It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1633 advisory.

  - A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver     which can lead to a local privilege escalation. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2021-3472)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1630 advisory.

  - A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core     server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could     inject a specially crafted value that will be executed on the victim's browser. (CVE-2019-10146)

  - A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent     Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting     (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted     Javascript code. (CVE-2019-10179)

  - A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca     module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An     attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which     can execute arbitrary code when viewed in a browser. (CVE-2019-10221)

  - A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to     renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The     highest threat from this vulnerability is to data confidentiality and integrity. (CVE-2021-20179)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1626 advisory.

  - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing     elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods     (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
    (CVE-2020-11023)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1631 advisory.

  - An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it     allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the     security controls. This occurs for certain uri_whitespace configuration settings. (CVE-2020-25097)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.231-173.360. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1627 advisory.

  - A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel     before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-ab612b1daf41.
    (CVE-2019-19060)

  - kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on     pointer arithmetic in various cases, including cases of different branches with different state or limits     to sanitize, leading to side-channel attacks. (CVE-2019-7308)

  - An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error     (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to     side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory,     aka CID-10d2bb2e6b1d. (CVE-2020-27171)

  - rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6     allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases,     CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may     have situations in which a drivers/staging issue is relevant to their own customer base. (CVE-2021-28660)

  - The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use     uninitialized or stale values. This initialization went too far and may under certain conditions also     overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking     persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died,     leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable.
    XSA-365 was classified to affect versions back to at least 3.11. (CVE-2021-28688)

  - A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It     allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer     before a cloning operation, aka CID-dbcc7d57bffc. (CVE-2021-28964)

  - In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has     a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing     userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and     remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8. (CVE-2021-28972)

  - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements,     allowing them to execute arbitrary code within the kernel context. This affects     arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. (CVE-2021-29154)

  - An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in     drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up     sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70.
    (CVE-2021-29265)

  - An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows     attackers to obtain sensitive information from kernel memory because of a partially uninitialized data     structure, aka CID-50535249f624. (CVE-2021-29647)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nettle installed on the remote host is prior to 2.7.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1629 advisory.

  - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions     (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being     called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to     force an invalid signature, causing an assertion failure or possible validation. The highest threat to     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-20305)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libldb installed on the remote host is prior to 1.5.4-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1628 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 78.9.0-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1632 advisory.

  - A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer     used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash.
    This vulnerability affects Firefox ESR < 78.9, Thunderbird < 78.9, and Firefox < 87. (CVE-2021-23981)

  - Using techniques that built on the slipstream research, a malicious webpage could have scanned both an     internal network's hosts as well as services running on the user's local machine utilizing WebRTC     connections. This vulnerability affects Firefox ESR < 78.9, Thunderbird < 78.9, and Firefox < 87.
    (CVE-2021-23982)

  - A malicious extension could have opened a popup window lacking an address bar. The title of the popup     lacking an address bar should not be fully controllable, but in this situation was. This could have been     used to spoof a website and attempt to trick the user into providing credentials. This vulnerability     affects Firefox ESR < 78.9, Thunderbird < 78.9, and Firefox < 87. (CVE-2021-23984)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR     78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9,     Thunderbird < 78.9, and Firefox < 87. (CVE-2021-23987)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libldb installed on the remote host is prior to 1.5.4-2.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1494 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nvidia installed on the remote host is prior to 418.197.02-2018.03.117. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1495 advisory.

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer     (nvlddmkm.sys or nvidia.ko) where improper access control may lead to denial of service, information     disclosure, or data corruption. (CVE-2021-1076)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tomcat7 installed on the remote host is prior to 7.0.108-1.40. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1493 advisory.

  - When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to     7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the     server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is     configured with sessionAttributeValueClassNameFilter=null (the default unless a SecurityManager is used)     or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker     knows the relative file path from the storage location used by FileStore to the file the attacker has     control over; then, using a specifically crafted request, the attacker will be able to trigger remote code     execution via deserialization of the file under their control. Note that all of conditions a) to d) must     be true for the attack to succeed. (CVE-2020-9484)

  - Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types     of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the     thread. (CVE-2020-9494)

  - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to     9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be     used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published     prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to     this issue. (CVE-2021-25329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of screen installed on the remote host is prior to 4.0.3-19.7. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1492 advisory.

  - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write     access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character     sequence. (CVE-2021-26937)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1625 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the file forwarding     feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by     the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak     app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had     chosen to open a target file with their Flatpak app, which automatically makes that file available to the     Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit `Disallow @@ and @@U     usage in desktop files`. The follow-up commits `dir: Reserve the whole @@ prefix` and `dir: Refuse to     export .desktop files with suspicious uses of @@ tokens` are recommended, but not strictly required. As a     workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported     `.desktop` files in `exports/share/applications/*.desktop` (typically     `~/.local/share/flatpak/exports/share/applications/*.desktop` and     `/var/lib/flatpak/exports/share/applications/*.desktop`) to make sure that literal filenames do not follow     `@@` or `@@u`. (CVE-2021-21381)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1622 advisory.

  - An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a     client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was     present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL     pointer dereference will result, leading to a crash and a denial of service attack. A server is only     vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS     clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of     these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in     OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). (CVE-2021-3449)

  - The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a     certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow     certificates in the chain that have explicitly encoded elliptic curve parameters was added as an     additional strict check. An error in the implementation of this check meant that the result of a previous     check to confirm that certificates in the chain are valid CA certificates was overwritten. This     effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a     purpose has been configured then there is a subsequent opportunity for checks that the certificate is a     valid CA. All of the named purpose values implemented in libcrypto perform this check. Therefore, where     a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A     purpose is set by default in libssl client and server certificate verification routines, but it can be     overridden or removed by an application. In order to be affected, an application must explicitly set the     X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification     or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions     1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k.
    OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).
    (CVE-2021-3450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of screen installed on the remote host is prior to 4.1.0-0.27.20120314git3c2946. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1623 advisory.

  - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write     access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character     sequence. (CVE-2021-26937)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of wpa_supplicant installed on the remote host is prior to 2.6-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1624 advisory.

  - A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi     Direct) provision discovery requests. It could result in denial of service or other impact (potentially     execution of arbitrary code), for an attacker within radio range. (CVE-2021-27803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.23.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1621 advisory.

  - Git is an open-source distributed revision control system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may     cause just-checked out script to be executed while cloning onto a case-insensitive file system such as     NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters     have to be configured for that. Git for Windows configures Git LFS by default, and is therefore     vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a     workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks     false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are     configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning     repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are:
    2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5,     2.17.62.17.6. (CVE-2021-21300)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tomcat8 installed on the remote host is prior to 8.5.63-1.87. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1491 advisory.

  - When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to     7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the     server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is     configured with sessionAttributeValueClassNameFilter=null (the default unless a SecurityManager is used)     or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker     knows the relative file path from the storage location used by FileStore to the file the attacker has     control over; then, using a specifically crafted request, the attacker will be able to trigger remote code     execution via deserialization of the file under their control. Note that all of conditions a) to d) must     be true for the attack to succeed. (CVE-2020-9484)

  - When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to     9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one     request to another meaning user A and user B could both see the results of user A's request.
    (CVE-2021-25122)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of git installed on the remote host is prior to 2.18.5-2.73. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1490 advisory.

  - Git is an open-source distributed revision control system. In affected versions of Git a specially crafted     repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may     cause just-checked out script to be executed while cloning onto a case-insensitive file system such as     NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters     have to be configured for that. Git for Windows configures Git LFS by default, and is therefore     vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a     workaound, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks     false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are     configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning     repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are:
    2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5,     2.17.62.17.6. (CVE-2021-21300)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of php72 installed on the remote host is prior to 7.2.33-1.25. The version of php73 installed on the remote host is prior to 7.3.21-1.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1425 advisory.

  - In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files     using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to     a crash or information disclosure. (CVE-2020-7068)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.225-121.357. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1487 advisory.

  - An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to     the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be     encountered. In one case, an error encountered earlier might be discarded by later processing, resulting     in the caller assuming successful mapping, and hence subsequent operations trying to access space that     wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery     from the error. This affects drivers/block/xen-blkback/blkback.c. (CVE-2021-26930)

  - An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI     backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially     being at least under the influence of guests (such as out of memory conditions), it isn't correct to     assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running     in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c.
    (CVE-2021-26931)

  - An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations     often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success     or failure of each one is reported to the backend driver, and the backend driver then loops over the     results, performing follow-up actions based on the success or failure of each operation. Unfortunately,     when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively     implying their success from the success of related batch elements. In other cases, errors resulting from     one batch element lead to further batch elements not being inspected, and hence successful ones to not be     possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are     vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and     drivers/xen/gntdev.c. (CVE-2021-26932)

  - An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI     subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the     pointer to an iscsi_transport struct in the kernel module's global variables. (CVE-2021-27363)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

  - An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the     netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of     changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior     of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931.
    (CVE-2021-28038)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of qemu-kvm installed on the remote host is prior to 1.5.3-156.26. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1488 advisory.

  - rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two     addresses, which allows attackers to trigger an invalid memory copy operation. (CVE-2020-13765)

  - In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects     the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the     QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in     hw/net/net_tx_pkt.c. (CVE-2020-16092)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cloud-init installed on the remote host is prior to 0.7.6-43.23. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1486 advisory.

  - cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for     attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
    (CVE-2020-8631)

  - In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default     pwlen value, which makes it easier for attackers to guess passwords. (CVE-2020-8632)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of bind installed on the remote host is prior to 9.8.2-0.68.rc1.86. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1485 advisory.

  - BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG     features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed,     but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or     tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-     TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server     environments that combine BIND servers with Active Directory domain controllers. The most likely outcome     of a successful exploitation of the vulnerability is a crash of the named process. However, remote code     execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11,     and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition.
    Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch (CVE-2020-8625)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of xterm installed on the remote host is prior to 295-3.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1489 advisory.

  - xterm through Patch #365 allows remote attackers to cause a denial of service (segmentation fault) or     possibly have unspecified other impact via a crafted UTF-8 character sequence. (CVE-2021-27135)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.225-168.357. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1616 advisory.

  - An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to     the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be     encountered. In one case, an error encountered earlier might be discarded by later processing, resulting     in the caller assuming successful mapping, and hence subsequent operations trying to access space that     wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery     from the error. This affects drivers/block/xen-blkback/blkback.c. (CVE-2021-26930)

  - An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI     backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially     being at least under the influence of guests (such as out of memory conditions), it isn't correct to     assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running     in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c.
    (CVE-2021-26931)

  - An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations     often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success     or failure of each one is reported to the backend driver, and the backend driver then loops over the     results, performing follow-up actions based on the success or failure of each operation. Unfortunately,     when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively     implying their success from the success of related batch elements. In other cases, errors resulting from     one batch element lead to further batch elements not being inspected, and hence successful ones to not be     possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are     vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and     drivers/xen/gntdev.c. (CVE-2021-26932)

  - An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine     the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI     subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the     pointer to an iscsi_transport struct in the kernel module's global variables. (CVE-2021-27363)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

  - An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the     netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of     changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior     of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931.
    (CVE-2021-28038)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1614 advisory.

  - BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG     features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed,     but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or     tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-     TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server     environments that combine BIND servers with Active Directory domain controllers. The most likely outcome     of a successful exploitation of the vulnerability is a crash of the named process. However, remote code     execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11,     and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition.
    Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch (CVE-2020-8625)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of glibc installed on the remote host is prior to 2.26-42. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1615 advisory.

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2021-3326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of xterm installed on the remote host is prior to 295-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1619 advisory.

  - xterm through Patch #365 allows remote attackers to cause a denial of service (segmentation fault) or     possibly have unspecified other impact via a crafted UTF-8 character sequence. (CVE-2021-27135)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1612 advisory.

  - Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument     in some cases where the input length is close to the maximum permissable length for an integer on the     platform. In such cases the return value from the function call will be 1 (indicating success), but the     output length value will be negative. This could cause applications to behave incorrectly or crash.
    OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to     OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out     of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should     upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i).
    Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). (CVE-2021-23840)

  - The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based     on the issuer and serial number data contained within an X509 certificate. However it fails to correctly     handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is     maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a     potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by     OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on     certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are     affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x     and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving     public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should     upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected     1.0.2-1.0.2x). (CVE-2021-23841)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1617 advisory.

  - rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two     addresses, which allows attackers to trigger an invalid memory copy operation. (CVE-2020-13765)

  - In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects     the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the     QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in     hw/net/net_tx_pkt.c. (CVE-2020-16092)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 78.8.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1618 advisory.

  - If Content Security Policy blocked frame navigation, the full destination of a redirect served in the     frame was reported in the violation report; as opposed to the original frame URI. This could be used to     leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird <     78.8, and Firefox ESR < 78.8. (CVE-2021-23968)

  - As specified in the W3C Content Security Policy draft, when creating a violation report, User agents need     to ensure that the source file is the URL requested by the page, pre-redirects. If thats not possible,     user agents need to strip the URL down to an origin to avoid unintentional leakage. Under certain types     of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was     fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird <     78.8, and Firefox ESR < 78.8. (CVE-2021-23969)

  - When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted,     and the content of that error may have revealed information about the resource. This vulnerability affects     Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. (CVE-2021-23973)

  - Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and     Firefox ESR < 78.8. (CVE-2021-23978)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cloud-init installed on the remote host is prior to 19.3-43. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1620 advisory.

