Amazon Linux 2 : file (ALAS-2020-1452)

The version of file installed on the remote host is prior to 5.11-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1452 advisory. The docorenote function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service out-of-bounds rea...

Amazon Linux AMI : poppler (ALAS-2020-1398)

The version of poppler installed on the remote host is prior to 0.26.5-42.20. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1398 advisory. The tiffdocumentrender and tiffdocumentgetthumbnail functions in the TIFF document backend in GNOME Evince through...

Amazon Linux 2 : ntp (ALAS-2020-1455)

The version of ntp installed on the remote host is prior to 4.2.6p5-29. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1455 advisory. ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service daemon exit or...

Amazon Linux 2 : taglib (ALAS-2020-1460)

The version of taglib installed on the remote host is prior to 1.8-8.20130218git. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1460 advisory. The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause informatio...

Amazon Linux 2 : patch (ALAS-2020-1457)

The version of patch installed on the remote host is prior to 2.7.1-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1457 advisory. In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and...

Amazon Linux 2 : qt (ALAS-2020-1458)

The version of qt installed on the remote host is prior to 4.8.5-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1458 advisory. An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp...

Amazon Linux 2 : curl (ALAS-2020-1451)

The version of curl installed on the remote host is prior to 7.61.1-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1451 advisory. command line arguments lead to local file overwrite CVE-2020-8177 Tenable has extracted the preceding description block directly fro...

Amazon Linux AMI : librabbitmq (ALAS-2020-1394)

The version of librabbitmq installed on the remote host is prior to 0.1-0.2.hgfb6fca832fd2.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1394 advisory. An issue was discovered in amqphandleinput in amqpconnection.c in rabbitmq-c 0.9.0. There is an integer overflo...

Amazon Linux 2 : java-11-amazon-corretto, --advisory ALAS2-2020-1464 (ALAS-2020-1464)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.8+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1464 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Support...

Medium: curl

Issue Overview: command line arguments lead to local file overwrite CVE-2020-8177 Affected Packages: curl Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update...

Medium: lftp

Issue Overview: It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled...

Medium: patch

Issue Overview: In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c. CVE-2019-13636 Affected Packages: patch Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for t...

Medium: advancecomp

Issue Overview: In AdvanceCOMP 2.1, pngcompress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. There is also a heap-based buffer over-read. CVE-2019-9210 Affected Packages:...

Medium: net-snmp

Issue Overview: snmpoidcompare in snmplib/snmpapi.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. CVE-2018-18066 Affected Packages: net-snmp...

Medium: openssl11

Issue Overview: In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message tha...

Amazon Linux AMI : texlive (ALAS-2020-1388)

The version of texlive installed on the remote host is prior to 2012-45.20130427r30134. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1388 advisory. An issue was discovered in t1checkunusualcharstring functions in writet1.c files in TeX Live before 2018-09-21. A...

Amazon Linux 2 : bind (ALAS-2020-1441)

The version of bind installed on the remote host is prior to 9.11.4-9.P2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1441 advisory. managed-keys is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which...

Amazon Linux 2 : squid (ALAS-2020-1448)

The version of squid installed on the remote host is prior to 3.5.20-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1448 advisory. An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain...

Amazon Linux AMI : exim (ALAS-2020-1380)

The version of exim installed on the remote host is prior to 4.92-1.26. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1380 advisory. Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa...

Amazon Linux AMI : bash (ALAS-2020-1379)

The version of bash installed on the remote host is prior to 4.2.46-34.43. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1379 advisory. rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASHCMDS, thus allowing the user to execute any comma...