Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2021-1515)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.292.b10-1.63. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1515 advisory. Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Amazon Linux AMI : dhcp (ALAS-2021-1510)

The version of dhcp installed on the remote host is prior to 4.1.1-53.P1.29. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1510 advisory. A flaw was found in the Dynamic Host Configuration Protocol DHCP. There is a discrepancy between the code that handles...

Amazon Linux AMI : libX11 (ALAS-2021-1517)

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.14. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1517 advisory. A missing validation flaw was found in libX11. This flaw allows an attacker to inject X11 protocol commands on X clients, and in...

Amazon Linux AMI : curl (ALAS-2021-1509)

The version of curl installed on the remote host is prior to 7.61.1-12.98. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1509 advisory. It was discovered that libcurl did not remove authentication credentials from URLs when automatically populating the...

Amazon Linux AMI : bind (ALAS-2021-1508)

The version of bind installed on the remote host is prior to 9.8.2-0.68.rc1.87. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1508 advisory. A flaw was found in bind. The way DNAME records are processed may trigger the same RRset to the ANSWER section to be added mo...

Important: kernel-livepatch-4.14.225-169.362

Issue Overview: A use-after-free flaw was found in hcisendacl in the bluetooth host controller interface HCI in Linux kernel, where a local attacker with an access rights could cause a denial of service problem on the system The issue results from the object hchan, freed in...

Medium: transfig

Issue Overview: An Out of Bounds flaw was found in fig2dev utility within transfig. An attacker could use this flaw and provide a crafted input to readobjects probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as...

Important: mod_http2

Issue Overview: A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this flaw to crash the httpd child process, causing temporary denial of service. CVE-2021-31618 Affected Packages: modhttp2 Note: This advisory is applicabl...

Amazon Linux 2 : libwebp (ALAS-2021-1676)

The version of libwebp installed on the remote host is prior to 0.3.0-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1676 advisory. A flaw was found in libwebp. A heap-based buffer overflow was found in PutLE16. The highest threat from this vulnerabilit...

Amazon Linux 2 : libxml2 (ALAS-2021-1677)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1677 advisory. There's a flaw in libxml2's xmllint. An attacker who is able to submit a crafted file to be processed by xmllint could...

Amazon Linux 2 : qt5-qtimageformats (ALAS-2021-1679)

The version of qt5-qtimageformats installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1679 advisory. A flaw was found in libwebp. A heap-based buffer overflow was found in PutLE16. The highest threat from this...

Amazon Linux 2 : unbound (ALAS-2021-1683)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1683 advisory. 2024-01-19: CVE-2019-25033 was added to this advisory. A flaw was found in unbound. An integer overflow in regionalalloc...

Amazon Linux 2 : transfig (ALAS-2021-1682)

The version of transfig installed on the remote host is prior to 3.2.8a-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1682 advisory. An Out of Bounds flaw was found in fig2dev utility within transfig. An attacker could use this flaw and provide a crafted input t...

Amazon Linux 2 : thunderbird (ALAS-2021-1681)

The version of thunderbird installed on the remote host is prior to 78.11.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1681 advisory. OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypte...

Amazon Linux 2 : kernel (ALAS-2021-1675)

The version of kernel installed on the remote host is prior to 4.14.232-177.418. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1675 advisory. A flaw was found in kernel/bpf/verifier.c in BPF in the Linux kernel. An incorrect limit is enforced for pointer arithmetic...

Amazon Linux 2 : gupnp (ALAS-2021-1673)

The version of gupnp installed on the remote host is prior to 1.0.2-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1673 advisory. A flaw was found in gupnp. DNS rebinding can occur when a victim's browser is used by a remote web server to trigger actions against...

Amazon Linux 2 : samba (ALAS-2021-1680)

The version of samba installed on the remote host is prior to 4.10.16-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1680 advisory. A flaw was found in samba. The Samba smbd file server must map Windows group identities SIDs into unix group ids gids. The code th...

Important: httpd

Issue Overview: A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this flaw to crash the httpd child process, causing temporary denial of service. CVE-2021-31618 Affected Packages: httpd Note: This advisory is applicable t...

Amazon Linux 2 : httpd (ALAS-2021-1659)

The version of httpd installed on the remote host is prior to 2.4.48-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1659 advisory. A flaw was found in Apache httpd. The modproxywstunnel module tunnels non-upgraded connections. CVE-2019-17567 Apache HTTP...

Amazon Linux 2 : httpd (ALAS-2021-1672)

The version of httpd installed on the remote host is prior to 2.4.46-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1672 advisory. A null pointer de-reference was found in the way httpd handled specially crafted HTTP/2 request. A remote attacker could use this fl...