Amazon Linux 2 : thunderbird (ALAS-2020-1572)

The version of thunderbird installed on the remote host is prior to 78.4.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1572 advisory. The Mozilla Foundation Security Advisory describes this flaw as:Mozilla developer reported memory safety bugs present...

Amazon Linux 2 : qt, qt5-qtbase (ALAS-2020-1574)

The version of qt installed on the remote host is prior to 4.8.5-15. The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1574 advisory. An issue was discovered in Qt through 5.12.9, and 5.13.x...

Amazon Linux 2 : libvirt (ALAS-2020-1569)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1569 advisory. A double free memory issue was found to occur in the libvirt API responsible for requesting information about network interfaces o...

Amazon Linux 2 : kernel (ALAS-2020-1566)

The version of kernel installed on the remote host is prior to 4.14.209-160.335. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1566 advisory. A use-after-free flaw was found in the debugfsremove function in the Linux kernel. The flaw could allow a local...

Amazon Linux AMI : containerd, containerd-stress (ALAS-2020-1455)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1455 advisory. Access controls for the shim's API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow maliciou...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2020-1491)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.265.b01-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1491 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supporte...

Amazon Linux 2 : httpd (ALAS-2020-1490)

The version of httpd installed on the remote host is prior to 2.4.46-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1490 advisory. Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE A flaw was found in Apache httpd in...

Amazon Linux AMI : kernel (ALAS-2020-1446)

The version of kernel installed on the remote host is prior to 4.14.203-116.332. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1446 advisory. In binderreleasework of binder.c, there is a possible use-after-free due to improper locking. This could lead to...

Amazon Linux AMI : poppler (ALAS-2020-1450)

The version of poppler installed on the remote host is prior to 0.26.5-43.22. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1450 advisory. A divide-by-zero error was found in the way Poppler handled certain PDF files. A remote attacker could exploit this flaw by...

Amazon Linux AMI : curl (ALAS-2020-1444)

The version of curl installed on the remote host is prior to 7.61.1-12.95. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1444 advisory. A flaw was found in libcurl from versions 7.29.0 through 7.71.1. An application that performs multiple requests with libcurl's mul...

Amazon Linux AMI : mod24_auth_openidc (ALAS-2020-1448)

The version of mod24authopenidc installed on the remote host is prior to 1.8.8-7.6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1448 advisory. An open redirect flaw was discovered in modauthopenidc, where it handles logout redirection. The module does not...

Amazon Linux AMI : python27, python34, python35 (ALAS-2020-1454)

The version of python27 installed on the remote host is prior to 2.7.18-2.140. The version of python34 installed on the remote host is prior to 3.4.10-1.53. The version of python35 installed on the remote host is prior to 3.5.10-1.29. It is, therefore, affected by a vulnerability as referenced in...

Amazon Linux AMI : golang (ALAS-2020-1445)

The version of golang installed on the remote host is prior to 1.15.3-1.63. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1445 advisory. Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a...

Amazon Linux AMI : qemu-kvm (ALAS-2020-1449)

The version of qemu-kvm installed on the remote host is prior to 1.5.3-156.24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1449 advisory. qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service guest crash by leveraging...

Amazon Linux AMI : ruby24 (ALAS-2020-1451)

The version of ruby24 installed on the remote host is prior to 2.4.10-2.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1451 advisory. An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundle...

Amazon Linux AMI : libtiff (ALAS-2020-1447)

The version of libtiff installed on the remote host is prior to 4.0.3-35.36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1447 advisory. TIFFCheckMalloc and TIFFCheckRealloc in tifaux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because th...

Amazon Linux AMI : squid (ALAS-2020-1453)

The version of squid installed on the remote host is prior to 3.5.20-17.41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1453 advisory. An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive...

Amazon Linux AMI : samba (ALAS-2020-1452)

The version of samba installed on the remote host is prior to 4.10.16-5.54. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1452 advisory. All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with log...

Medium: oniguruma

Issue Overview: In Oniguruma 6.9.5rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one byte in concatoptexactstr in src/regcomp.c . CVE-2020-26159 Affected Packages: oniguruma Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Amazon Linux 2 : kernel (ALAS-2020-1556)

The version of kernel installed on the remote host is prior to 4.14.203-156.332. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1556 advisory. In binderreleasework of binder.c, there is a possible use-after-free due to improper locking. This could lead to...