Amazon Linux 2 : gupnp (ALAS-2021-1673)

The version of gupnp installed on the remote host is prior to 1.0.2-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1673 advisory. A flaw was found in gupnp. DNS rebinding can occur when a victim's browser is used by a remote web server to trigger actions against...

Amazon Linux 2 : libwebp (ALAS-2021-1676)

The version of libwebp installed on the remote host is prior to 0.3.0-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1676 advisory. A flaw was found in libwebp. A heap-based buffer overflow was found in PutLE16. The highest threat from this vulnerabilit...

Amazon Linux 2 : qt5-qtimageformats (ALAS-2021-1679)

The version of qt5-qtimageformats installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1679 advisory. A flaw was found in libwebp. A heap-based buffer overflow was found in PutLE16. The highest threat from this...

Amazon Linux 2 : unbound (ALAS-2021-1683)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1683 advisory. 2024-01-19: CVE-2019-25033 was added to this advisory. A flaw was found in unbound. An integer overflow in regionalalloc...

Amazon Linux 2 : thunderbird (ALAS-2021-1681)

The version of thunderbird installed on the remote host is prior to 78.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1681 advisory. OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypte...

Amazon Linux 2 : kernel (ALAS-2021-1675)

The version of kernel installed on the remote host is prior to 4.14.232-177.418. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1675 advisory. A flaw was found in kernel/bpf/verifier.c in BPF in the Linux kernel. An incorrect limit is enforced for pointer arithmetic...

Amazon Linux 2 : samba (ALAS-2021-1680)

The version of samba installed on the remote host is prior to 4.10.16-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1680 advisory. A flaw was found in samba. The Samba smbd file server must map Windows group identities SIDs into unix group ids gids. The code th...

Amazon Linux 2 : libxml2 (ALAS-2021-1677)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1677 advisory. There's a flaw in libxml2's xmllint. An attacker who is able to submit a crafted file to be processed by xmllint could...

Amazon Linux 2 : transfig (ALAS-2021-1682)

The version of transfig installed on the remote host is prior to 3.2.8a-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1682 advisory. An Out of Bounds flaw was found in fig2dev utility within transfig. An attacker could use this flaw and provide a crafted input t...

Amazon Linux 2 : httpd (ALAS-2021-1672)

The version of httpd installed on the remote host is prior to 2.4.46-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1672 advisory. A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this fl...

Important: httpd

Issue Overview: A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this flaw to crash the httpd child process, causing temporary denial of service. CVE-2021-31618 Affected Packages: httpd Note: This advisory is applicable t...

Amazon Linux 2 : httpd (ALAS-2021-1659)

The version of httpd installed on the remote host is prior to 2.4.48-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1659 advisory. A flaw was found in Apache httpd. The modproxywstunnel module tunnels non-upgraded connections. CVE-2019-17567 Apache HTTP...

Amazon Linux 2 : systemd, --advisory ALAS2-2021-1647 (ALAS-2021-1647)

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1647 advisory. It was discovered that systemd is vulnerable to a state injection attack when deserializing the state of a service...

Amazon Linux 2 : postgresql (ALAS-2021-1665)

The version of postgresql installed on the remote host is prior to 9.2.24-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1665 advisory. A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER...

Amazon Linux 2 : python-urllib3 (ALAS-2021-1668)

The version of python-urllib3 installed on the remote host is prior to 1.25.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1668 advisory. A flaw was found in python-urllib3. The HTTPConnection.request does not properly validate CRLF sequences in the HTTP reques...

Amazon Linux 2 : curl (ALAS-2021-1653)

The version of curl installed on the remote host is prior to 7.61.1-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1653 advisory. It was discovered that libcurl did not remove authentication credentials from URLs when automatically populating the Refere...

Amazon Linux 2 : golang (ALAS-2021-1657)

The version of golang installed on the remote host is prior to 1.15.12-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1657 advisory. A vulnerability was found in net/http of the Go standard library when parsing very large HTTP header values, causing a crash and...

Amazon Linux 2 : slapi-nis (ALAS-2021-1646)

The version of slapi-nis installed on the remote host is prior to 0.56.5-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1646 advisory. A flaw was found in slapi-nis. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated...

Amazon Linux 2 : bind (ALAS-2021-1651)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1651 advisory. Incremental zone transfers IXFR provide a way of transferring changed portions of a zone between servers. An IXFR stream containi...

Amazon Linux 2 : microcode_ctl (ALAS-2021-1663)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1663 advisory. A flaw was found in the Intel Advanced Vector Extensions AVX implementation, where a local authenticated attacker with the...