Medium: openssl

Issue Overview: It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application into calling openssl function with a specially crafted, non-NUL terminated string to deliberately hit this bug, which may result in a crash of the applicatio...

Amazon Linux 2 : hivex (ALAS-2021-1717)

The version of hivex installed on the remote host is prior to 1.3.10-6.12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1717 advisory. A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry hive file, whic...

Amazon Linux AMI : httpd24 (ALAS-2021-1543)

The version of httpd24 installed on the remote host is prior to 2.4.51-1.94. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1543 advisory. A NULL pointer dereference was found in Apache httpd modh2. The highest threat from this flaw is to system integrity...

Amazon Linux 2 : httpd (ALAS-2021-1716)

The version of httpd installed on the remote host is prior to 2.4.51-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1716 advisory. A NULL pointer dereference was found in Apache httpd modh2. The highest threat from this flaw is to system integrity...

Important: libsndfile

Issue Overview: A heap buffer overflow flaw was found in libsndfile. This flaw allows an attacker to execute arbitrary code via a crafted WAV file. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. CVE-2021-3246 Affected Packages:...

Medium: glib2

Issue Overview: An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If gbytearraynewtake was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 232, causing unintended length truncation. CVE-2021-27218 Affected Packages: glib2...

Amazon Linux 2 : openssl11 (ALAS-2021-1714)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1714 advisory. It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application int...

Amazon Linux 2 : libsndfile (ALAS-2021-1713)

The version of libsndfile installed on the remote host is prior to 1.0.25-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1713 advisory. A heap buffer overflow flaw was found in libsndfile. This flaw allows an attacker to execute arbitrary code via a crafted WAV...

Amazon Linux 2 : kernel (ALAS-2021-1712)

The version of kernel installed on the remote host is prior to 4.14.248-189.473. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1712 advisory. A flaw was found in the Linux kernel. A race condition was discovered in the ext4 subsystem. The highest threat from this...

Amazon Linux 2 : sssd (ALAS-2021-1715)

The version of sssd installed on the remote host is prior to 1.16.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1715 advisory. A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and cache-expire...

Medium: openssl11

Issue Overview: It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application into calling openssl function with a specially crafted, non-NUL terminated string to deliberately hit this bug, which may result in a crash of the applicatio...

Amazon Linux 2 : glib2 (ALAS-2021-1711)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1711 advisory. An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If gbytearraynewtake was called with a buffer of 4GB o...

Amazon Linux 2 : ca-certificates (ALAS-2021-1710)

The version of ca-certificates installed on the remote host is prior to 2021.2.50-72. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1710 advisory. Update of ca-certificates to version 2021.2.50-72.amzn2.0.1 addresses the expiring IdentTrust DST Root CA X3, which...

Amazon Linux AMI : ca-certificates (ALAS-2021-1536)

The version of ca-certificates installed on the remote host is prior to 2018.2.22-65.1.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1536 advisory. Update of ca-certificates to version 2018.2.22-65.1.24.amzn1 addresses the expiring IdentTrust DST Root CA X3, whi...

Amazon Linux AMI : sssd (ALAS-2021-1542)

The version of sssd installed on the remote host is prior to 1.16.4-21.26. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1542 advisory. A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and cache-expire...

Amazon Linux AMI : openssl (ALAS-2021-1541)

The version of openssl installed on the remote host is prior to 1.0.2k-16.154. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1541 advisory. It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application in...

Amazon Linux AMI : golang (ALAS-2021-1538)

The version of golang installed on the remote host is prior to 1.15.15-1.71. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1538 advisory. A race condition flaw was found in Go. The incoming requests body weren't closed after the handler panic and as a consequence th...

Amazon Linux AMI : containerd (ALAS-2021-1540)

The version of containerd installed on the remote host is prior to 1.4.6-3.9. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1540 advisory. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions,...

Amazon Linux AMI : kernel (ALAS-2021-1539)

The version of kernel installed on the remote host is prior to 4.14.248-129.473. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1539 advisory. A flaw was found in the Linux kernel. When reusing a socket with an attached dccpshctxccid as a listener, the socke...

Amazon Linux AMI : docker (ALAS-2021-1537)

The version of docker installed on the remote host is prior to 20.10.7-3.71. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1537 advisory. A bug was found in Moby Docker Engine where attempting to copy files using docker cp into a specially- crafted containe...