Amazon Linux AMI : freetype (ALAS-2020-1348)

The version of freetype installed on the remote host is prior to 2.3.11-19.15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1348 advisory. FreeType before 2.6.1 has a heap-based buffer over-read in T1GetPrivateDict in type1/t1parse.c. CVE-2015-9381 FreeTyp...

Amazon Linux AMI : php72 (ALAS-2020-1350)

The version of php72 installed on the remote host is prior to 7.2.28-1.21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1350 advisory. In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension,...

Amazon Linux AMI : php72 (ALAS-2020-1346)

The version of php72 installed on the remote host is prior to 7.2.27-1.20. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1346 advisory. When using fgetss function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and...

Amazon Linux AMI : php73 (ALAS-2020-1347)

The version of php73 installed on the remote host is prior to 7.3.14-1.23. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1347 advisory. When using fgetss function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and...

Amazon Linux AMI : openssl (ALAS-2020-1344)

The version of openssl installed on the remote host is prior to 1.0.2k-16.151. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1344 advisory. In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker,...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2020-1345)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.242.b08-0.50. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1345 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Networking...

Amazon Linux AMI : libarchive (ALAS-2020-1343)

The version of libarchive installed on the remote host is prior to 3.1.2-14.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1343 advisory. archivereadformatrarreaddata in archivereadsupportformatrar.c in libarchive before 3.4.0 has a use-after-free in a certain...

Amazon Linux AMI : python-pip (ALAS-2020-1340)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1340 advisory. In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. CVE-2019-11236 The urllib3 library before 1.24.2 for Python mishandles...

Amazon Linux AMI : spamassassin (ALAS-2020-1341)

The version of spamassassin installed on the remote host is prior to 3.4.3-2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1341 advisory. In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA...

Amazon Linux AMI : kernel (ALAS-2020-1338)

The version of kernel installed on the remote host is prior to 4.14.165-102.185. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1338 advisory. 2024-05-09: CVE-2019-19965 was added to this advisory. A flaw was found in the Linux kernel. The cryptoreport...

Amazon Linux AMI : 389-ds-base (ALAS-2020-1334)

The version of 389-ds-base installed on the remote host is prior to 1.3.9.1-12.65. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1334 advisory. 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By...

Amazon Linux AMI : clamav (ALAS-2020-1335)

The version of clamav installed on the remote host is prior to 0.101.5-1.42. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1335 advisory. A vulnerability in the email parsing module Clam AntiVirus ClamAV Software versions 0.102.0, 0.101.4 and prior could allow an...

Amazon Linux AMI : tomcat8 (ALAS-2020-1337)

The version of tomcat8 installed on the remote host is prior to 8.5.50-1.82. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1337 advisory. When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle...

Amazon Linux AMI : mod_auth_mellon, mod24_auth_mellon (ALAS-2020-1331)

The version of mod24authmellon installed on the remote host is prior to 0.14.0-2.9. The version of modauthmellon installed on the remote host is prior to 0.13.1-1.6. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1331 advisory. modauthmellon through 0.14.2 has an Ope...

Amazon Linux AMI : mysql56 (ALAS-2020-1332)

The version of mysql56 installed on the remote host is prior to 5.6.46-1.35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1332 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Information Schema. Supported versions that are...

Amazon Linux AMI : libidn2 (ALAS-2019-1327)

idn2toascii4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string. CVE-2019-18224 GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some...

Amazon Linux AMI : rssh (ALAS-2019-1328)

Insufficient sanitation of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands. CVE-2019-3464 Insufficient sanitation of arguments...

Qualys FIM Profile Library Updates, December 2019

The library of out-of-the-box profiles in Qualys File Integrity Monitoring FIM, with their preconfigured content, provide a scalable solution to detect and identify critical changes, incidents, and risks resulting from normal as well as malicious events. With the help of these profiles, users can...

Amazon Linux AMI : glibc (ALAS-2019-1320)

In the GNU C Library aka glibc or libc6 through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the...

Amazon Linux AMI : blktrace (ALAS-2019-1319)

blktrace aka Block IO Tracing 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the devmapread function in btt/devmap.c because the device and devno arrays are too small, as demonstrated by an invalid free when using the btt program with a crafted file. CVE-2018-10689 C...