Important: kernel-livepatch-4.14.209-160.335

Issue Overview: A flaw was found in the Linux kernel's implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to...

Important: kernel-livepatch-4.14.209-160.339

Issue Overview: A flaw was found in the Linux kernel's implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to...

Important: sudo

Issue Overview: When sudo runs a command in shell mode, either via the -s or -i command line option, it escapes special characters in the command's arguments with a backslash. The sudoers policy plugin will then remove the escape characters from the arguments before evaluating the sudoers policy...

Critical: thunderbird

Issue Overview: A malicious peer could have modified a COOKIE-ECHO chunk in a SCTP packet in a way that potentially resulted in a use-after-free. We presume that with enough effort it could have been exploited to run arbitrary code. CVE-2020-16044 Affected Packages: thunderbird Note: This advisor...

Amazon Linux 2 : xorg-x11-server (ALAS-2021-1592)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1592 advisory. A flaw was found in the way the Xserver memory was not properly initialized. This issue leak parts of server memory to the X client. In cases where the Xorg server runs with elevated privileges,...

Important: xorg-x11-server

Issue Overview: A flaw was found in the way the Xserver memory was not properly initialized. This issue leak parts of server memory to the X client. In cases where the Xorg server runs with elevated privileges, this flaw results in a possible ASLR bypass. CVE-2020-14347 A flaw was found in the...

Amazon Linux 2 : thunderbird (ALAS-2021-1594)

The version of thunderbird installed on the remote host is prior to 78.6.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1594 advisory. A malicious peer could have modified a COOKIE-ECHO chunk in a SCTP packet in a way that potentially resulted in a...

Amazon Linux 2 : xstream (ALAS-2021-1593)

The version of xstream installed on the remote host is prior to 1.3.1-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1593 advisory. A flaw was found in xstream. An unsafe deserialization of user-supplied XML, in conjunction with relying on the default deny list,...

Amazon Linux 2 : python-rtslib (ALAS-2021-1589)

The version of python-rtslib installed on the remote host is prior to 2.1.74-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1589 advisory. A flaw was found in Open-iSCSI rtslib-fb through versions 2.1.72, where it has weak permissions for...

Amazon Linux 2 : dnsmasq (ALAS-2021-1587)

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1587 advisory. A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:replyquery if th...

Amazon Linux 2 : kernel (ALAS-2021-1588)

The version of kernel installed on the remote host is prior to 4.14.214-160.339. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1588 advisory. In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making...

Amazon Linux AMI : sudo (ALAS-2021-1478)

The version of sudo installed on the remote host is prior to 1.8.23-9.56. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1478 advisory. When sudo runs a command in shell mode, either via the -s or -i command line option, it escapes special characters in the command's...

Amazon Linux 2 : targetcli (ALAS-2021-1591)

The version of targetcli installed on the remote host is prior to 2.1.53-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1591 advisory. An access flaw was found in targetcli, where the /etc/target and underneath backup directory/files were world-readable. This fla...

Amazon Linux AMI : kernel (ALAS-2021-1477)

The version of kernel installed on the remote host is prior to 4.14.214-118.339. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1477 advisory. In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making ...

Amazon Linux 2 : sudo (ALAS-2021-1590)

The version of sudo installed on the remote host is prior to 1.8.23-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1590 advisory. When sudo runs a command in shell mode, either via the -s or -i command line option, it escapes special characters in the command's...

Amazon Linux AMI : php7-pear (ALAS-2021-1466)

The version of php7-pear installed on the remote host is prior to 1.10.12-4.30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1466 advisory. ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

Amazon Linux AMI : vim (ALAS-2021-1474)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1474 advisory. A flaw was found in vim in the restricted mode, where all commands that make use of external shells are disabled. However, it was found that users could still execute some arbitrary OS commands in the...

Amazon Linux AMI : golang (ALAS-2021-1471)

The version of golang installed on the remote host is prior to 1.15.5-1.65. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1471 advisory. Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. CVE-2020-28362 Go before 1.14.12 and 1.15.x before...

Amazon Linux AMI : net-snmp (ALAS-2021-1465)

The version of net-snmp installed on the remote host is prior to 5.5-60.22. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1465 advisory. A flaw was found in Net-SNMP through version 5.73, where an Improper Privilege Management issue occurs due to SNMP WRITE access t...

Amazon Linux AMI : tomcat7 (ALAS-2021-1472)

The version of tomcat7 installed on the remote host is prior to 7.0.107-1.39. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1472 advisory. A flaw was found in Apache Tomcat. The HTTP header parsing code used an approach to end-of-line EOL parsing that allowed some...