Amazon Linux 2 : python-reportlab (ALAS-2020-1390)

The version of python-reportlab installed on the remote host is prior to 2.5-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1390 advisory. ReportLab through 3.5.26 allows remote code execution because of toColorevalarg in colors.py, as demonstrated by a crafted X...

Important: libarchive

Issue Overview: archivereadformatrarreaddata in archivereadsupportformatrar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVEFAILED situation, related to Ppmd7DecodeSymbol. CVE-2019-18408 Affected Packages: libarchive Note: This advisory is applicable to Amazon Linux 2 AL2 Co...

Important: kernel

Issue Overview: A flaw was found in the Linux kernel. The cryptoreport function mishandles resource cleanup on error. A local attacker able to induce the error conditions could use this flaw to crash the system. The highest threat from this vulnerability is to system availability. CVE-2019-19062 ...

Medium: python-pip

Issue Overview: In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. CVE-2019-11236 The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store...

Amazon Linux 2 : thunderbird (ALAS-2020-1386)

The version of thunderbird installed on the remote host is prior to 68.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1386 advisory. The plain text serializer used a fixed-size array for the number of Under certain conditions, when checking the Resis...

Amazon Linux 2 : 389-ds-base (ALAS-2020-1381)

The version of 389-ds-base installed on the remote host is prior to 1.3.9.1-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1381 advisory. A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values...

Amazon Linux 2 : tcpdump (ALAS-2020-1385)

The version of tcpdump installed on the remote host is prior to 4.9.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1385 advisory. In tcpdump 4.9.2, a stack-based buffer over-read exists in the printprefix function of print-hncp.c via crafted packet data because...

Amazon Linux 2 : golang, --advisory ALAS2-2020-1383 (ALAS-2020-1383)

The version of golang installed on the remote host is prior to 1.13.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1383 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C...

Amazon Linux 2 : nss (ALAS-2020-1384)

The version of nss installed on the remote host is prior to 3.44.0-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1384 advisory. A heap-based buffer overflow was found in the NSCEncryptUpdate function in Mozilla nss. A remote attacker could trigger this...

Low: golang

Issue Overview: No CVE associated with this advisory Affected Packages: golang Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update golang or yum update...

Important: thunderbird

Issue Overview: The plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 68.3, Firefox ESR 68.3...

Amazon Linux 2 : nss-softokn (ALAS-2020-1379)

The version of nss-softokn installed on the remote host is prior to 3.44.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1379 advisory. Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized befor...

Amazon Linux 2 : oniguruma (ALAS-2020-1380)

The version of oniguruma installed on the remote host is prior to 5.9.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1380 advisory. Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. CVE-2019-16163 Oniguruma...

Medium: oniguruma

Issue Overview: Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. CVE-2019-16163 Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in strlowercasematch in regexec.c.CVE-2019-19246 Affected Packages:...

Amazon Linux 2 : SDL (ALAS-2019-1375)

A heap-based buffer overflow flaw, in SDL while copying an existing surface into a new optimized one, due to a lack of validation while loading a BMP image, is possible. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw, which could allow an attacker to ma...

Amazon Linux 2 : udisks2 (ALAS-2019-1377)

UDisks 2.8.0 has a format string vulnerability in udiskslog in udiskslogging.c, allowing attackers to obtain sensitive information stack contents, cause a denial of service memory corruption, or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n...

Amazon Linux 2 : git (ALAS-2019-1371)

Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning CVE-2019-1351 NTFS protections inactive when running Git in the Windows Subsystem for Linux CVE-2019-1353 remote code execution in recursive clones with nested submodules CVE-2019-1387 Arbitrary path...

Amazon Linux 2 : java-1.7.0-openjdk (ALAS-2019-1372)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JAXP. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

Amazon Linux 2 : libsolv (ALAS-2019-1374)

There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any real-world...

Amazon Linux 2 : libidn2 (ALAS-2019-1373)

heap-based buffer overflow in idn2toascii4i in lib/lookup.c idn2toascii4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.CVE-2019-18224 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fro...