Amazon Linux 2 : freerdp (ALAS-2020-1516)

The version of freerdp installed on the remote host is prior to 2.1.1-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1516 advisory. In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients...

Amazon Linux 2 : libmspack (ALAS-2020-1525)

The version of libmspack installed on the remote host is prior to 0.5-0.8.alpha. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1525 advisory. libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function...

Amazon Linux 2 : openwsman (ALAS-2020-1540)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1540 advisory. Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in processconnection when parsing specially crafted HTTP requests. A remote, unauthenticated attacker can exploit this...

Amazon Linux 2 : audiofile (ALAS-2020-1501)

The version of audiofile installed on the remote host is prior to 0.3.6-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1501 advisory. The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in...

Amazon Linux 2 : samba (ALAS-2020-1544)

The version of samba installed on the remote host is prior to 4.10.16-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1544 advisory. All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with log...

Amazon Linux 2 : kernel (ALAS-2020-1520)

The version of kernel installed on the remote host is prior to 4.14.200-155.322. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1520 advisory. A flaw was found in the Linux kernel. When changing screen size, an out-of-bounds memory write can occur leading t...

Amazon Linux 2 : tigervnc (ALAS-2020-1552)

The version of tigervnc installed on the remote host is prior to 1.8.0-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1552 advisory. TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack...

Amazon Linux 2 : qt5-qtbase (ALAS-2020-1543)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1543 advisory. 2023-08-03: CVE-2020-24742 was added to this advisory. Files placed by attacker can influence the working directory and...

Amazon Linux 2 : expat (ALAS-2020-1513)

The version of expat installed on the remote host is prior to 2.1.0-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1513 advisory. It was discovered that the setElementTypePrefix function incorrectly extracted XML namespace prefixes. By tricking an...

Amazon Linux 2 : spice-gtk (ALAS-2020-1546)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1546 advisory. Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system. Both the SPICE client spice-gtk and server are affected by these flaws. These fla...

Amazon Linux 2 : ipa (ALAS-2020-1519)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1519 advisory. jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed...

Amazon Linux 2 : libexif (ALAS-2020-1523)

The version of libexif installed on the remote host is prior to 0.6.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1523 advisory. In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of...

Amazon Linux 2 : squid (ALAS-2020-1548)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1548 advisory. A flaw was found in squid. Due to incorrect data validation, a HTTP Request Smuggling attack against HTTP and HTTPS traffi...

Amazon Linux 2 : cups (ALAS-2020-1506)

The version of cups installed on the remote host is prior to 1.6.3-51. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1506 advisory. A localhost.localdomain whitelist entry in validhost in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to...

Amazon Linux 2 : fontforge (ALAS-2020-1514)

The version of fontforge installed on the remote host is prior to 20120731b-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1514 advisory. An out-of-bounds write was discovered in fontforge while parsing SFD files containing very large LayerCount tokens. The flaw...

Amazon Linux 2 : exiv2 (ALAS-2020-1512)

The version of exiv2 installed on the remote host is prior to 0.27.0-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1512 advisory. An out of bounds read vulnerability was discovered in the way exiv2 parses Canon raw format CRW images. An application that uses exi...

Amazon Linux 2 : edk2 (ALAS-2020-1510)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1510 advisory. Insufficient control flow management in BIOS firmware for 8th, 9th, 10th Generation IntelR CoreTM, IntelR CeleronR Processor 4000 & 5000 Series Processors may allow an authenticated user to...

Amazon Linux 2 : libwmf, --advisory ALAS2-2020-1533 (ALAS-2020-1533)

The version of libwmf installed on the remote host is prior to 0.2.8.4-44. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1533 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C...

Medium: spamassassin

Issue Overview: In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly. CVE-2019-12420 Affected Packages: spamassassin Note: This advisory is...

Low: libguestfs-winsupport

Issue Overview: An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute...