Important: libuv

Issue Overview: Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on t...

Amazon Linux 2 : php-pear (ALAS-2021-1584)

The version of php-pear installed on the remote host is prior to 1.10.12-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1584 advisory. ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2021-1579)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.272.b10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1579 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux 2 : cloud-init (ALAS-2021-1576)

The version of cloud-init installed on the remote host is prior to 19.3-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1576 advisory. The default cloud-init configuration included sshdeletekeys: 0, disabling cloud-init's deletion of ssh host keys. In som...

Medium: gd

Issue Overview: An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2 function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application,...

Amazon Linux 2 : thunderbird (ALAS-2021-1586)

The version of thunderbird installed on the remote host is prior to 78.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1586 advisory. When drawing a transparent image on top of an unknown cross-origin image, the Skia library drawImage function took a...

Medium: kernel-livepatch-4.14.193-149.317

Issue Overview: A flaw was found in the Linux kernel. A local attacker, able to inject conntrack netlink configuration, could overflow a local buffer causing crashes or triggering the use of incorrect protocol numbers in ctnetlinkparsetuplefilter in net/netfilter/nfconntracknetlink.c. The highest...

Medium: kernel-livepatch-4.14.198-152.320

Issue Overview: A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel. Incorrect capability checks could alllow a local user with root priviledges but no capabilities to add or remove Rados Block Devices from the system. CVE-2020-25284 Affected...

Amazon Linux 2 : bind (ALAS-2020-1564)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1564 advisory. A flaw was found in bind. An assertion failure can occur when trying to verify a truncated response to a TSIG-signed...

Amazon Linux 2 : kernel (ALAS-2020-1566)

The version of kernel installed on the remote host is prior to 4.14.209-160.335. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1566 advisory. A use-after-free flaw was found in the debugfsremove function in the Linux kernel. The flaw could allow a local...

Amazon Linux 2 : librepo (ALAS-2020-1568)

The version of librepo installed on the remote host is prior to 1.8.1-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1568 advisory. A flaw was found in librepo. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository...

Amazon Linux 2 : libX11 (ALAS-2020-1567)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1567 advisory. An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to caus...

Amazon Linux 2 : xorg-x11-server (ALAS-2020-1571)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1571 advisory. A flaw was found in X.Org Server. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data...

Important: librepo

Issue Overview: A flaw was found in librepo. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path...

Important: freetype

Issue Overview: Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2020-15999 Affected Packages: freetype Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository...

Amazon Linux 2 : libvirt (ALAS-2020-1569)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1569 advisory. A double free memory issue was found to occur in the libvirt API responsible for requesting information about network interfaces o...

Amazon Linux 2 : qemu (ALAS-2020-1570)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1570 advisory. A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. The issue occurs in ipreass...

Amazon Linux 2 : openssl, openssl11 (ALAS-2020-1573)

The version of openssl installed on the remote host is prior to 1.0.2k-19. The version of openssl11 installed on the remote host is prior to 1.1.1c-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1573 advisory. A null pointer dereference flaw was found in openssl...

Amazon Linux 2 : thunderbird (ALAS-2020-1572)

The version of thunderbird installed on the remote host is prior to 78.4.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1572 advisory. The Mozilla Foundation Security Advisory describes this flaw as:Mozilla developer reported memory safety bugs present...

Amazon Linux 2 : freetype (ALAS-2020-1565)

The version of freetype installed on the remote host is prior to 2.8-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1565 advisory. Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap...