Amazon Linux 2 : php-pear (ALAS-2021-1602)

The version of php-pear installed on the remote host is prior to 1.10.12-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1602 advisory. Tar.php in ArchiveTar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic...

Amazon Linux 2 : openssl (ALAS-2021-1608)

The version of openssl installed on the remote host is prior to 1.0.2k-19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1608 advisory. OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both...

Amazon Linux 2 : python, python3 (ALAS-2021-1611)

The version of python installed on the remote host is prior to 2.7.18-1. The version of python3 installed on the remote host is prior to 3.7.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1611 advisory. A flaw was found in python. A stack-based buffer overflow...

Amazon Linux 2 : kernel (ALAS-2021-1600)

The version of kernel installed on the remote host is prior to 4.14.219-161.340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1600 advisory. 2024-05-23: CVE-2023-1390 was added to this advisory. A use-after-free flaw was found in kernel/trace/ringbuffer.c...

Amazon Linux 2 : ghostscript (ALAS-2021-1598)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1598 advisory. Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers...

Amazon Linux 2 : thunderbird (ALAS-2021-1603)

The version of thunderbird installed on the remote host is prior to 78.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1603 advisory. The Mozilla Foundation Security Advisory describes these flaws as: During the plaintext phase of the STARTTLS...

Amazon Linux 2 : glibc (ALAS-2021-1599)

The version of glibc installed on the remote host is prior to 2.26-40. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1599 advisory. A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequence could cause glibc to read beyond t...

Amazon Linux 2 : ImageMagick (ALAS-2021-1596)

The version of ImageMagick installed on the remote host is prior to 6.9.10.68-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1596 advisory. A flaw was found in ImageMagick. The -authenticate option is mishandled allowing user-controlled password set for a PDF fil...

Amazon Linux 2 : cloud-init (ALAS-2021-1595)

The version of cloud-init installed on the remote host is prior to 19.3-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1595 advisory. A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use...

Amazon Linux 2 : perl (ALAS-2021-1610)

The version of perl installed on the remote host is prior to 5.16.3-299. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1610 advisory. Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers...

Amazon Linux 2 : golang (ALAS-2021-1609)

The version of golang installed on the remote host is prior to 1.15.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1609 advisory. In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an...

Amazon Linux AMI : ImageMagick (ALAS-2021-1479)

The version of ImageMagick installed on the remote host is prior to 6.9.10.68-3.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1479 advisory. A flaw was found in ImageMagick. The -authenticate option is mishandled allowing user-controlled password set for a PDF...

Amazon Linux AMI : php7-pear (ALAS-2021-1481)

The version of php7-pear installed on the remote host is prior to 1.10.12-5.32. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1481 advisory. Tar.php in ArchiveTar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic...

Amazon Linux AMI : kernel (ALAS-2021-1480)

The version of kernel installed on the remote host is prior to 4.14.219-119.340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1480 advisory. 2024-05-23: CVE-2023-1390 was added to this advisory. A use-after-free flaw was found in kernel/trace/ringbuffer.c ...

Important: kernel-livepatch-4.14.209-160.339

Issue Overview: A flaw was found in the Linux kernel's implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to...

Important: kernel-livepatch-4.14.209-160.335

Issue Overview: A flaw was found in the Linux kernel's implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to...

Amazon Linux 2 : dnsmasq (ALAS-2021-1587)

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1587 advisory. A flaw was found in dnsmasq. When getting a reply from a forwarded query, dnsmasq checks in the forward.c:replyquery if th...

Amazon Linux 2 : targetcli (ALAS-2021-1591)

The version of targetcli installed on the remote host is prior to 2.1.53-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1591 advisory. An access flaw was found in targetcli, where the /etc/target and underneath backup directory/files were world-readable. This fla...

Amazon Linux 2 : kernel (ALAS-2021-1588)

The version of kernel installed on the remote host is prior to 4.14.214-160.339. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1588 advisory. In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making...

Critical: thunderbird

Issue Overview: A malicious peer could have modified a COOKIE-ECHO chunk in a SCTP packet in a way that potentially resulted in a use-after-free. We presume that with enough effort it could have been exploited to run arbitrary code. CVE-2020-16044 Affected Packages: thunderbird Note: This advisor...