Low: golang

Issue Overview: No CVE associated with this advisory Affected Packages: golang Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update golang or yum update...

Important: thunderbird

Issue Overview: The plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 68.3, Firefox ESR 68.3...

Amazon Linux 2 : nss-softokn (ALAS-2020-1379)

The version of nss-softokn installed on the remote host is prior to 3.44.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1379 advisory. Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized befor...

Amazon Linux 2 : oniguruma (ALAS-2020-1380)

The version of oniguruma installed on the remote host is prior to 5.9.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1380 advisory. Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. CVE-2019-16163 Oniguruma...

Medium: oniguruma

Issue Overview: Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. CVE-2019-16163 Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in strlowercasematch in regexec.c.CVE-2019-19246 Affected Packages:...

Amazon Linux 2 : udisks2 (ALAS-2019-1377)

UDisks 2.8.0 has a format string vulnerability in udiskslog in udiskslogging.c, allowing attackers to obtain sensitive information stack contents, cause a denial of service memory corruption, or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n...

Amazon Linux 2 : libidn2 (ALAS-2019-1373)

heap-based buffer overflow in idn2toascii4i in lib/lookup.c idn2toascii4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.CVE-2019-18224 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fro...

Amazon Linux 2 : SDL (ALAS-2019-1375)

A heap-based buffer overflow flaw, in SDL while copying an existing surface into a new optimized one, due to a lack of validation while loading a BMP image, is possible. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw, which could allow an attacker to ma...

Amazon Linux 2 : java-1.7.0-openjdk (ALAS-2019-1372)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: JAXP. Supported versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

Amazon Linux 2 : file (ALAS-2019-1370)

cdfreadpropertyinfo in cdf.c in file through 5.37 does not restrict the number of CDFVECTOR elements, which allows a heap-based buffer overflow 4-byte out-of-bounds write.CVE-2019-18218 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Amazon Linux 2 : git (ALAS-2019-1371)

Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning CVE-2019-1351 NTFS protections inactive when running Git in the Windows Subsystem for Linux CVE-2019-1353 remote code execution in recursive clones with nested submodules CVE-2019-1387 Arbitrary path...

Amazon Linux 2 : openslp (ALAS-2019-1378)

A heap-based buffer overflow was discovered in OpenSLP in the way the slpd service processes URLs in service request messages. A remote unauthenticated attacker could register a service with a specially crafted URL that, when used during a service request message, would trigger the flaw and cause...

Amazon Linux 2 : libsolv (ALAS-2019-1374)

There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any real-world...

Medium: file

Issue Overview: cdfreadpropertyinfo in cdf.c in file through 5.37 does not restrict the number of CDFVECTOR elements, which allows a heap-based buffer overflow 4-byte out-of-bounds write.CVE-2019-18218 Affected Packages: file Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository...

Medium: libidn2

Issue Overview: heap-based buffer overflow in idn2toascii4i in lib/lookup.c idn2toascii4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.CVE-2019-18224 Affected Packages: libidn2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Low: libsolv

Issue Overview: There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any...

Amazon Linux 2 : freerdp (ALAS-2019-1365)

FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvcmain.c, drdynvcprocesscapabilityrequest that can result in The RDP server can read the client's memory.. This attack appear to...

Amazon Linux 2 : python / python3 (ALAS-2019-1368)

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To header...

Amazon Linux 2 : ntp (ALAS-2019-1367)

The ntpq and ntpdc command-line utilities that are part of ntp package are vulnerable to stack-based buffer overflow via crafted hostname. Applications using these vulnerable utilities with an untrusted input may be potentially exploited, resulting in a crash or arbitrary code execution under...

Amazon Linux 2 : rsyslog (ALAS-2019-1369)

A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash.CVE-2018-16881 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...