Amazon Linux AMI : kernel (ALAS-2021-1461)

The version of kernel installed on the remote host is prior to 4.14.209-117.337. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1461 advisory. A use-after-free flaw was found in the debugfsremove function in the Linux kernel. The flaw could allow a local...

Amazon Linux AMI : qemu-kvm (ALAS-2021-1467)

The version of qemu-kvm installed on the remote host is prior to 1.5.3-156.25. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1467 advisory. A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. The issue occurs in ipreass...

Amazon Linux AMI : xorg-x11-server (ALAS-2021-1475)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1475 advisory. A flaw was found in X.Org Server. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data...

Amazon Linux AMI : vim (ALAS-2021-1474)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1474 advisory. A flaw was found in vim in the restricted mode, where all commands that make use of external shells are disabled. However, it was found that users could still execute some arbitrary OS commands in the...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2021-1460)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.272.b10-1.56. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1460 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux AMI : net-snmp (ALAS-2021-1465)

The version of net-snmp installed on the remote host is prior to 5.5-60.22. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1465 advisory. A flaw was found in Net-SNMP through version 5.73, where an Improper Privilege Management issue occurs due to SNMP WRITE access t...

Amazon Linux AMI : ruby20 (ALAS-2021-1468)

The version of ruby20 installed on the remote host is prior to 2.0.0.648-2.39. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1468 advisory. An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server...

Amazon Linux AMI : bind (ALAS-2021-1457)

The version of bind installed on the remote host is prior to 9.8.2-0.68.rc1.85. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1457 advisory. A flaw was found in bind. An assertion failure can occur when trying to verify a truncated response to a TSIG-signed request...

Amazon Linux AMI : php7-pear (ALAS-2021-1466)

The version of php7-pear installed on the remote host is prior to 1.10.12-4.30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1466 advisory. ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

Amazon Linux AMI : postgresql95, postgresql96 (ALAS-2021-1476)

The version of postgresql95 installed on the remote host is prior to 9.5.24-1.82. The version of postgresql96 installed on the remote host is prior to 9.6.20-1.84. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1476 advisory. A flaw was found in postgresql. ...

Amazon Linux AMI : tomcat8 (ALAS-2021-1473)

The version of tomcat8 installed on the remote host is prior to 8.5.60-1.86. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1473 advisory. While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.5...

Amazon Linux AMI : tomcat7 (ALAS-2021-1472)

The version of tomcat7 installed on the remote host is prior to 7.0.107-1.39. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1472 advisory. A flaw was found in Apache Tomcat. The HTTP header parsing code used an approach to end-of-line EOL parsing that allowed some...

Amazon Linux AMI : golang (ALAS-2021-1471)

The version of golang installed on the remote host is prior to 1.15.5-1.65. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1471 advisory. Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. CVE-2020-28362 Go before 1.14.12 and 1.15.x before...

Amazon Linux AMI : samba (ALAS-2021-1469)

The version of samba installed on the remote host is prior to 4.10.16-9.56. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1469 advisory. A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to...

Amazon Linux 2 : gd (ALAS-2021-1577)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1577 advisory. An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2 function of PHP's gd extension. A...

Amazon Linux 2 : chrony (ALAS-2021-1575)

The version of chrony installed on the remote host is prior to 3.5.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1575 advisory. A flaw was found in chrony when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup...

Medium: golang

Issue Overview: Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. CVE-2020-28362 Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. CVE-2020-28366 Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. CVE-2020-28367 Affected Packages: golang Note:...

Amazon Linux 2 : libuv (ALAS-2021-1581)

The version of libuv installed on the remote host is prior to 1.39.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1581 advisory. Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting...

Amazon Linux 2 : libexif (ALAS-2021-1580)

The version of libexif installed on the remote host is prior to 0.6.22-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1580 advisory. A flaw was found in libexif. A possible out of bounds write, due ot an integer overflow, could lead to a remote code execution if ...

Amazon Linux 2 : net-snmp (ALAS-2021-1582)

The version of net-snmp installed on the remote host is prior to 5.7.2-49. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1582 advisory. A flaw was found in Net-SNMP through version 5.73, where an Improper Privilege Management issue occurs due to SNMP WRITE access t...