Medium: e2fsprogs

Issue Overview: An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability...

Important: squid

Issue Overview: A flaw was found in squid. Due to incorrect data validation, a HTTP Request Smuggling attack against HTTP and HTTPS traffic is possible leading to cache poisoning. The highest threat from this vulnerability is to data confidentiality and integrity. CVE-2020-15810 A flaw was found ...

Medium: zziplib

Issue Overview: It was discovered that zziplib is vulnerable to a directory traversal flaw in most of its unzip binaries, including unzip-mem, unzzipcat-mem, unzzipcat-big, unzzipcat-mix, and unzzipcat-zip. An attacker may use this flaw to write files outside the intended target directory,...

Medium: audiofile

Issue Overview: The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an attacker to cause a denial of service via a crafted caf file, as demonstrated by sfconvert. CVE-2018-13440 An issue has been discovered in...

Amazon Linux 2 : zziplib (ALAS-2020-1551)

The version of zziplib installed on the remote host is prior to 0.13.62-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1551 advisory. It was discovered that zziplib is vulnerable to a directory traversal flaw in most of its unzip binaries, including unzip-mem,...

Amazon Linux 2 : e2fsprogs (ALAS-2020-1509)

The version of e2fsprogs installed on the remote host is prior to 1.42.9-19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1509 advisory. An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially...

Amazon Linux 2 : cpio (ALAS-2020-1505)

The version of cpio installed on the remote host is prior to 2.11-28. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1505 advisory. It was discovered cpio does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives...

Medium: geronimo-jaxrpc

Issue Overview: Liblouis 3.5.0 has a Segmentation fault in loulogPrint in logging.c. CVE-2018-11577 Liblouis 3.5.0 has a stack-based Buffer Overflow in the function includeFile in compileTranslationTable.c. CVE-2018-11684 Liblouis 3.5.0 has a stack-based Buffer Overflow in the function...

Medium: NetworkManager

Issue Overview: A flaw was found in nmcli, where the command-line interface to the NetworkManager did not accept the 802-1x.ca-path and 802-1x.phase2-ca-path settings when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and an...

Medium: OpenEXR

Issue Overview: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp. CVE-2020-11761 An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and...

Medium: bash

Issue Overview: rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASHCMDS, thus allowing the user to execute any command with the permissions of the shell. CVE-2019-9924 Affected Packages: bash Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository...

Medium: openldap

Issue Overview: In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service daemon crash. CVE-2020-12243 Affected Packages: openldap Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

Low: doxygen

Issue Overview: Insufficient sanitization of the query parameter in templates/html/searchopensearch.php could lead to reflected cross-site scripting or iframe injection. CVE-2016-10245 Affected Packages: doxygen Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this F...

Medium: libsrtp

Issue Overview: Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service crash via vectors related to a length inconsistency in the cryptopolicysetfromprofileforrtp and srtpprotect functions. CVE-2013-2139 The encryption-processing featur...

Amazon Linux 2 : unzip (ALAS-2020-1550)

The version of unzip installed on the remote host is prior to 6.0-21. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1550 advisory. Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka ...

Amazon Linux 2 : subversion (ALAS-2020-1549)

The version of subversion installed on the remote host is prior to 1.7.14-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1549 advisory. In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a...

Amazon Linux 2 : mailman (ALAS-2020-1536)

The version of mailman installed on the remote host is prior to 2.1.15-30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1536 advisory. A cross-site scripting vulnerability XSS has been discovered in mailman due to the hostname field not being properly...

Low: avahi

Issue Overview: avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service traffic amplification and may cause information leakage by obtaining potentially...

Low: unzip

Issue Overview: Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka a "better zip bomb" issue. CVE-2019-13232 Affected Packages: unzip Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit...

Low: libwmf

Issue Overview: No CVE associated with this advisory Affected Packages: libwmf Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update libwmf or yum update...