Amazon Linux 2 : ImageMagick (ALAS-2020-1497)

The version of ImageMagick installed on the remote host is prior to 6.9.10.68-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1497 advisory. ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c,...

Amazon Linux 2 : python-pillow (ALAS-2020-1542)

The version of python-pillow installed on the remote host is prior to 2.0.0-21.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1542 advisory. An out-of-bounds read was discovered in python-pillow in the way it decodes FLI images. An application that uses...

Amazon Linux 2 : libosinfo (ALAS-2020-1527)

The version of libosinfo installed on the remote host is prior to 1.1.0-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1527 advisory. A flaw was found in libosinfo, version 1.5.0, where the script for automated guest installations, 'osinfo- install-script', accep...

Amazon Linux 2 : SDL (ALAS-2020-1500)

The version of SDL installed on the remote host is prior to 1.2.15-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1500 advisory. SDL Simple DirectMedia Layer through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMAADPCMnibble in audio/SDLwave....

Amazon Linux 2 : NetworkManager (ALAS-2020-1498)

The version of NetworkManager installed on the remote host is prior to 1.18.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1498 advisory. A flaw was found in nmcli, where the command-line interface to the NetworkManager did not accept the 802-1x.ca-path and...

Amazon Linux 2 : OpenEXR (ALAS-2020-1499)

The version of OpenEXR installed on the remote host is prior to 1.7.1-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1499 advisory. An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as...

Amazon Linux 2 : bluez (ALAS-2020-1504)

The version of bluez installed on the remote host is prior to 5.44-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1504 advisory. Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation ...

Amazon Linux 2 : libssh2 (ALAS-2020-1531)

The version of libssh2 installed on the remote host is prior to 1.4.3-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1531 advisory. In libssh2 v1.9.0 and earlier versions, the SSHMSGDISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling...

Amazon Linux 2 : evince (ALAS-2020-1511)

The version of evince installed on the remote host is prior to 3.28.2-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1511 advisory. A divide-by-zero error was found in the way Poppler handled certain PDF files. A remote attacker could exploit this flaw by...

Amazon Linux 2 : geronimo-jaxrpc (ALAS-2020-1524)

The version of geronimo-jaxrpc installed on the remote host is prior to 2.1-14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1524 advisory. Liblouis 3.5.0 has a Segmentation fault in loulogPrint in logging.c. CVE-2018-11577 Liblouis 3.5.0 has a stack-base...

Amazon Linux 2 : libcroco (ALAS-2020-1521)

The version of libcroco installed on the remote host is prior to 0.6.12-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1521 advisory. A stack overflow flaw was found in libcroco. A service using libcroco's CSS parser could be crashed by a local, authenticated...

Amazon Linux 2 : doxygen (ALAS-2020-1508)

The version of doxygen installed on the remote host is prior to 1.8.5-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1508 advisory. Insufficient sanitization of the query parameter in templates/html/searchopensearch.php could lead to reflected cross-site scriptin...

Amazon Linux 2 : poppler (ALAS-2020-1541)

The version of poppler installed on the remote host is prior to 0.26.5-43. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1541 advisory. A divide-by-zero error was found in the way Poppler handled certain PDF files. A remote attacker could exploit this flaw by...

Amazon Linux 2 : libtiff (ALAS-2020-1532)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1532 advisory. TIFFCheckMalloc and TIFFCheckRealloc in tifaux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they...

Amazon Linux 2 : libxslt (ALAS-2020-1535)

The version of libxslt installed on the remote host is prior to 1.1.28-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1535 advisory. libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit...

Amazon Linux 2 : glibc (ALAS-2020-1517)

The version of glibc installed on the remote host is prior to 2.26-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1517 advisory. In the GNU C Library aka glibc or libc6 through 2.28, the getaddrinfo function would successfully parse a string that contained an IP...

Amazon Linux 2 : qt5-qtbase (ALAS-2020-1543)

The version of qt5-qtbase installed on the remote host is prior to 5.9.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1543 advisory. 2023-08-03: CVE-2020-24742 was added to this advisory. Files placed by attacker can influence the working directory and...

Amazon Linux 2 : spice-gtk (ALAS-2020-1546)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1546 advisory. Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system. Both the SPICE client spice-gtk and server are affected by these flaws. These fla...

Amazon Linux 2 : expat (ALAS-2020-1513)

The version of expat installed on the remote host is prior to 2.1.0-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1513 advisory. It was discovered that the setElementTypePrefix function incorrectly extracted XML namespace prefixes. By tricking an...

Amazon Linux 2 : libxml2 (ALAS-2020-1534)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1534 advisory. xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc-oldNs...