Important: kernel-livepatch-5.10.50-44.131

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-5.10.50-44.131 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-5.10.50-44.131 or yum update --advisory ALAS2LIVEPATCH-2021-065 to update your system. New...

Amazon Linux 2 : thunderbird (ALAS-2021-1720)

The version of thunderbird installed on the remote host is prior to 78.14.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1720 advisory. Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showe...

Amazon Linux 2 : kernel (ALAS-2021-1719)

The version of kernel installed on the remote host is prior to 4.14.252-195.481. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1719 advisory. A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2021-1718)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.13+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1718 advisory. There is a flaw in the xml entity encoding functionality of libxml2. An attacker who is able to supply...

Amazon Linux AMI : tomcat8 (ALAS-2021-1547)

The version of tomcat8 installed on the remote host is prior to 8.5.69-1.88. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1547 advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP...

Amazon Linux AMI : c-ares (ALAS-2021-1545)

The version of c-ares installed on the remote host is prior to 1.17.2-1.8. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1545 advisory. A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can...

Amazon Linux AMI : mysql57 (ALAS-2021-1544)

The version of mysql57 installed on the remote host is prior to 5.7.35-1.17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1544 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are...

Amazon Linux AMI : tomcat8 (ALAS-2021-1546)

The version of tomcat8 installed on the remote host is prior to 8.5.72-1.89. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1546 advisory. A memory leak flaw was found in Apache Tomcat, where an HTTP upgrade connection does not release for WebSocket connections once...

Low: hivex

Issue Overview: A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry hive file, which would cause hivex to recursively call the getchildren function, leading to a stack overflow. The highest threat from this vulnerability is to system...

Medium: openssl

Issue Overview: It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application into calling openssl function with a specially crafted, non-NUL terminated string to deliberately hit this bug, which may result in a crash of the applicatio...

Amazon Linux 2 : hivex (ALAS-2021-1717)

The version of hivex installed on the remote host is prior to 1.3.10-6.12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1717 advisory. A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry hive file, whic...

Amazon Linux AMI : httpd24 (ALAS-2021-1543)

The version of httpd24 installed on the remote host is prior to 2.4.51-1.94. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1543 advisory. A NULL pointer dereference was found in Apache httpd modh2. The highest threat from this flaw is to system integrity...

Amazon Linux 2 : httpd (ALAS-2021-1716)

The version of httpd installed on the remote host is prior to 2.4.51-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1716 advisory. A NULL pointer dereference was found in Apache httpd modh2. The highest threat from this flaw is to system integrity...

Medium: glib2

Issue Overview: An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If gbytearraynewtake was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 232, causing unintended length truncation. CVE-2021-27218 Affected Packages: glib2...

Important: libsndfile

Issue Overview: A heap buffer overflow flaw was found in libsndfile. This flaw allows an attacker to execute arbitrary code via a crafted WAV file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. CVE-2021-3246 Affected Packages:...

Amazon Linux 2 : openssl11 (ALAS-2021-1714)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1714 advisory. It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application int...

Amazon Linux 2 : libsndfile (ALAS-2021-1713)

The version of libsndfile installed on the remote host is prior to 1.0.25-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1713 advisory. A heap buffer overflow flaw was found in libsndfile. This flaw allows an attacker to execute arbitrary code via a crafted WAV...

Amazon Linux 2 : kernel (ALAS-2021-1712)

The version of kernel installed on the remote host is prior to 4.14.248-189.473. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1712 advisory. A flaw was found in the Linux kernel. A race condition was discovered in the ext4 subsystem. The highest threat from this...

Amazon Linux 2 : sssd (ALAS-2021-1715)

The version of sssd installed on the remote host is prior to 1.16.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1715 advisory. A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and cache-expire...

Medium: openssl11

Issue Overview: It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application into calling openssl function with a specially crafted, non-NUL terminated string to deliberately hit this bug, which may result in a crash of the applicatio...