Amazon Linux AMI : doxygen (ALAS-2020-1412)

The version of doxygen installed on the remote host is prior to 1.8.5-4.14. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1412 advisory. Insufficient sanitization of the query parameter in templates/html/searchopensearch.php could lead to reflected cross-site...

Amazon Linux AMI : tomcat8 (ALAS-2020-1409)

The version of tomcat8 installed on the remote host is prior to 8.5.57-1.85. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1409 advisory. The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 t...

Amazon Linux AMI : curl (ALAS-2020-1411)

The version of curl installed on the remote host is prior to 7.61.1-12.94. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1411 advisory. This issue only affects the 'curl' command line utility. Additionally, this is only an issue when using the '-J' with the '-O'...

Amazon Linux AMI : openvpn (ALAS-2020-1410)

The version of openvpn installed on the remote host is prior to 2.4.9-1.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1410 advisory. This security issue is quite hard to abuse, requiring a fairly precise timing attack combined with guessing a just assigned peer-...

Amazon Linux AMI : python26 (ALAS-2020-1406)

The version of python26 installed on the remote host is prior to 2.6.9-2.90. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1406 advisory. Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server...

Amazon Linux AMI : python27, python34, python35, python36 (ALAS-2020-1407)

The version of python27 installed on the remote host is prior to 2.7.18-1.138. The version of python34 installed on the remote host is prior to 3.4.10-1.50. The version of python35 installed on the remote host is prior to 3.5.7-1.26. The version of python36 installed on the remote host is prior t...

Amazon Linux AMI : mysql56 (ALAS-2020-1402)

The version of mysql56 installed on the remote host is prior to 5.6.49-1.37. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1402 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Replication. Supported versions that are...

Amazon Linux AMI : nghttp2 (ALAS-2020-1404)

The version of nghttp2 installed on the remote host is prior to 1.33.0-1.1.6. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1404 advisory. In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept...

Amazon Linux 2 : qemu, --advisory ALAS2-2020-1467 (ALAS-2020-1467)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1467 advisory. In libslirp 4.1.0, as used in QEMU 4.2.0, tcpsubr.c misuses snprintf return values, leading to a buffer overflow in later code...

Amazon Linux 2 : libxml2 (ALAS-2020-1466)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1466 advisory. A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval function of libxml2 through 2.9.8 when...

Amazon Linux 2 : kernel (ALAS-2020-1465)

The version of kernel installed on the remote host is prior to 4.14.186-146.268. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1465 advisory. An issue where a provided address with accessok is not checked was discovered in i915gemexecbuffer2ioctl in...

Amazon Linux 2 : thunderbird (ALAS-2020-1468)

The version of thunderbird installed on the remote host is prior to 68.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1468 advisory. The Mozilla Foundation Security Advisory describes this flaw as: If Thunderbird is configured to use STARTTLS for an...

Important: qemu

Issue Overview: In libslirp 4.1.0, as used in QEMU 4.2.0, tcpsubr.c misuses snprintf return values, leading to a buffer overflow in later code. CVE-2020-8608 Affected Packages: qemu Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference...

Amazon Linux 2 : samba (ALAS-2020-1459)

The version of samba installed on the remote host is prior to 4.10.4-11. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1459 advisory. A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server...

Amazon Linux AMI : qemu-kvm (ALAS-2020-1400)

The version of qemu-kvm installed on the remote host is prior to 1.5.3-156.19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1400 advisory. In libslirp 4.1.0, as used in QEMU 4.2.0, tcpsubr.c misuses snprintf return values, leading to a buffer overflow in...

Amazon Linux AMI : cairo (ALAS-2020-1392)

The version of cairo installed on the remote host is prior to 1.12.14-6.9. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1392 advisory. The fillxrgb32lerpopaquespans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denia...

Amazon Linux 2 : taglib (ALAS-2020-1460)

The version of taglib installed on the remote host is prior to 1.8-8.20130218git. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1460 advisory. The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause informatio...

Amazon Linux AMI : kernel (ALAS-2020-1382)

The version of kernel installed on the remote host is prior to 4.14.177-107.254. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1382 advisory. A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw...

Amazon Linux 2 : qt (ALAS-2020-1458)

The version of qt installed on the remote host is prior to 4.8.5-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1458 advisory. An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp...

Amazon Linux 2 : thunderbird (ALAS-2020-1462)

The version of thunderbird installed on the remote host is prior to 68.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1462 advisory. Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed...