Amazon Linux AMI : bind (ALAS-2021-1457)

The version of bind installed on the remote host is prior to 9.8.2-0.68.rc1.85. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1457 advisory. A flaw was found in bind. An assertion failure can occur when trying to verify a truncated response to a TSIG-signed request...

Amazon Linux AMI : libX11 (ALAS-2021-1462)

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1462 advisory. An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to...

Amazon Linux AMI : mysql56 (ALAS-2021-1464)

The version of mysql56 installed on the remote host is prior to 5.6.50-1.38. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1464 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported versions that...

Amazon Linux AMI : kernel (ALAS-2021-1461)

The version of kernel installed on the remote host is prior to 4.14.209-117.337. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1461 advisory. A use-after-free flaw was found in the debugfsremove function in the Linux kernel. The flaw could allow a local...

Amazon Linux AMI : postgresql95, postgresql96 (ALAS-2021-1476)

The version of postgresql95 installed on the remote host is prior to 9.5.24-1.82. The version of postgresql96 installed on the remote host is prior to 9.6.20-1.84. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1476 advisory. A flaw was found in postgresql. ...

Amazon Linux AMI : tomcat8 (ALAS-2021-1473)

The version of tomcat8 installed on the remote host is prior to 8.5.60-1.86. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1473 advisory. While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.5...

Amazon Linux AMI : ruby20 (ALAS-2021-1468)

The version of ruby20 installed on the remote host is prior to 2.0.0.648-2.39. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1468 advisory. An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server...

Amazon Linux AMI : expat (ALAS-2021-1459)

The version of expat installed on the remote host is prior to 2.1.0-12.24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1459 advisory. It was discovered that the setElementTypePrefix function incorrectly extracted XML namespace prefixes. By tricking an...

Amazon Linux AMI : libxslt (ALAS-2021-1463)

The version of libxslt installed on the remote host is prior to 1.1.28-6.15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1463 advisory. libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite perm...

Amazon Linux AMI : qemu-kvm (ALAS-2021-1467)

The version of qemu-kvm installed on the remote host is prior to 1.5.3-156.25. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1467 advisory. A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. The issue occurs in ipreass...

Amazon Linux AMI : e2fsprogs (ALAS-2021-1458)

The version of e2fsprogs installed on the remote host is prior to 1.43.5-2.44. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1458 advisory. An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially...

Amazon Linux AMI : xorg-x11-server (ALAS-2021-1475)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1475 advisory. A flaw was found in X.Org Server. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data...

Amazon Linux AMI : samba (ALAS-2021-1469)

The version of samba installed on the remote host is prior to 4.10.16-9.56. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1469 advisory. A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to...

Amazon Linux AMI : tomcat7 (ALAS-2021-1472)

The version of tomcat7 installed on the remote host is prior to 7.0.107-1.39. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1472 advisory. A flaw was found in Apache Tomcat. The HTTP header parsing code used an approach to end-of-line EOL parsing that allowed some...

Amazon Linux 2 : gd (ALAS-2021-1577)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1577 advisory. An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2 function of PHP's gd extension. A...

Amazon Linux 2 : chrony (ALAS-2021-1575)

The version of chrony installed on the remote host is prior to 3.5.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1575 advisory. A flaw was found in chrony when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup...

Important: libuv

Issue Overview: Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on t...

Medium: gd

Issue Overview: An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2 function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application,...

Amazon Linux 2 : php-pear (ALAS-2021-1584)

The version of php-pear installed on the remote host is prior to 1.10.12-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1584 advisory. ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

Amazon Linux 2 : libuv (ALAS-2021-1581)

The version of libuv installed on the remote host is prior to 1.39.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1581 advisory. Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting...