Amazon Linux 2 : httpd (ALAS-2020-1490)

The version of httpd installed on the remote host is prior to 2.4.46-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1490 advisory. Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE A flaw was found in Apache httpd in...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2020-1491)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.265.b01-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1491 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supporte...

Amazon Linux 2 : libvpx (ALAS-2020-1558)

The version of libvpx installed on the remote host is prior to 1.3.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1558 advisory. A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file t...

Amazon Linux 2 : qemu (ALAS-2020-1562)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1562 advisory. A memory leakage flaw was found in the way the VNC display driver of QEMU handled the connection disconnect when ZRLE and Tig...

Amazon Linux 2 : libvirt (ALAS-2020-1557)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1557 advisory. A flaw was found in the way the libvirtd daemon issued the 'suspend' command to a QEMU guest-agent running inside a guest...

Amazon Linux 2 : golang (ALAS-2020-1554)

The version of golang installed on the remote host is prior to 1.15.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1554 advisory. Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Typ...

Amazon Linux 2 : nspr, nss-softokn, nss-util, nss (ALAS-2020-1559)

The version of nspr installed on the remote host is prior to 4.25.0-2. The version of nss installed on the remote host is prior to 3.53.1-3. The version of nss-softokn installed on the remote host is prior to 3.53.1-6. The version of nss- util installed on the remote host is prior to 3.53.1-1. It...

Amazon Linux 2 : glib2 (ALAS-2020-1553)

The version of glib2 installed on the remote host is prior to 2.56.1-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1553 advisory. filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operati...

Amazon Linux 2 : webkitgtk4 (ALAS-2020-1563)

The version of webkitgtk4 installed on the remote host is prior to 2.28.2-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1563 advisory. WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when...

Medium: oniguruma

Issue Overview: In Oniguruma 6.9.5rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one byte in concatoptexactstr in src/regcomp.c . CVE-2020-26159 Affected Packages: oniguruma Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Amazon Linux 2 : oniguruma (ALAS-2020-1560)

The version of oniguruma installed on the remote host is prior to 5.9.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1560 advisory. In Oniguruma 6.9.5rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one...

Amazon Linux 2 : ibus (ALAS-2020-1555)

The version of ibus installed on the remote host is prior to 1.5.17-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1555 advisory. A flaw was discovered in ibus that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due...

Amazon Linux 2 : pcp (ALAS-2020-1561)

The version of pcp installed on the remote host is prior to 4.3.2-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1561 advisory. A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance...

Amazon Linux 2 : kernel (ALAS-2020-1556)

The version of kernel installed on the remote host is prior to 4.14.203-156.332. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1556 advisory. In binderreleasework of binder.c, there is a possible use-after-free due to improper locking. This could lead to...

Medium: nspr, nss-softokn, nss-util, nss

Issue Overview: When importing a curve25519 private key in PKCS8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services NSS library. This could lead to information disclosure. This vulnerability affects Firefox ESR 60.8, Firefox 68, and...

Medium: glib2

Issue Overview: filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used. CVE-2019-12450 Affected Packages: glib2 Note: This advisory is applicable to Amazon Linux 2...

Amazon Linux 2 : doxygen (ALAS-2020-1508)

The version of doxygen installed on the remote host is prior to 1.8.5-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1508 advisory. Insufficient sanitization of the query parameter in templates/html/searchopensearch.php could lead to reflected cross-site scriptin...

Amazon Linux 2 : python-pillow (ALAS-2020-1542)

The version of python-pillow installed on the remote host is prior to 2.0.0-21.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1542 advisory. An out-of-bounds read was discovered in python-pillow in the way it decodes FLI images. An application that uses...

Amazon Linux 2 : NetworkManager (ALAS-2020-1498)

The version of NetworkManager installed on the remote host is prior to 1.18.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1498 advisory. A flaw was found in nmcli, where the command-line interface to the NetworkManager did not accept the 802-1x.ca-path and...

Amazon Linux 2 : evince (ALAS-2020-1511)

The version of evince installed on the remote host is prior to 3.28.2-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1511 advisory. A divide-by-zero error was found in the way Poppler handled certain PDF files. A remote attacker could exploit this flaw by...