Amazon Linux AMI : cloud-init (ALAS-2021-1486)

The version of cloud-init installed on the remote host is prior to 0.7.6-43.23. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1486 advisory. A flaw was found in cloud-init, where it uses the random.choice function when creating sensitive random strings used...

Important: thunderbird

Issue Overview: If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affec...

Amazon Linux AMI : bind (ALAS-2021-1485)

The version of bind installed on the remote host is prior to 9.8.2-0.68.rc1.86. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1485 advisory. A buffer overflow flaw was found in the SPNEGO implementation used by BIND. This flaw allows a remote attacker to cause the...

Amazon Linux AMI : xterm (ALAS-2021-1489)

The version of xterm installed on the remote host is prior to 295-3.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1489 advisory. A flaw was found in xterm. A specially crafted sequence of combining characters causes an out of bounds write leading to arbitrary co...

Amazon Linux AMI : kernel (ALAS-2021-1487)

The version of kernel installed on the remote host is prior to 4.14.225-121.357. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1487 advisory. An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV...

Medium: qemu

Issue Overview: An out-of-bound write access flaw was found in the way QEMU loads ROM contents at boot time. This flaw occurs in the romcopy routine while loading the contents of a 32-bit -kernel image into memory. Running an untrusted -kernel image may load contents at arbitrary memory locations...

Amazon Linux AMI : qemu-kvm (ALAS-2021-1488)

The version of qemu-kvm installed on the remote host is prior to 1.5.3-156.26. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1488 advisory. An out-of-bound write access flaw was found in the way QEMU loads ROM contents at boot time. This flaw occurs in the...

Amazon Linux 2 : cloud-init (ALAS-2021-1620)

The version of cloud-init installed on the remote host is prior to 19.3-43. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1620 advisory. A vulnerability was discovered in cloud-init which can improperly disclose randomly generated passwords as part of the chpasswd...

Amazon Linux 2 : glibc (ALAS-2021-1615)

The version of glibc installed on the remote host is prior to 2.26-42. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1615 advisory. A flaw was found in glibc's iconv functionality. This flaw allows an attacker capable of supplying a crafted sequence of characters t...

Amazon Linux 2 : xterm (ALAS-2021-1619)

The version of xterm installed on the remote host is prior to 295-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1619 advisory. A flaw was found in xterm. A specially crafted sequence of combining characters causes an out of bounds write leading to arbitrary code...

Amazon Linux 2 : thunderbird (ALAS-2021-1618)

The version of thunderbird installed on the remote host is prior to 78.8.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1618 advisory. If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was...

Amazon Linux 2 : bind (ALAS-2021-1614)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1614 advisory. A buffer overflow flaw was found in the SPNEGO implementation used by BIND. This flaw allows a remote attacker to cause the named...

Amazon Linux 2 : kernel (ALAS-2021-1616)

The version of kernel installed on the remote host is prior to 4.14.225-168.357. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1616 advisory. An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV...

Amazon Linux 2 : qemu (ALAS-2021-1617)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1617 advisory. An out-of-bound write access flaw was found in the way QEMU loads ROM contents at boot time. This flaw occurs in the romcopy...

Amazon Linux 2 : ansible (ALAS-2021-1613)

The version of ansible installed on the remote host is prior to 2.9.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1613 advisory. A flaw was found in ansible. The 'authkey' and 'privkey' credentials are disclosed by default and not protected by nolog...

Amazon Linux 2 : p11-kit (ALAS-2021-1601)

The version of p11-kit installed on the remote host is prior to 0.23.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1601 advisory. An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array...

Amazon Linux AMI : python27, python36, python38 (ALAS-2021-1484)

The version of python27 installed on the remote host is prior to 2.7.18-2.141. The version of python36 installed on the remote host is prior to 3.6.12-1.20. The version of python38 installed on the remote host is prior to 3.8.5-1.5. It is, therefore, affected by a vulnerability as referenced in t...

Amazon Linux AMI : subversion (ALAS-2021-1483)

The version of subversion installed on the remote host is prior to 1.9.7-1.61. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1483 advisory. A null-pointer-dereference flaw was found in modauthzsvn of subversion. This flaw allows a remote, unauthenticated attacker to...

Amazon Linux AMI : openssl (ALAS-2021-1482)

The version of openssl installed on the remote host is prior to 1.0.2k-16.153. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1482 advisory. Calls to EVPCipherUpdate, EVPEncryptUpdate and EVPDecryptUpdate may overflow the output length argument in some cases...

Important: kernel-livepatch-4.14.209-160.335

Issue Overview: A flaw was found in the Linux kernel. A use-after-free memory flaw in the Fast Userspace Mutexes functionality allowing a local user to crash the system or escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity ...