Amazon Linux 2 : mailman (ALAS-2020-1536)

The version of mailman installed on the remote host is prior to 2.1.15-30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1536 advisory. A cross-site scripting vulnerability XSS has been discovered in mailman due to the hostname field not being properly...

Amazon Linux 2 : libguestfs-winsupport (ALAS-2020-1522)

The version of libguestfs-winsupport installed on the remote host is prior to 7.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1522 advisory. An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running...

Medium: OpenEXR

Issue Overview: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp. CVE-2020-11761 An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and...

Amazon Linux 2 : e2fsprogs (ALAS-2020-1509)

The version of e2fsprogs installed on the remote host is prior to 1.42.9-19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1509 advisory. An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially...

Amazon Linux 2 : cpio (ALAS-2020-1505)

The version of cpio installed on the remote host is prior to 2.11-28. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1505 advisory. It was discovered cpio does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives...

Low: mod_auth_openidc

Issue Overview: An open redirect flaw was discovered in modauthopenidc, where it handles logout redirection. The module does not correctly validate the URL, allowing a URL with leading slashes to bypass the protection checks. A victim user may be tricked into visiting a trusted vulnerable web sit...

Important: squid

Issue Overview: A flaw was found in squid. Due to incorrect data validation, a HTTP Request Smuggling attack against HTTP and HTTPS traffic is possible leading to cache poisoning. The highest threat from this vulnerability is to data confidentiality and integrity. CVE-2020-15810 A flaw was found ...

Medium: e2fsprogs

Issue Overview: An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability...

Medium: expat

Issue Overview: It was discovered that the "setElementTypePrefix" function incorrectly extracted XML namespace prefixes. By tricking an application into processing a specially crafted XML file, an attacker could cause unusually high consumption of memory resources and possibly lead to a denial of...

Amazon Linux AMI : libxml2 (ALAS-2020-1438)

The version of libxml2 installed on the remote host is prior to 2.9.1-6.4.41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1438 advisory. xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc-oldNs...

Medium: audiofile

Issue Overview: The audiofile Audio File Library 0.3.6 has a NULL pointer dereference bug in ModuleState::setup in modules/ModuleState.cpp, which allows an attacker to cause a denial of service via a crafted caf file, as demonstrated by sfconvert. CVE-2018-13440 An issue has been discovered in...

Amazon Linux 2 : golang (ALAS-2020-1494)

The version of golang installed on the remote host is prior to 1.13.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1494 advisory. The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder...

Amazon Linux 2 : kernel (ALAS-2020-1495)

The version of kernel installed on the remote host is prior to 4.14.198-152.320. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1495 advisory. In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and...

Amazon Linux 2 : thunderbird (ALAS-2020-1496)

The version of thunderbird installed on the remote host is prior to 68.12.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1496 advisory. By holding a reference to the eval function from an about:blank window, a malicious webpage could have gained access...

Amazon Linux 2 : mod_http2 (ALAS-2020-1493)

The version of modhttp2 installed on the remote host is prior to 1.15.14-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1493 advisory. Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 reque...

Amazon Linux 2 : dovecot (ALAS-2020-1489)

The version of dovecot installed on the remote host is prior to 2.2.36-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1489 advisory. In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zer...

Amazon Linux 2 : lua53 (ALAS-2020-1492)

The version of lua53 installed on the remote host is prior to 5.3.5-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1492 advisory. ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal3,2^31...

Low: lua53

Issue Overview: ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal3,2^31. CVE-2020-24370 Affected Packages: lua53 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Amazon Linux AMI : clamav (ALAS-2020-1433)

The version of clamav installed on the remote host is prior to 0.102.4-1.44. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1433 advisory. Fixed a vulnerability in the ARJ archive-parsing module in ClamAV 0.102.3 that could cause a denial-of- service DoS...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2020-1434)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.265.b01-0.54. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1434 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries...