Amazon Linux 2 : qemu (ALAS-2020-1485)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1485 advisory. A use after free vulnerability in ipreass in ipinput.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial o...

Amazon Linux 2 : thunderbird (ALAS-2020-1487)

The version of thunderbird installed on the remote host is prior to 68.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1487 advisory. Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit hea...

Amazon Linux 2 : postgresql-jdbc (ALAS-2020-1482)

The version of postgresql-jdbc installed on the remote host is prior to 9.2.1002-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1482 advisory. PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE. A flaw was found in PostgreSQL JDBC in versions prior to...

Amazon Linux 2 : python (ALAS-2020-1483)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1483 advisory. In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by...

Important: postgresql-jdbc

Issue Overview: PostgreSQL JDBC Driver aka PgJDBC before 42.2.13 allows XXE. A flaw was found in PostgreSQL JDBC in versions prior to 42.2.13. An XML External Entity XXE weakness was found in PostgreSQL JDBC. The highest threat from this vulnerability is to data confidentiality and system...

Medium: python

Issue Overview: In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation. CVE-2019-20907 Affected Packages: python Note: This advisory is applicable to Amazon Linux 2 AL2...

Amazon Linux 2 : python3 (ALAS-2020-1484)

The version of python3 installed on the remote host is prior to 3.7.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1484 advisory. Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,...

Amazon Linux 2 : dovecot (ALAS-2020-1473)

The version of dovecot installed on the remote host is prior to 2.2.36-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1473 advisory. In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker...

Amazon Linux 2 : evince (ALAS-2020-1474)

The version of evince installed on the remote host is prior to 3.28.2-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1474 advisory. The tiffdocumentrender and tiffdocumentgetthumbnail functions in the TIFF document backend in GNOME Evince through 3.32.0 did not...

Amazon Linux 2 : gnome-shell (ALAS-2020-1478)

The version of gnome-shell installed on the remote host is prior to 3.28.3-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1478 advisory. It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An...

Amazon Linux 2 : golang (ALAS-2020-1479)

The version of golang installed on the remote host is prior to 1.13.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1479 advisory. Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy...

Amazon Linux 2 : poppler (ALAS-2020-1481)

The version of poppler installed on the remote host is prior to 0.26.5-42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1481 advisory. An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function...

Amazon Linux 2 : kernel (ALAS-2020-1480)

The version of kernel installed on the remote host is prior to 4.14.192-147.314. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1480 advisory. 2024-06-19: CVE-2020-14356 was added to this advisory. The Serial Attached SCSI SAS implementation in the Linux...

Amazon Linux 2 : evolution-data-server, evolution-ews (ALAS-2020-1475)

The version of evolution-data-server installed on the remote host is prior to 3.28.5-4. The version of evolution-ews installed on the remote host is prior to 3.28.5-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1475 advisory. It was discovered evolution-ews befo...

Amazon Linux 2 : evolution (ALAS-2020-1476)

The version of evolution installed on the remote host is prior to 3.28.5-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1476 advisory. GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted ema...

Amazon Linux 2 : gettext (ALAS-2020-1477)

The version of gettext installed on the remote host is prior to 0.19.8.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1477 advisory. An issue was discovered in GNU gettext 0.19.8. There is a double free in defaultaddmessage in read- catalog.c, related to an...

Low: gettext

Issue Overview: An issue was discovered in GNU gettext 0.19.8. There is a double free in defaultaddmessage in read-catalog.c, related to an invalid free in pogramparse in po-gram-gen.y, as demonstrated by lt-msgfmt. CVE-2018-18751 Affected Packages: gettext Note: This advisory is applicable to...

Medium: evolution

Issue Overview: GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment. CVE-2018-15587 Affected Packages: evolution Note: This advisory i...

Medium: gnome-shell

Issue Overview: It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions. CVE-2019-3820 Affected...

Medium: golang

Issue Overview: Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time. CVE-2020-15586 Affected Packages: golang Note: This advisory is...