Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2021-1579)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.272.b10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1579 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux 2 : cloud-init (ALAS-2021-1576)

The version of cloud-init installed on the remote host is prior to 19.3-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1576 advisory. The default cloud-init configuration included sshdeletekeys: 0, disabling cloud-init's deletion of ssh host keys. In som...

Important: libuv

Issue Overview: Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on t...

Amazon Linux 2 : php-pear (ALAS-2021-1584)

The version of php-pear installed on the remote host is prior to 1.10.12-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1584 advisory. ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

Amazon Linux AMI : tigervnc (ALAS-2020-1470) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1470 advisory. - TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usa...

Amazon Linux AMI : vim-common (ALAS-2020-1468) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1468 advisory. - In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scriptin...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2020-1461) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1461 advisory. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization. Supporte...

Amazon Linux AMI : e2fsprogs (ALAS-2020-1459) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1459 advisory. - An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A...

Amazon Linux AMI : xorg-x11-server-Xdmx (ALAS-2020-1469) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1469 advisory. - A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames...

Amazon Linux AMI : ruby20 (ALAS-2020-1467) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1467 advisory. - An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP...

Amazon Linux AMI : bind (ALAS-2020-1457) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1457 advisory. - In BIND 9.0.0 - 9.11.21, 9.12.0 - 9.16.5, 9.17.0 - 9.17.3, also affects 9.9.3-S1 - 9.11.21-S1 of the BIND 9 Supporte...

Amazon Linux AMI : mysql56 (ALAS-2020-1465) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1465 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported...

Amazon Linux AMI : libxslt (ALAS-2020-1464) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1464 advisory. - libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and...

Amazon Linux AMI : kernel (ALAS-2020-1462) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1462 advisory. - DISPUTED In the Linux kernel 4.19.83, there is a use-after-free read in the debugfsremove function in...

Medium: kernel-livepatch-4.14.193-149.317

Issue Overview: A flaw was found in the Linux kernel. A local attacker, able to inject conntrack netlink configuration, could overflow a local buffer causing crashes or triggering the use of incorrect protocol numbers in ctnetlinkparsetuplefilter in net/netfilter/nfconntracknetlink.c. The highest...

Amazon Linux AMI : tomcat7 (ALAS-2020-1472) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1472 advisory. - In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approa...

Amazon Linux AMI : libX11 (ALAS-2020-1463) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1463 advisory. - An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged...

Medium: kernel-livepatch-4.14.198-152.320

Issue Overview: A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel. Incorrect capability checks could alllow a local user with root priviledges but no capabilities to add or remove Rados Block Devices from the system. CVE-2020-25284 Affected...

Amazon Linux AMI : tomcat8 (ALAS-2020-1473) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1473 advisory. - While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and...

Amazon Linux AMI : golang (ALAS-2020-1471) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1471 advisory. - Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. CVE-2020-28362 - Go before 1.14.12 and...