Amazon Linux AMI : rubygem-json (ALAS-2020-1423)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1423 advisory. The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar toCVE-2013-0269, but doe...

Amazon Linux AMI : python27 (ALAS-2020-1427)

The version of python27 installed on the remote host is prior to 2.7.18-2.139. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1427 advisory. In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened ...

Amazon Linux AMI : python-httplib2 (ALAS-2020-1420)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1420 advisory. In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for httplib2.Http.request could change request headers and body, send additional hidden requests to same server. This...

Amazon Linux AMI : golang (ALAS-2020-1417)

The version of golang installed on the remote host is prior to 1.13.14-1.58. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1417 advisory. Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProx...

Amazon Linux AMI : ruby24 (ALAS-2020-1422)

The version of ruby24 installed on the remote host is prior to 2.4.10-2.12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1422 advisory. Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using...

Amazon Linux AMI : python36 (ALAS-2020-1428)

The version of python36 installed on the remote host is prior to 3.6.11-1.18. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1428 advisory. In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when...

Amazon Linux AMI : ruby19, ruby21 (ALAS-2020-1426)

The version of ruby19 installed on the remote host is prior to 1.9.3.551-33.71. The version of ruby21 installed on the remote host is prior to 2.1.9-1.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1426 advisory. The JSON gem through 2.2.0 for Ruby, as used in Ru...

Amazon Linux 2 : golang (ALAS-2020-1479)

The version of golang installed on the remote host is prior to 1.13.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1479 advisory. Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy...

Amazon Linux 2 : dovecot (ALAS-2020-1473)

The version of dovecot installed on the remote host is prior to 2.2.36-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1473 advisory. In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker...

Amazon Linux 2 : evince (ALAS-2020-1474)

The version of evince installed on the remote host is prior to 3.28.2-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1474 advisory. The tiffdocumentrender and tiffdocumentgetthumbnail functions in the TIFF document backend in GNOME Evince through 3.32.0 did not...

Amazon Linux 2 : gnome-shell (ALAS-2020-1478)

The version of gnome-shell installed on the remote host is prior to 3.28.3-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1478 advisory. It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An...

Amazon Linux 2 : poppler (ALAS-2020-1481)

The version of poppler installed on the remote host is prior to 0.26.5-42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1481 advisory. An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function...

Amazon Linux 2 : kernel (ALAS-2020-1480)

The version of kernel installed on the remote host is prior to 4.14.192-147.314. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1480 advisory. 2024-06-19: CVE-2020-14356 was added to this advisory. The Serial Attached SCSI SAS implementation in the Linux...

Amazon Linux 2 : gettext (ALAS-2020-1477)

The version of gettext installed on the remote host is prior to 0.19.8.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1477 advisory. An issue was discovered in GNU gettext 0.19.8. There is a double free in defaultaddmessage in read- catalog.c, related to an...

Amazon Linux 2 : evolution (ALAS-2020-1476)

The version of evolution installed on the remote host is prior to 3.28.5-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1476 advisory. GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted ema...

Amazon Linux 2 : evolution-data-server, evolution-ews (ALAS-2020-1475)

The version of evolution-data-server installed on the remote host is prior to 3.28.5-4. The version of evolution-ews installed on the remote host is prior to 3.28.5-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1475 advisory. It was discovered evolution-ews befo...

Medium: evolution

Issue Overview: GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment. CVE-2018-15587 Affected Packages: evolution Note: This advisory i...

Medium: poppler

Issue Overview: An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc. CVE-2019-10871 Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.CVE-2018-21009 The JPXStream::init...

Low: gettext

Issue Overview: An issue was discovered in GNU gettext 0.19.8. There is a double free in defaultaddmessage in read-catalog.c, related to an invalid free in pogramparse in po-gram-gen.y, as demonstrated by lt-msgfmt. CVE-2018-18751 Affected Packages: gettext Note: This advisory is applicable to...

Medium: golang

Issue Overview: Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time. CVE-2020-15586 Affected Packages: golang Note: This advisory is...