Amazon Linux 2 : cloud-init (ALAS-2021-1576)

The version of cloud-init installed on the remote host is prior to 19.3-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1576 advisory. The default cloud-init configuration included sshdeletekeys: 0, disabling cloud-init's deletion of ssh host keys. In som...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2021-1579)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.272.b10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1579 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux 2 : thunderbird (ALAS-2021-1586)

The version of thunderbird installed on the remote host is prior to 78.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1586 advisory. When drawing a transparent image on top of an unknown cross-origin image, the Skia library drawImage function took a...

Amazon Linux 2 : php-pear (ALAS-2021-1584)

The version of php-pear installed on the remote host is prior to 1.10.12-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1584 advisory. ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

Amazon Linux AMI : vim-common (ALAS-2020-1468) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1468 advisory. - In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scriptin...

Amazon Linux AMI : tigervnc (ALAS-2020-1470) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1470 advisory. - TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usa...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2020-1461) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1461 advisory. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization. Supporte...

Amazon Linux AMI : xorg-x11-server-Xdmx (ALAS-2020-1469) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1469 advisory. - A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames...

Amazon Linux AMI : e2fsprogs (ALAS-2020-1459) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1459 advisory. - An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A...

Amazon Linux AMI : ruby20 (ALAS-2020-1467) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1467 advisory. - An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP...

Amazon Linux AMI : bind (ALAS-2020-1457) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1457 advisory. - In BIND 9.0.0 - 9.11.21, 9.12.0 - 9.16.5, 9.17.0 - 9.17.3, also affects 9.9.3-S1 - 9.11.21-S1 of the BIND 9 Supporte...

Amazon Linux AMI : libxslt (ALAS-2020-1464) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1464 advisory. - libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and...

Amazon Linux AMI : mysql56 (ALAS-2020-1465) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1465 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported...

Amazon Linux AMI : kernel (ALAS-2020-1462) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1462 advisory. - DISPUTED In the Linux kernel 4.19.83, there is a use-after-free read in the debugfsremove function in...

Medium: kernel-livepatch-4.14.193-149.317

Issue Overview: A flaw was found in the Linux kernel. A local attacker, able to inject conntrack netlink configuration, could overflow a local buffer causing crashes or triggering the use of incorrect protocol numbers in ctnetlinkparsetuplefilter in net/netfilter/nfconntracknetlink.c. The highest...

Amazon Linux AMI : tomcat7 (ALAS-2020-1472) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1472 advisory. - In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approa...

Amazon Linux AMI : libX11 (ALAS-2020-1463) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1463 advisory. - An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged...

Amazon Linux AMI : tomcat8 (ALAS-2020-1473) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1473 advisory. - While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and...

Amazon Linux AMI : qemu-img (ALAS-2020-1466) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1466 advisory. - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ipreass in ipinput.c. CVE-2019-15890 Note that Nessus...

Amazon Linux AMI : golang (ALAS-2020-1471) (deprecated)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1471 advisory. - Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. CVE-2020-28362 - Go before 1.14.12 and...