Amazon Linux 2 : kernel (ALAS-2022-1749)

The version of kernel installed on the remote host is prior to 4.14.262-200.489. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1749 advisory. A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was found in th...

Important: kernel

Issue Overview: An out-of-bounds write flaw was found in the Linux kernel's seqfile in the Filesystem layer. This flaw allows a local attacker with a user privilege to gain access to out-of-bound memory, leading to a system crash or a leak of internal kernel information. The issue results from no...

Important: kernel

Issue Overview: A logic bug flaw was found in the Linux kernel's implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced...

Important: kernel

Issue Overview: A flaw was found in the Linux kernel. When reusing a socket with an attached dccpshctxccid as a listener, the socket will be used after being released leading to denial of service DoS or a potential code execution. The highest threat from this vulnerability is to data...

Important: kernel

Issue Overview: An out-of-bounds write flaw was found in the Linux kernel's seqfile in the Filesystem layer. This flaw allows a local attacker with a user privilege to gain access to out-of-bound memory, leading to a system crash or a leak of internal kernel information. The issue results from no...

Medium: kernel

Issue Overview: A race problem was seen in the vtkioctl in drivers/tty/vt/vtioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vcmode is not protected by lock-in vtioctl KDSETMDE. The highest threat from this vulnerability is to data confidentiality...

Important: kernel

Issue Overview: A flaw was found in the Linux kernel. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2020-14386 Affected Packages: kerne...

Amazon Linux 2 : polkit (ALAS-2022-1745)

The version of polkit installed on the remote host is prior to 0.112-26. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1745 advisory. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed t...

Important: polkit

Issue Overview: A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling...

Important: xorg-x11-server

Issue Overview: A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the SProcRenderCompositeGlyphs function due to improper validation of the request length. CVE-2021-4008 A flaw was found in xorg-x11-server. An out-of-bounds access can occur in the...

Amazon Linux AMI : vim (ALAS-2022-1557)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1557 advisory. 2024-05-09: CVE-2020-20703 was added to this advisory. Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter. CVE-2020-20703...

Medium: python-pip

Issue Overview: A flaw was found in python-urllib3. SSL certificate validation is omitted in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates...

Amazon Linux AMI : cyrus-imapd (ALAS-2022-1559)

The version of cyrus-imapd installed on the remote host is prior to 2.4.22-1.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1559 advisory. A flaw was found in cyrus-imapd. A bad string hashing algorithm used in internal hash tables allows user inputs to be stored...

Amazon Linux AMI : log4j (ALAS-2022-1562)

The version of log4j installed on the remote host is prior to 1.2.17-16.12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1562 advisory. It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2022-1561)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.312.b07-0.65. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1561 advisory. Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component:...

Amazon Linux AMI : busybox (ALAS-2022-1558)

The version of busybox installed on the remote host is prior to 1.34.1-1.13. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1558 advisory. A flaw was found in BusyBox, where it did not properly sanitize while processing a crafted shell command, leading to a...

Amazon Linux AMI : httpd24 (ALAS-2022-1560)

The version of httpd24 installed on the remote host is prior to 2.4.52-1.95. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1560 advisory. There's a null pointer dereference and server-side request forgery flaw in httpd's modproxy module, when it is configur...

The vulnerability of the NSS cryptographic libraries in the Amazon Linux AMI operating system allows a hacker to execute arbitrary code.

The vulnerability of the NSS cryptographic libraries in the Amazon Linux AMI operating system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Important: log4j-cve-2021-44228-hotpatch

Issue Overview: The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-13 will now explicitly mimic the permissions of the JVM attempting to be updated. Affected Packages: log4j-cve-2021-44228-hotpatch Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Amazon Linux 2 : log4j-cve-2021-44228-hotpatch (ALAS-2021-1732)

The version of log4j-cve-2021-44228-hotpatch installed on the remote host is prior to 1.1-13. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1732 advisory. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-13 will now explicitly mimic...