Amazon Linux AMI : bash (ALAS-2014-418) (Shellshock)

This ALAS is superceded by ALAS-2014-419. A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote...

Amazon Linux AMI : nss (ALAS-2014-385)

Use-after-free vulnerability in the CERTDestroyCertificate function in libnss3.so in Mozilla Network Security Services NSS 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger...

Amazon Linux AMI : perl-FCGI (ALAS-2011-5)

The FCGI aka Fast CGI module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers. C Tenable Network Security, Inc. The descriptive...

Amazon Linux AMI : php55 (ALAS-2014-415)

A denial of service flaw was found in the way the File Information fileinfo extension parsed certain Composite Document Format CDF files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file. gdctx.c in the GD component in PHP 5.4.x befo...

Amazon Linux AMI : gnupg2 (ALAS-2014-379)

The douncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service infinite loop via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence. C Tenable Network Security, Inc. The...

Amazon Linux AMI : squid (ALAS-2014-411)

A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. CVE-2014-3609 A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to...

Amazon Linux AMI : chkrootkit (ALAS-2014-370)

A quoting issue was found in chkrootkit which would lead to a file in /tmp/ being executed, if /tmp/ was mounted without the noexec option. chkrootkit is typically run as the root user. A local attacker could use this flaw to escalate their privileges. C Tenable Network Security, Inc. The...

Asterisk 'ast_parse_digest()' Stack Buffer Overflow Vulnerability

No description provided by source. =========================== Description =========================== There is a remotely exploitable stack buffer overflow in HTTP digest authentication handling in Asterisk. This vulnerability includes the possibility of code execution with plenty of stack space...

Amazon Linux AMI : file (ALAS-2014-323)

The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service CPU consumption via a crafted ASCII file that triggers a large amount of...

Amazon Linux AMI : xalan-j2 (ALAS-2014-325)

It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features. A remote attacker able to provide Extensible Stylesheet Language Transformations XSLT content to be processed by an application using Xalan-Java could use this...

Amazon Linux AMI : curl (ALAS-2014-322)

The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses 1 SCP, 2 SFTP, 3 POP3, 4 POP3S, 5 IMAP, 6 IMAPS, 7 SMTP, 8 SMTPS, 9 LDAP, and 10 LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015 . ...

Amazon Linux AMI : perl-YAML-LibYAML (ALAS-2014-324)

The yamlparserscantaguri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow...

Amazon Linux AMI : openssl Information Disclosure Vulnerability (ALAS-2014-320)

A missing bounds check was found in the way OpenSSL handled TLS heartbeat extension packets. This flaw could be used to reveal up to 64k of memory from a connected client or server. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon...

Amazon Linux AMI : httpd24 (ALAS-2014-309)

The logcookie function in modlogconfig.c in the modlogconfig module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service segmentation fault and daemon crash via a crafted cookie that is not properly handled during truncation. C Tenable Network Security, Inc...

Amazon Linux AMI : php54 (ALAS-2014-313)

A denial of service flaw was found in the way the File Information fileinfo extension handled indirect rules. A remote attacker could use this flaw to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU. C Tenable Network Security, Inc. The descriptive text and...

Amazon Linux AMI : kernel Privilege Escalation (ALAS-2013-190)

A flaw was found in the way index into perfsweventenabled array was sanitized. A local, unprivileged user could leverage this flaw to gain elevated privileges on the system. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon Linux AM...

Amazon Linux AMI : postgresql9 (ALAS-2014-306)

Multiple stack-based buffer overflow flaws were found in the date/time implementation of PostgreSQL. An authenticated database user could provide a specially crafted date/time value that, when processed, could cause PostgreSQL to crash or, potentially, execute arbitrary code with the permissions ...

Amazon Linux AMI : postgresql8 (ALAS-2014-305)

Multiple stack-based buffer overflow flaws were found in the date/time implementation of PostgreSQL. An authenticated database user could provide a specially crafted date/time value that, when processed, could cause PostgreSQL to crash or, potentially, execute arbitrary code with the permissions ...

Amazon Linux AMI : libtiff (ALAS-2014-307)

A heap-based buffer overflow and a use-after-free flaw were found in the tiff2pdf tool. An attacker could use these flaws to create a specially crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute arbitrary code. CVE-2013-1960 , CVE-2013-4232 Multiple buffer overflow flaws...

Amazon Linux AMI : file (ALAS-2014-304)

Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service infinite recursion, CPU consumption, and crash via a crafted indirect offset value in the magic of a file. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...