Amazon Linux AMI : bind (ALAS-2020-1369)

The version of bind installed on the remote host is prior to 9.8.2-0.68.rc1.64. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1369 advisory. A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed wh...

Amazon Linux AMI : python-twisted-web (ALAS-2020-1372)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1372 advisory. In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set ...

Amazon Linux AMI : squid (ALAS-2020-1378)

The version of squid installed on the remote host is prior to 3.5.20-15.39. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1378 advisory. An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls...

Amazon Linux AMI : httpd24 (ALAS-2020-1370)

The version of httpd24 installed on the remote host is prior to 2.4.43-1.89. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1370 advisory. In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with modrewrite that were intended to be self-referential...

Amazon Linux AMI : php72 (ALAS-2020-1367)

The version of php72 installed on the remote host is prior to 7.2.30-1.22. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1367 advisory. In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while parsing EXIF data with exifreaddata...

Amazon Linux AMI : php73 (ALAS-2020-1368)

The version of php73 installed on the remote host is prior to 7.3.17-1.25. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1368 advisory. In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while parsing EXIF data with exifreaddata...

Amazon Linux AMI : dovecot (ALAS-2020-1363)

The version of dovecot installed on the remote host is prior to 2.2.36-6.19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1363 advisory. In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker...

Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2020-1365)

The version of java-1.7.0-openjdk installed on the remote host is prior to 1.7.0.261-2.6.22.1.83. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1365 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux AMI : kernel (ALAS-2020-1366)

The version of kernel installed on the remote host is prior to 4.14.177-107.254. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1366 advisory. A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem. This flaw occurs while importing...

Amazon Linux AMI : http-parser (ALAS-2020-1359)

The version of http-parser installed on the remote host is prior to 2.9.3-1.2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1359 advisory. A flaw was found in the Node.js code where a specially crafted HTTPs request sent to a Node.js server failed to...

Amazon Linux AMI : icu (ALAS-2020-1361)

The version of icu installed on the remote host is prior to 50.2-4.0. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1361 advisory. An issue was discovered in International Components for Unicode ICU for C/C++ through 66.1. An integer overflow, leading to a heap-base...

Amazon Linux AMI : kernel (ALAS-2020-1360)

The version of kernel installed on the remote host is prior to 4.14.173-106.229. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1360 advisory. 2023-11-29: CVE-2020-27418 was added to this advisory. A stack buffer overflow issue was found in the getrawsocket...

Amazon Linux AMI : runc (ALAS-2020-1358)

The version of runc installed on the remote host is prior to 1.0.0-0.1.20200204.gitdc9208a.1. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1358 advisory. runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to...

Amazon Linux AMI : libtirpc (ALAS-2020-1362)

The version of libtirpc installed on the remote host is prior to 0.2.4-0.16.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1362 advisory. A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefdxprt was n...

Amazon Linux AMI : git (ALAS-2020-1357)

The version of git installed on the remote host is prior to 2.14.6-1.62. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1357 advisory. With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a...

AMI MegaRAC SP-X BMC Vulnerabilities - Lenovo Support US

No description provided...

AMI MegaRAC SP-X BMC Vulnerabilities - Lenovo Support US

Lenovo Security Advisory: LEN-29592 Potential Impact: Denial of service, privilege escalation, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2013-4312, CVE-2013-7446, CVE-2014-3631, CVE-2014-5206, CVE-2014-5207, CVE-2014-6410, CVE-2014-7145, CVE-2014-782...

Amazon Linux AMI : nss, nss-softokn, nss-util, nspr (ALAS-2020-1355)

The version of nspr installed on the remote host is prior to 4.21.0-1.43. The version of nss installed on the remote host is prior to 3.44.0-7.84. The version of nss-softokn installed on the remote host is prior to 3.44.0-8.44. The version of nss-util installed on the remote host is prior to...

Amazon Linux AMI : freetype (ALAS-2020-1348)

The version of freetype installed on the remote host is prior to 2.3.11-19.15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1348 advisory. FreeType before 2.6.1 has a heap-based buffer over-read in T1GetPrivateDict in type1/t1parse.c. CVE-2015-9381 FreeTyp...

Amazon Linux AMI : php73 (ALAS-2020-1351)

The version of php73 installed on the remote host is prior to 7.3.15-1.24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1351 advisory. In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension,...