Amazon Linux 2 : libuv (ALAS-2021-1581)

The version of libuv installed on the remote host is prior to 1.39.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1581 advisory. Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting...

Amazon Linux 2 : pacemaker (ALAS-2021-1583)

The version of pacemaker installed on the remote host is prior to 1.1.23-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1583 advisory. An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use...

Amazon Linux 2 : golang (ALAS-2021-1578)

The version of golang installed on the remote host is prior to 1.15.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1578 advisory. Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. CVE-2020-28362 Go before 1.14.12 and 1.15.x before...

Amazon Linux 2 : libexif (ALAS-2021-1580)

The version of libexif installed on the remote host is prior to 0.6.22-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1580 advisory. A flaw was found in libexif. A possible out of bounds write, due ot an integer overflow, could lead to a remote code execution if ...

Amazon Linux 2 : net-snmp (ALAS-2021-1582)

The version of net-snmp installed on the remote host is prior to 5.7.2-49. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1582 advisory. A flaw was found in Net-SNMP through version 5.73, where an Improper Privilege Management issue occurs due to SNMP WRITE access t...

Amazon Linux 2 : samba (ALAS-2021-1585)

The version of samba installed on the remote host is prior to 4.10.16-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1585 advisory. A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gai...

Important: libuv

Issue Overview: Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on t...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2021-1579)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.272.b10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1579 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Medium: gd

Issue Overview: An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2 function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application,...

Amazon Linux 2 : cloud-init (ALAS-2021-1576)

The version of cloud-init installed on the remote host is prior to 19.3-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1576 advisory. The default cloud-init configuration included sshdeletekeys: 0, disabling cloud-init's deletion of ssh host keys. In som...

Amazon Linux 2 : php-pear (ALAS-2021-1584)

The version of php-pear installed on the remote host is prior to 1.10.12-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1584 advisory. ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

Amazon Linux 2 : thunderbird (ALAS-2021-1586)

The version of thunderbird installed on the remote host is prior to 78.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1586 advisory. When drawing a transparent image on top of an unknown cross-origin image, the Skia library drawImage function took a...

Amazon Linux AMI : vim-common (ALAS-2020-1468) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1468 advisory. - In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scriptin...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2020-1461) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1461 advisory. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization. Supporte...

Amazon Linux AMI : tigervnc (ALAS-2020-1470) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1470 advisory. - TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usa...

Amazon Linux AMI : bind (ALAS-2020-1457) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1457 advisory. - In BIND 9.0.0 - 9.11.21, 9.12.0 - 9.16.5, 9.17.0 - 9.17.3, also affects 9.9.3-S1 - 9.11.21-S1 of the BIND 9 Supporte...

Amazon Linux AMI : xorg-x11-server-Xdmx (ALAS-2020-1469) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1469 advisory. - A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames...

Amazon Linux AMI : e2fsprogs (ALAS-2020-1459) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1459 advisory. - An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A...

Amazon Linux AMI : ruby20 (ALAS-2020-1467) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1467 advisory. - An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP...

Amazon Linux AMI : libxslt (ALAS-2020-1464) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1464 advisory. - libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and...