Amazon Linux 2 : freetype (ALAS-2020-1565)

The version of freetype installed on the remote host is prior to 2.8-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1565 advisory. Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap...

Amazon Linux 2 : qemu (ALAS-2020-1570)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1570 advisory. A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. The issue occurs in ipreass...

Amazon Linux 2 : openssl, openssl11 (ALAS-2020-1573)

The version of openssl installed on the remote host is prior to 1.0.2k-19. The version of openssl11 installed on the remote host is prior to 1.1.1c-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1573 advisory. A null pointer dereference flaw was found in openssl...

Amazon Linux 2 : thunderbird (ALAS-2020-1572)

The version of thunderbird installed on the remote host is prior to 78.4.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1572 advisory. The Mozilla Foundation Security Advisory describes this flaw as:Mozilla developer reported memory safety bugs present...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2020-1491)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.265.b01-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1491 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supporte...

Amazon Linux 2 : httpd (ALAS-2020-1490)

The version of httpd installed on the remote host is prior to 2.4.46-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1490 advisory. Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE A flaw was found in Apache httpd in...

Amazon Linux 2 : glib2 (ALAS-2020-1553)

The version of glib2 installed on the remote host is prior to 2.56.1-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1553 advisory. filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operati...

Amazon Linux 2 : nspr, nss-softokn, nss-util, nss (ALAS-2020-1559)

The version of nspr installed on the remote host is prior to 4.25.0-2. The version of nss installed on the remote host is prior to 3.53.1-3. The version of nss-softokn installed on the remote host is prior to 3.53.1-6. The version of nss- util installed on the remote host is prior to 3.53.1-1. It...

Amazon Linux 2 : qemu (ALAS-2020-1562)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1562 advisory. A memory leakage flaw was found in the way the VNC display driver of QEMU handled the connection disconnect when ZRLE and Tig...

Amazon Linux 2 : libvirt (ALAS-2020-1557)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1557 advisory. A flaw was found in the way the libvirtd daemon issued the 'suspend' command to a QEMU guest-agent running inside a guest...

Amazon Linux 2 : golang (ALAS-2020-1554)

The version of golang installed on the remote host is prior to 1.15.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1554 advisory. Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Typ...

Amazon Linux 2 : webkitgtk4 (ALAS-2020-1563)

The version of webkitgtk4 installed on the remote host is prior to 2.28.2-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1563 advisory. WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when...

Amazon Linux 2 : libvpx (ALAS-2020-1558)

The version of libvpx installed on the remote host is prior to 1.3.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1558 advisory. A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file t...

Medium: oniguruma

Issue Overview: In Oniguruma 6.9.5rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one byte in concatoptexactstr in src/regcomp.c . CVE-2020-26159 Affected Packages: oniguruma Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Amazon Linux 2 : oniguruma (ALAS-2020-1560)

The version of oniguruma installed on the remote host is prior to 5.9.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1560 advisory. In Oniguruma 6.9.5rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one...

Amazon Linux 2 : ibus (ALAS-2020-1555)

The version of ibus installed on the remote host is prior to 1.5.17-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1555 advisory. A flaw was discovered in ibus that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due...

Medium: nspr, nss-softokn, nss-util, nss

Issue Overview: When importing a curve25519 private key in PKCS8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services NSS library. This could lead to information disclosure. This vulnerability affects Firefox ESR 60.8, Firefox 68, and...

Amazon Linux 2 : kernel (ALAS-2020-1556)

The version of kernel installed on the remote host is prior to 4.14.203-156.332. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1556 advisory. In binderreleasework of binder.c, there is a possible use-after-free due to improper locking. This could lead to...

Medium: glib2

Issue Overview: filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used. CVE-2019-12450 Affected Packages: glib2 Note: This advisory is applicable to Amazon Linux 2...

Amazon Linux 2 : pcp (ALAS-2020-1561)

The version of pcp installed on the remote host is prior to 4.3.2-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1561 advisory. A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance...