Important: python-pillow

Issue Overview: A flaw was discovered in the way the python-pillow may allocate a large amount of memory or require a long time while processing specially crafted image files, possibly causing a denial of service. Applications that use the library to process untrusted files may be vulnerable to...

Amazon Linux AMI : git (ALAS-2020-1357)

The version of git installed on the remote host is prior to 2.14.6-1.62. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1357 advisory. With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2020-1410)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.7+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1410 advisory. Further information about this update can be found in the Corretto 11 change log...

Amazon Linux 2 : git (ALAS-2020-1409)

The version of git installed on the remote host is prior to 2.23.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1409 advisory. With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a...

Important: git

Issue Overview: With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a wrong host. The attack has been made impossible by forbidding a newline character in any value passed via the credential protocol. CVE-2020-5260...

Important: java-11-amazon-corretto

Issue Overview: Further information about this update can be found in the Corretto 11 change log https://github.com/corretto/corretto-11/blob/develop/CHANGELOG.md Affected Packages: java-11-amazon-corretto Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

Amazon Linux 2 : qemu (ALAS-2020-1407)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1407 advisory. tcpemu in tcpsubr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMUIR...

Amazon Linux 2 : thunderbird (ALAS-2020-1408)

The version of thunderbird installed on the remote host is prior to 68.5.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1408 advisory. When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents...

Amazon Linux 2 : kernel (ALAS-2020-1405)

The version of kernel installed on the remote host is prior to 4.14.173-137.228. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1405 advisory. 2023-11-29: CVE-2020-27418 was added to this advisory. A stack buffer overflow issue was found in the getrawsocket...

Important: openssl

Issue Overview: Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters instead of using a named curve. In those cases it is possible that such a grou...

Important: qemu

Issue Overview: tcpemu in tcpsubr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMUIRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code. CVE-2020-7039 An...

Important: kernel

Issue Overview: A stack buffer overflow issue was found in the getrawsocket routine of the Host kernel accelerator for virtio net vhost-net driver. It could occur while doing an ictolVHOSTNETSETBACKEND call, and retrieving socket name in a kernel stack variable via getrawsocket. A user able to...

Amazon Linux 2 : sudo (ALAS-2020-1404)

The version of sudo installed on the remote host is prior to 1.8.23-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1404 advisory. In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged su...

Amazon Linux 2 : java-1.7.0-openjdk (ALAS-2020-1403)

The version of java-1.7.0-openjdk installed on the remote host is prior to 1.7.0.251-2.6.21.0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1403 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux AMI : sudo (ALAS-2020-1356)

The version of sudo installed on the remote host is prior to 1.8.6p3-29.30. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1356 advisory. In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privilege...

Amazon Linux AMI : nss, nss-softokn, nss-util, nspr (ALAS-2020-1355)

The version of nspr installed on the remote host is prior to 4.21.0-1.43. The version of nss installed on the remote host is prior to 3.44.0-7.84. The version of nss-softokn installed on the remote host is prior to 3.44.0-8.44. The version of nss-util installed on the remote host is prior to...

Amazon Linux AMI : php73 (ALAS-2020-1351)

The version of php73 installed on the remote host is prior to 7.3.15-1.24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1351 advisory. In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension,...

Amazon Linux AMI : freetype (ALAS-2020-1348)

The version of freetype installed on the remote host is prior to 2.3.11-19.15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1348 advisory. FreeType before 2.6.1 has a heap-based buffer over-read in T1GetPrivateDict in type1/t1parse.c. CVE-2015-9381 FreeTyp...

Amazon Linux AMI : kernel (ALAS-2020-1349)

The version of kernel installed on the remote host is prior to 4.14.171-105.231. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1349 advisory. In the Linux kernel before 5.1, there is a memory leak in featregistersp in net/dccp/feat.c, which may cause denial...

Amazon Linux AMI : php72 (ALAS-2020-1350)

The version of php72 installed on the remote host is prior to 7.2.28-1.21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1350 advisory. In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension,...