Amazon Linux 2 : gnome-shell (ALAS-2020-1478)

The version of gnome-shell installed on the remote host is prior to 3.28.3-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1478 advisory. It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An...

Amazon Linux 2 : evince (ALAS-2020-1474)

The version of evince installed on the remote host is prior to 3.28.2-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1474 advisory. The tiffdocumentrender and tiffdocumentgetthumbnail functions in the TIFF document backend in GNOME Evince through 3.32.0 did not...

Amazon Linux 2 : poppler (ALAS-2020-1481)

The version of poppler installed on the remote host is prior to 0.26.5-42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1481 advisory. An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function...

Amazon Linux 2 : kernel (ALAS-2020-1480)

The version of kernel installed on the remote host is prior to 4.14.192-147.314. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1480 advisory. 2024-06-19: CVE-2020-14356 was added to this advisory. The Serial Attached SCSI SAS implementation in the Linux...

Amazon Linux 2 : gettext (ALAS-2020-1477)

The version of gettext installed on the remote host is prior to 0.19.8.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1477 advisory. An issue was discovered in GNU gettext 0.19.8. There is a double free in defaultaddmessage in read- catalog.c, related to an...

Amazon Linux 2 : evolution (ALAS-2020-1476)

The version of evolution installed on the remote host is prior to 3.28.5-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1476 advisory. GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted ema...

Amazon Linux 2 : evolution-data-server, evolution-ews (ALAS-2020-1475)

The version of evolution-data-server installed on the remote host is prior to 3.28.5-4. The version of evolution-ews installed on the remote host is prior to 3.28.5-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1475 advisory. It was discovered evolution-ews befo...

Medium: evolution

Issue Overview: GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment. CVE-2018-15587 Affected Packages: evolution Note: This advisory i...

Low: gettext

Issue Overview: An issue was discovered in GNU gettext 0.19.8. There is a double free in defaultaddmessage in read-catalog.c, related to an invalid free in pogramparse in po-gram-gen.y, as demonstrated by lt-msgfmt. CVE-2018-18751 Affected Packages: gettext Note: This advisory is applicable to...

Medium: poppler

Issue Overview: An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc. CVE-2019-10871 Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.CVE-2018-21009 The JPXStream::init...

Medium: golang

Issue Overview: Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time. CVE-2020-15586 Affected Packages: golang Note: This advisory is...

Medium: gnome-shell

Issue Overview: It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions. CVE-2019-3820 Affected...

Medium: dovecot

Issue Overview: In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate to root. This occurs because of missing checks in the fts and pop3-uidl components. CVE-2019-7524 It was discovered that...

Low: evince

Issue Overview: The tiffdocumentrender and tiffdocumentgetthumbnail functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented, leading to uninitialized memory use when processing certain TIFF image files. CVE-2019-11459 Affected...

Amazon Linux AMI : keepalived (ALAS-2020-1414)

The version of keepalived installed on the remote host is prior to 1.2.13-8.5. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1414 advisory. keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or...

Amazon Linux AMI : ruby20 (ALAS-2020-1416)

The version of ruby20 installed on the remote host is prior to 2.0.0.648-1.33. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1416 advisory. An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3...

Amazon Linux 2 : python, python3 (ALAS-2020-1471)

The version of python installed on the remote host is prior to 2.7.18-1. The version of python3 installed on the remote host is prior to 3.7.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1471 advisory. 2023-10-25: CVE-2022-48560 was added to this...

Amazon Linux 2 : dnsmasq (ALAS-2020-1469)

The version of dnsmasq installed on the remote host is prior to 2.76-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1469 advisory. A flaw was found in the default configuration of dnsmasq, as shipped with Fedora and Red Hat Enterprise Linux, where it listens on...

Amazon Linux 2 : python-rsa (ALAS-2020-1470)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1470 advisory. Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses...

Medium: python-rsa

Issue Overview: Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior...