Amazon Linux 2 : libsrtp (ALAS-2020-1530)

The version of libsrtp installed on the remote host is prior to 1.4.4-11.20101004cvs. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1530 advisory. Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of...

Low: unzip

Issue Overview: Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka a "better zip bomb" issue. CVE-2019-13232 Affected Packages: unzip Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit...

Low: libwmf

Issue Overview: No CVE associated with this advisory Affected Packages: libwmf Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update libwmf or yum update...

Low: mod_auth_openidc

Issue Overview: An open redirect flaw was discovered in modauthopenidc, where it handles logout redirection. The module does not correctly validate the URL, allowing a URL with leading slashes to bypass the protection checks. A victim user may be tricked into visiting a trusted vulnerable web sit...

Low: libmspack

Issue Overview: libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmdreadheaders in libmspackfile libmspack/mspack/chmd.c. The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after...

Low: avahi

Issue Overview: avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service traffic amplification and may cause information leakage by obtaining potentially...

Medium: libtiff

Issue Overview: TIFFCheckMalloc and TIFFCheckRealloc in tifaux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is undefined by the applicable C standards. This can, for example, lead to an application crash. CVE-2019-14973 tifgetimage.c in...

Low: exiv2

Issue Overview: An out of bounds read vulnerability was discovered in the way exiv2 parses Canon raw format CRW images. An application that uses exiv2 library to parse untrusted images may be vulnerable to this flaw, which could be used by an attacker to extract data from the application's memory...

Amazon Linux 2 : avahi (ALAS-2020-1502)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1502 advisory. avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not...

Amazon Linux 2 : libguestfs-winsupport (ALAS-2020-1522)

The version of libguestfs-winsupport installed on the remote host is prior to 7.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1522 advisory. An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running...

Low: tigervnc

Issue Overview: TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process...

Amazon Linux 2 : kernel (ALAS-2020-1495)

The version of kernel installed on the remote host is prior to 4.14.198-152.320. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1495 advisory. In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and...

Amazon Linux 2 : golang (ALAS-2020-1494)

The version of golang installed on the remote host is prior to 1.13.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1494 advisory. The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder...

Amazon Linux 2 : thunderbird (ALAS-2020-1496)

The version of thunderbird installed on the remote host is prior to 68.12.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1496 advisory. By holding a reference to the eval function from an about:blank window, a malicious webpage could have gained access...

Amazon Linux 2 : mod_http2 (ALAS-2020-1493)

The version of modhttp2 installed on the remote host is prior to 1.15.14-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1493 advisory. Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 reque...

Amazon Linux 2 : dovecot (ALAS-2020-1489)

The version of dovecot installed on the remote host is prior to 2.2.36-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1489 advisory. In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zer...

Low: lua53

Issue Overview: ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal3,2^31. CVE-2020-24370 Affected Packages: lua53 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Amazon Linux 2 : lua53 (ALAS-2020-1492)

The version of lua53 installed on the remote host is prior to 5.3.5-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1492 advisory. ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal3,2^31...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2020-1434)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.265.b01-0.54. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1434 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries...

Amazon Linux AMI : clamav (ALAS-2020-1433)

The version of clamav installed on the remote host is prior to 0.102.4-1.44. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1433 advisory. Fixed a vulnerability in the ARJ archive-parsing module in ClamAV 0.102.3 that could cause a denial-of- service DoS...