisory. snmpoidcompare in snmplib/snmpapi.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticate...

Amazon Linux 2 : ntp (ALAS-2020-1455)

The version of ntp installed on the remote host is prior to 4.2.6p5-29. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1455 advisory. ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service daemon exit or...

Amazon Linux 2 : thunderbird (ALAS-2020-1462)

The version of thunderbird installed on the remote host is prior to 68.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1462 advisory. Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed...

Amazon Linux 2 : curl (ALAS-2020-1451)

The version of curl installed on the remote host is prior to 7.61.1-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1451 advisory. command line arguments lead to local file overwrite CVE-2020-8177 Tenable has extracted the preceding description block directly fro...

Amazon Linux 2 : taglib (ALAS-2020-1460)

The version of taglib installed on the remote host is prior to 1.8-8.20130218git. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1460 advisory. The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause informatio...

Amazon Linux 2 : advancecomp (ALAS-2020-1450)

The version of advancecomp installed on the remote host is prior to 1.15-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1450 advisory. In AdvanceCOMP 2.1, pngcompress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which...

Amazon Linux 2 : java-11-amazon-corretto, --advisory ALAS2-2020-1464 (ALAS-2020-1464)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.8+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1464 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Support...

Amazon Linux 2 : texlive (ALAS-2020-1461)

The version of texlive installed on the remote host is prior to 2012-38.20130427r30134. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1461 advisory. An issue was discovered in t1checkunusualcharstring functions in writet1.c files in TeX Live before 2018-09-21. A...

Amazon Linux 2 : qt (ALAS-2020-1458)

The version of qt installed on the remote host is prior to 4.8.5-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1458 advisory. An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp...

Medium: openssl11

Issue Overview: In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message tha...

Medium: curl

Issue Overview: command line arguments lead to local file overwrite CVE-2020-8177 Affected Packages: curl Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update...

Medium: lftp

Issue Overview: It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled...

Medium: advancecomp

Issue Overview: In AdvanceCOMP 2.1, pngcompress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. There is also a heap-based buffer over-read. CVE-2019-9210 Affected Packages:...