Amazon Linux 2 : libldb (ALAS-2021-1628)

The version of libldb installed on the remote host is prior to 1.5.4-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1628 advisory. A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory...

Amazon Linux 2 : pki-core (ALAS-2021-1630)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1630 advisory. A Reflected Cross Site Scripting flaw was found in the pki-ca module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could...

Amazon Linux 2 : squid (ALAS-2021-1631)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1631 advisory. A flaw was found in squid. Due to improper validation while parsing the request URI, squid is vulnerable to HTTP request smuggling...

Amazon Linux 2 : thunderbird (ALAS-2021-1632)

The version of thunderbird installed on the remote host is prior to 78.9.0-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1632 advisory. The Mozilla Foundation Security Advisory describes this issue as:A texture upload of a Pixel Buffer Object could have...

Amazon Linux 2 : kernel (ALAS-2021-1627)

The version of kernel installed on the remote host is prior to 4.14.231-173.360. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1627 advisory. A memory leak in the adisupdatescanmode function in drivers/iio/imu/adisbuffer.c in the Linux kernel before 5.3.9...

Amazon Linux 2 : ipa (ALAS-2021-1626)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1626 advisory. A flaw was found in jQuery. HTML containingelements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest...

Important: nettle

Issue Overview: A flaw was found in Nettle, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an...

Important: thunderbird

Issue Overview: The Mozilla Foundation Security Advisory describes this issue as: A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash...

Medium: ipa

Issue Overview: A flaw was found in jQuery. HTML containing elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...

Important: squid

Issue Overview: A flaw was found in squid. Due to improper validation while parsing the request URI, squid is vulnerable to HTTP request smuggling. This issue could allow a trusted client to perform an HTTP request smuggling attack and access services otherwise forbidden by squid. The highest...

Amazon Linux 2 : git (ALAS-2021-1621)

The version of git installed on the remote host is prior to 2.23.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1621 advisory. Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains...

Amazon Linux 2 : screen (ALAS-2021-1623)

The version of screen installed on the remote host is prior to 4.1.0-0.27.20120314git3c2946. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1623 advisory. A flaw was found in screen. A specially crafted sequence of combining characters could cause an out of bounds...

Important: wpa_supplicant

Issue Overview: A flaw was found in the wpasupplicant, in the way it processes P2P Wi-Fi Direct provision discovery requests. This flaw allows an attacker who is within radio range of the device running P2P discovery to cause termination of the wpasupplicant process or potentially cause code...

Important: xterm

Issue Overview: A flaw was found in xterm. A specially crafted sequence of combining characters causes an out of bounds write leading to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. CVE-2021-27135 Affected...

Medium: cloud-init

Issue Overview: A vulnerability was discovered in cloud-init which can improperly disclose randomly generated passwords as part of the chpasswd module. The fix prevents the generated password from being written to a world-readable log file on the local disk. CVE-2021-3429 Affected Packages:...

Important: thunderbird

Issue Overview: If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affec...

Medium: qemu

Issue Overview: An out-of-bound write access flaw was found in the way QEMU loads ROM contents at boot time. This flaw occurs in the romcopy routine while loading the contents of a 32-bit -kernel image into memory. Running an untrusted -kernel image may load contents at arbitrary memory locations...

Amazon Linux 2 : glibc (ALAS-2021-1615)

The version of glibc installed on the remote host is prior to 2.26-42. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1615 advisory. A flaw was found in glibc's iconv functionality. This flaw allows an attacker capable of supplying a crafted sequence of characters t...

Amazon Linux 2 : cloud-init (ALAS-2021-1620)

The version of cloud-init installed on the remote host is prior to 19.3-43. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1620 advisory. A vulnerability was discovered in cloud-init which can improperly disclose randomly generated passwords as part of the chpasswd...

Amazon Linux 2 : xterm (ALAS-2021-1619)

The version of xterm installed on the remote host is prior to 295-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1619 advisory. A flaw was found in xterm. A specially crafted sequence of combining characters causes an out of bounds write leading to arbitrary code...