Important: postfix

Issue Overview: Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpddatarestrictions=rejectunauthpipelining and smtpddiscardehlokeywords=chunking or certain other options that exist in recent versions. Remote attackers can use a published exploitation technique to inject e-mai...

Medium: nss-softokn

Issue Overview: It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a Bleichenbacher or Manger like attack against all RSA decryption operations. As the...

Low: uriparser

Issue Overview: An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner. CVE-2021-46141 Affected Packages: uriparser Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2024-2415)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.10+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2415 advisory. A vulnerability that allows an attacker to execute arbitrary java code from the javascript engine even...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2024-2414)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.22+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2414 advisory. A vulnerability that allows an attacker to execute arbitrary java code from the javascript engine even...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2024-009)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0402.b06-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2CORRETTO8-2024-009 advisory. 2024-05-03: The severity of this advisory has been changed from important to low. 2024-05-02:...

Medium: xmlgraphics-commons

Issue Overview: Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET...

Medium: jetty

Issue Overview: For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. Thi...

Medium: squid

Issue Overview: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to...

Low: perl-HTTP-Daemon

Issue Overview: HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based...

Amazon Linux 2 : jetty (ALAS-2024-2394)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2394 advisory. Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a...

Amazon Linux 2 : gstreamer-plugins-base (ALAS-2024-2407)

The version of gstreamer-plugins-base installed on the remote host is prior to 0.10.36-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2407 advisory. A flaw was found in gstreamer-plugins-base where an out-of-bounds read when handling certain ID3v2 tags is...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-019)

The version of firefox installed on the remote host is prior to 115.5.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-019 advisory. On some systems--depending on the graphics settings and drivers--it was possible to force an out-of-bounds read an...

Amazon Linux 2 : libXpm (ALAS-2024-2389)

The version of libXpm installed on the remote host is prior to 3.5.12-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2389 advisory. A vulnerability was found in libX11 due to an infinite loop within the PutSubImage function. This flaw allows a local user to consu...

Amazon Linux 2 : python-urllib3 (ALAS-2024-2387)

The version of python-urllib3 installed on the remote host is prior to 1.25.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2387 advisory. urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an...

Amazon Linux 2 : squid (ALAS-2024-2381)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2381 advisory. Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug...

Amazon Linux 2 : net-snmp (ALAS-2024-2402)

The version of net-snmp installed on the remote host is prior to 5.7.2-49. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2402 advisory. handleipv6IpForwarding in agent/mibgroup/ip-mib/ipscalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that...

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2024-006)

The version of java-11-openjdk installed on the remote host is prior to 11.0.21.0.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2JAVA-OPENJDK11-2024-006 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE component: JSSE...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-045)

The version of kernel installed on the remote host is prior to 5.10.205-195.804. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-045 advisory. A race condition leading to a use-after-free issue was found in the QXL driver in the Linux kernel...

Amazon Linux 2 : curl (ALAS-2024-2385)

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2385 advisory. This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more origins than what is...