Amazon Linux AMI : openssl (ALAS-2011-04)

The MITRE CVE database describes CVE-2011-3207 as : crypto/x509/x509vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past. C Tenable...

Amazon Linux AMI : krb5 (ALAS-2013-182)

A NULL pointer dereference flaw was found in the way the MIT Kerberos KDC processed certain TGS Ticket-granting Server requests. A remote, authenticated attacker could use this flaw to crash the KDC via a specially crafted TGS request. CVE-2013-1416 C Tenable Network Security, Inc. The descriptiv...

Amazon Linux AMI : httpd (ALAS-2013-174)

Multiple cross-site scripting XSS vulnerabilities in the balancerhandler function in the manager interface in modproxybalancer.c in the modproxybalancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML vi...

Amazon Linux AMI : cacti (ALAS-2011-23)

The release notes for Cacti 0.8.7h indicate that two security vulnerabilities were fixed, though no corresponding CVE has been issued. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon Linux AMI Security Advisory ALAS-2011-23...

Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2012-119)

It was discovered that the Beans component in OpenJDK did not perform permission checks properly. An untrusted Java application or applet could use this flaw to use classes from restricted packages, allowing it to bypass Java sandbox restrictions. CVE-2012-1682 A hardening fix was applied to the...

Amazon Linux AMI : mysql51 (ALAS-2012-145)

A stack-based buffer overflow flaw was found in the user permission checking code in MySQL. An authenticated database user could use this flaw to crash the mysqld daemon or, potentially, execute arbitrary code with the privileges of the user running the mysqld daemon. CVE-2012-5611 C Tenable...

Amazon Linux AMI : openssl (ALAS-2012-85)

An integer underflow flaw, leading to a buffer over-read, was found in the way OpenSSL handled DTLS Datagram Transport Layer Security application data record lengths when using a block cipher in CBC cipher-block chaining mode. A malicious DTLS client or server could use this flaw to crash its DTL...

Amazon Linux AMI : kernel (ALAS-2012-118)

The rdsrecvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a 1 recvfrom or 2 recvmsg system call on an RDS socket. C Tenable Network...

Amazon Linux AMI : perl (ALAS-2013-177)

A heap overflow flaw was found in Perl. If a Perl application allowed user input to control the count argument of the string repeat operator, an attacker could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application...

Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2012-43)

It was discovered that Java2D did not properly check graphics rendering objects before passing them to the native renderer. Malicious input, or an untrusted Java application or applet could use this flaw to crash the Java Virtual Machine JVM, or bypass Java sandbox restrictions. CVE-2012-0497 It...

Amazon Linux AMI : ruby (ALAS-2012-139)

Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the nameerrmesgtostr API function, which marks the string as tainted, a different vulnerability than...

Amazon Linux AMI : kernel (ALAS-2012-78)

The rioioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call. C Tenable Network Security, Inc. The descriptive text and package check...

Amazon Linux AMI : socat (ALAS-2013-202)

socat 1.2.0.0 before 1.7.2.2 and 2.0.0-b1 before 2.0.0-b6, when used for a listen type address and the fork option is enabled, allows remote attackers to cause a denial of service file descriptor consumption via multiple request that are refused based on the 1 sourceport, 2 lowport, 3 range, or 4...

Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2012-136) (ROBOT)

Multiple improper permission check issues were discovered in the Beans, Swing, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. CVE-2012-5086 , CVE-2012-5084 , CVE-2012-5089 Multiple improper permission check issues...

AMI Firmware Source Code, Private Key Leaked

Source code and a private signing key for firmware manufactured by a popular PC hardware maker American Megatrends Inc. AMI have been found on an open FTP server hosted in Taiwan. Researcher Brandan Wilson found the company’s data hosted on an unnamed vendor’s FTP server. Among the vendor’s...

Low: Red Hat Security Advisory: Red Hat Enterprise MRG Grid 2.3 security update

Updated Grid component packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.3 for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability...

Low: Red Hat Security Advisory: Red Hat Enterprise MRG Grid 2.3 security update

Updated Grid component packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise MRG 2.3 for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability...

RHEL 6 : jboss-ec2-eap (RHSA-2012:1376)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2012:1376 advisory. jboss-ec2-eap provides JBoss Operations Network JBoss ON scripts for JBoss Enterprise Application Platform running on the Amazon Web Services AWS...

Low: Red Hat Security Advisory: jboss-ec2-eap security update

An updated jboss-ec2-eap package that fixes one security issue is now available for JBoss Enterprise Application Platform 5.1.2 for Red Hat Enterprise Linux 6 running on the Amazon Web Services AWS Elastic Compute Cloud EC2. The Red Hat Security Response Team has rated this update as having low...

Design/Logic Flaw

Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows...