Amazon Linux 2 : ntp (ALAS-2021-1706)

The version of ntp installed on the remote host is prior to 4.2.8p15-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1706 advisory. The monlist feature in ntprequest.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service traffic...

Amazon Linux 2 : kernel (ALAS-2021-1704)

The version of kernel installed on the remote host is prior to 4.14.246-187.474. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1704 advisory. A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing t...

Amazon Linux 2 : glibc (ALAS-2021-1703)

The version of glibc installed on the remote host is prior to 2.26-53. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1703 advisory. An integer overflow flaw was found in glibc that may result in reading of arbitrary memory when wordexp is used with a specially...

Amazon Linux 2 : thunderbird (ALAS-2021-1709)

The version of thunderbird installed on the remote host is prior to 78.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1709 advisory. If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses...

Amazon Linux 2 : php-pear (ALAS-2021-1708)

The version of php-pear installed on the remote host is prior to 1.10.12-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1708 advisory. In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than...

Amazon Linux 2 : openldap (ALAS-2021-1707)

The version of openldap installed on the remote host is prior to 2.4.44-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1707 advisory. A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resultin...

Amazon Linux 2 : gcc10-binutils (ALAS-2021-1702)

The version of gcc10-binutils installed on the remote host is prior to 2.35-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1702 advisory. 2024-01-19: CVE-2021-20284 was added to this advisory. An issue was discovered in the Binary File Descriptor BFD...

Medium: php-pear

Issue Overview: In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193. CVE-2021-32610 Affected Packages: php-pear Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section fo...

Important: exiv2

Issue Overview: A flaw was found in exiv2. A flawed bounds checking in the jp2Image.cpp:doWriteMetadata function leads to a heap-based buffer overflow. This flaw allows an attacker who can provide a malicious image to an application using the exiv2 library, to write data out of bounds and...

Medium: glibc

Issue Overview: An integer overflow flaw was found in glibc that may result in reading of arbitrary memory when wordexp is used with a specially crafted untrusted regular expression input. CVE-2021-35942 Affected Packages: glibc Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Medium: openldap

Issue Overview: A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service. CVE-2020-36225 Affected Packages: openldap Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FA...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2021-1695)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.302.b08-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1695 advisory. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component:...

Important: kernel

Issue Overview: A flaw was found in the Linux kernel's KVM implementation, where improper handing of the VMIO|VMPFNMAP VMAs in KVM bypasses RO checks and leads to pages being freed while still accessible by the VMM and guest. This flaw allows users who can start and control a VM to read/write...

Amazon Linux 2 : kernel, --advisory ALAS2-2021-1696 (ALAS-2021-1696)

The version of kernel installed on the remote host is prior to 4.14.241-184.433. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1696 advisory. A flaw was found in the Linux kernel, where a BPF program can obtain sensitive information from kernel memory via ...

Amazon Linux 2 : linuxptp (ALAS-2021-1697)

The version of linuxptp installed on the remote host is prior to 2.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1697 advisory. A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports...

Amazon Linux 2 : xstream (ALAS-2021-1698)

The version of xstream installed on the remote host is prior to 1.3.1-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1698 advisory. A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights...

Amazon Linux 2 : curl (ALAS-2021-1693)

The version of curl installed on the remote host is prior to 7.76.1-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1693 advisory. A flaw was found in libcurl from versions 7.29.0 through 7.71.1. An application that performs multiple requests with libcurl...

Amazon Linux 2 : golang (ALAS-2021-1694)

The version of golang installed on the remote host is prior to 1.15.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1694 advisory. A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially...

Important: java-1.8.0-openjdk

Issue Overview: Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1...

Medium: golang

Issue Overview: A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files. CVE-2021-33196 A flaw was found in golang. A panic can be triggered by an attacker in a privileged netwo...