Important: ca-certificates

Issue Overview: Update of ca-certificates to version 2021.2.50-72.amzn2.0.1 addresses the expiring IdentTrust DST Root CA X3, which affected some Let's Encrypt TLS certificates. The effect of the expiring certificate would be an inability of OpenSSL to validate impacted certificates issued by Let...

Amazon Linux 2 : kernel (ALAS-2021-1699)

The version of kernel installed on the remote host is prior to 4.14.243-185.433. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1699 advisory. A flaw was found in the Linux kernel's KVM implementation, where improper handing of the VMIO|VMPFNMAP VMAs in KVM bypasses...

Important: kernel-livepatch-4.14.232-177.418

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.232-177.418 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.232-177.418 or yum update --advisory ALAS2LIVEPATCH-2021-060 to update your system. New...

Important: kernel-livepatch-4.14.243-185.433

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.243-185.433 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.243-185.433 or yum update --advisory ALAS2LIVEPATCH-2021-062 to update your system. New...

Important: kernel-livepatch-4.14.241-184.433

Issue Overview: No CVE associated with this advisory Affected Packages: kernel-livepatch-4.14.241-184.433 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-4.14.241-184.433 or yum update --advisory ALAS2LIVEPATCH-2021-063 to update your system. New...

Amazon Linux 2 : openldap (ALAS-2021-1707)

The version of openldap installed on the remote host is prior to 2.4.44-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1707 advisory. A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resultin...

Amazon Linux 2 : php-pear (ALAS-2021-1708)

The version of php-pear installed on the remote host is prior to 1.10.12-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1708 advisory. In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than...

Amazon Linux 2 : gcc10-binutils (ALAS-2021-1702)

The version of gcc10-binutils installed on the remote host is prior to 2.35-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1702 advisory. 2024-01-19: CVE-2021-20284 was added to this advisory. An issue was discovered in the Binary File Descriptor BFD...

Amazon Linux 2 : glibc (ALAS-2021-1703)

The version of glibc installed on the remote host is prior to 2.26-53. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1703 advisory. An integer overflow flaw was found in glibc that may result in reading of arbitrary memory when wordexp is used with a specially...

Amazon Linux 2 : ntp (ALAS-2021-1706)

The version of ntp installed on the remote host is prior to 4.2.8p15-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1706 advisory. The monlist feature in ntprequest.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service traffic...

Amazon Linux 2 : exiv2 (ALAS-2021-1701)

The version of exiv2 installed on the remote host is prior to 0.27.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1701 advisory. A flaw was found in exiv2. A flawed bounds checking in the jp2Image.cpp:doWriteMetadata function leads to a heap-based buffer...

Amazon Linux 2 : kernel (ALAS-2021-1704)

The version of kernel installed on the remote host is prior to 4.14.246-187.474. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1704 advisory. A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing t...

Amazon Linux 2 : thunderbird (ALAS-2021-1709)

The version of thunderbird installed on the remote host is prior to 78.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1709 advisory. If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses...

Medium: php-pear

Issue Overview: In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193. CVE-2021-32610 Affected Packages: php-pear Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section fo...

Important: exiv2

Issue Overview: A flaw was found in exiv2. A flawed bounds checking in the jp2Image.cpp:doWriteMetadata function leads to a heap-based buffer overflow. This flaw allows an attacker who can provide a malicious image to an application using the exiv2 library, to write data out of bounds and...

Medium: glibc

Issue Overview: An integer overflow flaw was found in glibc that may result in reading of arbitrary memory when wordexp is used with a specially crafted untrusted regular expression input. CVE-2021-35942 Affected Packages: glibc Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Medium: openldap

Issue Overview: A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service. CVE-2020-36225 Affected Packages: openldap Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FA...

Amazon Linux AMI : glib2 (ALAS-2021-1526)

The version of glib2 installed on the remote host is prior to 2.36.3-5.22. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1526 advisory. An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function gbytesnew has an integer overflow on...

Amazon Linux AMI : libwebp (ALAS-2021-1530)

The version of libwebp installed on the remote host is prior to 0.3.0-10.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1530 advisory. A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due ...

Amazon Linux AMI : lasso (ALAS-2021-1529)

The version of lasso installed on the remote host is prior to 2.5.1-8.6. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1529 advisory. An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to...