Amazon Linux 2 : glib2 (ALAS-2020-1553)

The version of glib2 installed on the remote host is prior to 2.56.1-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1553 advisory. filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operati...

Medium: oniguruma

Issue Overview: In Oniguruma 6.9.5rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one byte in concatoptexactstr in src/regcomp.c . CVE-2020-26159 Affected Packages: oniguruma Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Amazon Linux 2 : golang (ALAS-2020-1554)

The version of golang installed on the remote host is prior to 1.15.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1554 advisory. Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Typ...

Amazon Linux 2 : oniguruma (ALAS-2020-1560)

The version of oniguruma installed on the remote host is prior to 5.9.6-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1560 advisory. In Oniguruma 6.9.5rev1, an attacker able to supply a regular expression for compilation may be able to overflow a buffer by one...

Medium: nspr, nss-softokn, nss-util, nss

Issue Overview: When importing a curve25519 private key in PKCS8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services NSS library. This could lead to information disclosure. This vulnerability affects Firefox ESR 60.8, Firefox 68, and...

Amazon Linux 2 : kernel (ALAS-2020-1556)

The version of kernel installed on the remote host is prior to 4.14.203-156.332. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1556 advisory. In binderreleasework of binder.c, there is a possible use-after-free due to improper locking. This could lead to...

Amazon Linux 2 : nspr, nss-softokn, nss-util, nss (ALAS-2020-1559)

The version of nspr installed on the remote host is prior to 4.25.0-2. The version of nss installed on the remote host is prior to 3.53.1-3. The version of nss-softokn installed on the remote host is prior to 3.53.1-6. The version of nss- util installed on the remote host is prior to 3.53.1-1. It...

Amazon Linux 2 : libvirt (ALAS-2020-1557)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1557 advisory. A flaw was found in the way the libvirtd daemon issued the 'suspend' command to a QEMU guest-agent running inside a guest...

Amazon Linux 2 : samba (ALAS-2020-1544)

The version of samba installed on the remote host is prior to 4.10.16-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1544 advisory. All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with log...

Amazon Linux 2 : audiofile (ALAS-2020-1501)

The version of audiofile installed on the remote host is prior to 0.3.6-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1501 advisory. The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in...

Amazon Linux 2 : libtiff (ALAS-2020-1532)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1532 advisory. TIFFCheckMalloc and TIFFCheckRealloc in tifaux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they...

Amazon Linux 2 : ipa (ALAS-2020-1519)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1519 advisory. jQuery before 3.0.0 is vulnerable to Cross-site Scripting XSS attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed...

Amazon Linux 2 : exiv2 (ALAS-2020-1512)

The version of exiv2 installed on the remote host is prior to 0.27.0-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1512 advisory. An out of bounds read vulnerability was discovered in the way exiv2 parses Canon raw format CRW images. An application that uses exi...

Amazon Linux 2 : freerdp (ALAS-2020-1516)

The version of freerdp installed on the remote host is prior to 2.1.1-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1516 advisory. In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients...

Amazon Linux 2 : tigervnc (ALAS-2020-1552)

The version of tigervnc installed on the remote host is prior to 1.8.0-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1552 advisory. TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack...

Amazon Linux 2 : libmspack (ALAS-2020-1525)

The version of libmspack installed on the remote host is prior to 0.5-0.8.alpha. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1525 advisory. libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function...

Amazon Linux 2 : fontforge (ALAS-2020-1514)

The version of fontforge installed on the remote host is prior to 20120731b-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1514 advisory. An out-of-bounds write was discovered in fontforge while parsing SFD files containing very large LayerCount tokens. The flaw...

Amazon Linux 2 : ImageMagick (ALAS-2020-1497)

The version of ImageMagick installed on the remote host is prior to 6.9.10.68-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1497 advisory. ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c,...

Amazon Linux 2 : libcroco (ALAS-2020-1521)

The version of libcroco installed on the remote host is prior to 0.6.12-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1521 advisory. A stack overflow flaw was found in libcroco. A service using libcroco's CSS parser could be crashed by a local, authenticated...

Amazon Linux 2 : libxslt (ALAS-2020-1535)

The version of libxslt installed on the remote host is prior to 1.1.28-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1535 advisory. libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit...