Amazon Linux 2 : qt5-qtimageformats (ALAS-2021-1679)

The version of qt5-qtimageformats installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1679 advisory. A flaw was found in libwebp. A heap-based buffer overflow was found in PutLE16. The highest threat from this...

Amazon Linux 2 : unbound (ALAS-2021-1683)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1683 advisory. 2024-01-19: CVE-2019-25033 was added to this advisory. A flaw was found in unbound. An integer overflow in regionalalloc...

Amazon Linux 2 : thunderbird (ALAS-2021-1681)

The version of thunderbird installed on the remote host is prior to 78.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1681 advisory. OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypte...

Amazon Linux 2 : systemd, --advisory ALAS2-2021-1647 (ALAS-2021-1647)

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1647 advisory. It was discovered that systemd is vulnerable to a state injection attack when deserializing the state of a service...

Amazon Linux 2 : httpd (ALAS-2021-1672)

The version of httpd installed on the remote host is prior to 2.4.46-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1672 advisory. A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this fl...

Important: httpd

Issue Overview: A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this flaw to crash the httpd child process, causing temporary denial of service. CVE-2021-31618 Affected Packages: httpd Note: This advisory is applicable t...

Amazon Linux 2 : httpd (ALAS-2021-1659)

The version of httpd installed on the remote host is prior to 2.4.48-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1659 advisory. A flaw was found in Apache httpd. The modproxywstunnel module tunnels non-upgraded connections. CVE-2019-17567 Apache HTTP...

Medium: bind

Issue Overview: Incremental zone transfers IXFR provide a way of transferring changed portions of a zone between servers. An IXFR stream containing SOA records with an owner name other than the transferred zone's apex may cause the receiving named server to inadvertently remove the SOA record for...

Medium: glibc

Issue Overview: In the GNU C Library aka glibc or libc6 through 2.29, proceednextnode in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. CVE-2019-9169 A flaw was found in glibc. If an attacker provides the iconv function with invalid...

Important: postgresql

Issue Overview: A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function. CVE-2019-10208 A flaw was found in postgresq...

Amazon Linux 2 : microcode_ctl (ALAS-2021-1663)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1663 advisory. A flaw was found in the Intel Advanced Vector Extensions AVX implementation, where a local authenticated attacker with the...

Amazon Linux 2 : bind (ALAS-2021-1651)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1651 advisory. Incremental zone transfers IXFR provide a way of transferring changed portions of a zone between servers. An IXFR stream containi...

Amazon Linux 2 : bzip2 (ALAS-2021-1652)

The version of bzip2 installed on the remote host is prior to 1.0.6-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1652 advisory. BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. CVE-2019-12900 Tenabl...

Amazon Linux 2 : dhcp (ALAS-2021-1654)

The version of dhcp installed on the remote host is prior to 4.2.5-77. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1654 advisory. A flaw was found in the Dynamic Host Configuration Protocol DHCP. There is a discrepancy between the code that handles encapsulated...

Amazon Linux 2 : python-urllib3 (ALAS-2021-1668)

The version of python-urllib3 installed on the remote host is prior to 1.25.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1668 advisory. A flaw was found in python-urllib3. The HTTPConnection.request does not properly validate CRLF sequences in the HTTP reques...

Amazon Linux 2 : glib2 (ALAS-2021-1655)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1655 advisory. An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function gbytesnew has an integer overflow on 64-b...

Amazon Linux 2 : postgresql (ALAS-2021-1665)

The version of postgresql installed on the remote host is prior to 9.2.24-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1665 advisory. A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER...

Medium: python-pip

Issue Overview: A flaw was found in python-urllib3. SSL certificate validation is omitted in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates...

Medium: wpa_supplicant

Issue Overview: In p2pcopyclientinfo of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no additional execution privileges needed. User interaction is not needed f...

Medium: libxml2

Issue Overview: GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e. CVE-2020-24977 There is a flaw in the xml entity encoding functionality of libxml2. An attacker who is able to...