Low: doxygen

Issue Overview: Insufficient sanitization of the query parameter in templates/html/searchopensearch.php could lead to reflected cross-site scripting or iframe injection. CVE-2016-10245 Affected Packages: doxygen Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this F...

Medium: freeradius

Issue Overview: It was discovered freeradius does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the...

Amazon Linux 2 : zziplib (ALAS-2020-1551)

The version of zziplib installed on the remote host is prior to 0.13.62-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1551 advisory. It was discovered that zziplib is vulnerable to a directory traversal flaw in most of its unzip binaries, including unzip-mem,...

Amazon Linux 2 : libguestfs-winsupport (ALAS-2020-1522)

The version of libguestfs-winsupport installed on the remote host is prior to 7.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1522 advisory. An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running...

Amazon Linux 2 : dnsmasq (ALAS-2020-1507)

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1507 advisory. A flaw was found in the Dnsmasq application where a remote attacker can trigger a memory leak by sending specially crafted DHCP...

Amazon Linux 2 : unzip (ALAS-2020-1550)

The version of unzip installed on the remote host is prior to 6.0-21. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1550 advisory. Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka ...

Amazon Linux 2 : spamassassin (ALAS-2020-1545)

The version of spamassassin installed on the remote host is prior to 3.4.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1545 advisory. In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as so...

Amazon Linux 2 : subversion (ALAS-2020-1549)

The version of subversion installed on the remote host is prior to 1.7.14-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1549 advisory. In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a...

Amazon Linux 2 : avahi (ALAS-2020-1502)

The version of avahi installed on the remote host is prior to 0.6.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1502 advisory. avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not...

Low: libmspack

Issue Overview: libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmdreadheaders in libmspackfile libmspack/mspack/chmd.c. The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after...

Medium: NetworkManager

Issue Overview: A flaw was found in nmcli, where the command-line interface to the NetworkManager did not accept the 802-1x.ca-path and 802-1x.phase2-ca-path settings when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and an...

Low: avahi

Issue Overview: avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service traffic amplification and may cause information leakage by obtaining potentially...

Medium: zziplib

Issue Overview: It was discovered that zziplib is vulnerable to a directory traversal flaw in most of its unzip binaries, including unzip-mem, unzzipcat-mem, unzzipcat-big, unzzipcat-mix, and unzzipcat-zip. An attacker may use this flaw to write files outside the intended target directory,...

Medium: bash

Issue Overview: rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASHCMDS, thus allowing the user to execute any command with the permissions of the shell. CVE-2019-9924 Affected Packages: bash Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository...

Amazon Linux 2 : cpio (ALAS-2020-1505)

The version of cpio installed on the remote host is prior to 2.11-28. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1505 advisory. It was discovered cpio does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives...

Amazon Linux 2 : mailman (ALAS-2020-1536)

The version of mailman installed on the remote host is prior to 2.1.15-30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1536 advisory. A cross-site scripting vulnerability XSS has been discovered in mailman due to the hostname field not being properly...

Amazon Linux 2 : e2fsprogs (ALAS-2020-1509)

The version of e2fsprogs installed on the remote host is prior to 1.42.9-19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1509 advisory. An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially...

Amazon Linux 2 : libsrtp (ALAS-2020-1530)

The version of libsrtp installed on the remote host is prior to 1.4.4-11.20101004cvs. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1530 advisory. Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of...

Amazon Linux AMI : libxml2 (ALAS-2020-1438)

The version of libxml2 installed on the remote host is prior to 2.9.1-6.4.41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1438 advisory. xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc-oldNs...

Amazon Linux 2 : libpng (ALAS-2020-1528)

The version of libpng installed on the remote host is prior to 1.5.13-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1528 advisory. libpng before 1.6.32 does not properly check the length of chunks against the user limit. CVE-2017-12652 Tenable has extracted the...