Important: sudo

Issue Overview: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, an...

Amazon Linux 2 : ppp (ALAS-2020-1400)

The version of ppp installed on the remote host is prior to 2.4.5-33. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1400 advisory. eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eaprequest and eapresponse functions. CVE-2020-8597...

Amazon Linux 2 : qemu (ALAS-2020-1401)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1401 advisory. ipreass in ipinput.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the...

Amazon Linux 2 : kernel (ALAS-2020-1399)

The version of kernel installed on the remote host is prior to 4.14.171-136.231. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1399 advisory. In the Linux kernel before 5.1, there is a memory leak in featregistersp in net/dccp/feat.c, which may cause denia...

Medium: kernel-livepatch-4.14.165-131.185

Issue Overview: In the Linux kernel before 5.1, there is a memory leak in featregistersp in net/dccp/feat.c, which may cause denial of service, aka CID-1d3ff0950e2b.CVE-2019-20096 Affected Packages: kernel-livepatch-4.14.165-131.185 Issue Correction: Please ensure you have live patching enabled...

Important: ppp

Issue Overview: eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eaprequest and eapresponse functions. CVE-2020-8597 Affected Packages: ppp Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL...

Important: qemu

Issue Overview: ipreass in ipinput.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment. CVE-2019-14378 Affected Packages: qemu Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

Important: kernel

Issue Overview: In the Linux kernel before 5.1, there is a memory leak in featregistersp in net/dccp/feat.c, which may cause denial of service, aka CID-1d3ff0950e2b. CVE-2019-20096 An issue was discovered in the Linux kernel before 5.0.10. SMB2negotiate in fs/cifs/smb2pdu.c has an out-of-bounds...

Amazon Linux 2 : transfig (ALAS-2020-1398)

The version of transfig installed on the remote host is prior to 3.2.7b-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1398 advisory. readcolordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write. CVE-2019-19797 makearrow in arrow.c in Xfig...

Amazon Linux 2 : qt5-qtbase (ALAS-2020-1397)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1397 advisory. An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler...

Medium: transfig

Issue Overview: readcolordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write. CVE-2019-19797 makearrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type. CVE-2019-19746 Affected Packages: transfi...

Amazon Linux 2 : sqlite (ALAS-2020-1394)

The version of sqlite installed on the remote host is prior to 3.7.17-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1394 advisory. Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corrupti...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2020-1396)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.242.b08-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1396 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking. Support...

Amazon Linux 2 : apache-commons-beanutils (ALAS-2020-1395)

The version of apache-commons-beanutils installed on the remote host is prior to 1.8.3-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1395 advisory. In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the abilit...

Important: apache-commons-beanutils

Issue Overview: In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the...

Amazon Linux 2 : thunderbird (ALAS-2020-1393)

The version of thunderbird installed on the remote host is prior to 68.4.1-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1393 advisory. When pasting a tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace...

Amazon Linux 2 : python-reportlab (ALAS-2020-1390)

The version of python-reportlab installed on the remote host is prior to 2.5-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1390 advisory. ReportLab through 3.5.26 allows remote code execution because of toColorevalarg in colors.py, as demonstrated by a crafted X...

Amazon Linux 2 : libarchive (ALAS-2020-1391)

The version of libarchive installed on the remote host is prior to 3.1.2-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1391 advisory. archivereadformatrarreaddata in archivereadsupportformatrar.c in libarchive before 3.4.0 has a use-after-free in a certain...

Amazon Linux 2 : kernel (ALAS-2020-1392)

The version of kernel installed on the remote host is prior to 4.14.165-131.185. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1392 advisory. 2024-05-09: CVE-2019-19965 was added to this advisory. A flaw was found in the Linux kernel. The cryptoreport...

Amazon Linux 2 : systemd (ALAS-2020-1388)

The version of systemd installed on the remote host is prior to 219-57. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1388 advisory. A heap use-after-free vulnerability was found in systemd, where asynchronous Polkit queries are performed while handling dbus...