  - A vulnerability was discovered in cloud-init which can improperly disclose randomly generated passwords as     part of the chpasswd module. The fix prevents the generated password from being written to a world-     readable log file on the local disk. (CVE-2021-3429)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ansible installed on the remote host is prior to 2.9.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1613 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of p11-kit installed on the remote host is prior to 0.23.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1601 advisory.

  - An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered     in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are     missing before calling realloc or calloc. (CVE-2020-29361)

  - An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been     discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the     remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may     allow the reading of up to 4 bytes of memory past the heap allocation. (CVE-2020-29362)

  - An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been     discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the     remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate     sufficient length for the buffer to store the deserialized value. (CVE-2020-29363)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python27 installed on the remote host is prior to 2.7.18-2.141. The version of python36 installed on the remote host is prior to 3.6.12-1.20. The version of python38 installed on the remote host is prior to 3.8.5-1.5. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1484 advisory.

  - Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to     remote code execution in certain Python applications that accept floating-point numbers as untrusted     input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used     unsafely. (CVE-2021-3177)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of openssl installed on the remote host is prior to 1.0.2k-16.153. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1482 advisory.

  - Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument     in some cases where the input length is close to the maximum permissable length for an integer on the     platform. In such cases the return value from the function call will be 1 (indicating success), but the     output length value will be negative. This could cause applications to behave incorrectly or crash.
    OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to     OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out     of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should     upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i).
    Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). (CVE-2021-23840)

  - The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based     on the issuer and serial number data contained within an X509 certificate. However it fails to correctly     handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is     maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a     potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by     OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on     certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are     affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x     and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving     public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should     upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected     1.0.2-1.0.2x). (CVE-2021-23841)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of subversion installed on the remote host is prior to 1.9.7-1.61. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1483 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.15.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1609 advisory.

  - In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs,     related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
    (CVE-2021-3114)

  - Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code     execution when using the go get command to fetch modules that make use of cgo (for example, cgo can     execute a gcc program from an untrusted download). (CVE-2021-3115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 78.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1603 advisory.

  - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. (CVE-2020-26976)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1598 advisory.

  - Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by     remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to     inject code. (CVE-2018-17183)

  - Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors     involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183.
    (CVE-2018-17961)

  - Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of     system operators in the saved execution stack in an error object. (CVE-2018-18073)

  - Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors     involving the 1Policy operator. (CVE-2018-18284)

  - In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A     specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute     arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of     failure to check whether the Implementation of a pattern dictionary was a structure type. (CVE-2018-19134)

  - An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if     another device is used. (CVE-2018-19409)

  - psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access     restrictions because available stack space is not checked when the device remains the same.
    (CVE-2018-19475)

  - psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access     restrictions because of a setcolorspace type confusion. (CVE-2018-19476)

  - psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access     restrictions because of a JBIG2Decode type confusion. (CVE-2018-19477)

  - A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands. (CVE-2019-14811)

  - A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands. (CVE-2019-14812)

  - A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did     not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially     crafted PostScript file could disable security protection and then have access to the file system, or     execute arbitrary commands. (CVE-2019-14813)

  - A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where     it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A     specially crafted PostScript file could disable security protection and then have access to the file     system, or execute arbitrary commands. (CVE-2019-14817)

  - A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it     did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An     attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate     privileges within the Ghostscript and access files outside of restricted areas or execute commands.
    (CVE-2019-14869)

  - It was found that the superexec operator was available in the internal dictionary in ghostscript before     9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the     file system outside of the constrains imposed by -dSAFER. (CVE-2019-3835)

  - It was found that the forceput operator could be extracted from the DefineResource method in ghostscript     before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access     to the file system outside of the constrains imposed by -dSAFER. (CVE-2019-3838)

  - It was found that in ghostscript some privileged operators remained accessible from various places after     the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example,     have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before     9.27 are vulnerable. (CVE-2019-3839)

  - In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system     operators, leading to remote code execution. (CVE-2019-6116)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of unzip installed on the remote host is prior to 6.0-43. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1604 advisory.

  - Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2     data in a ZIP archive. (CVE-2015-7697)

  - Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to     cause a denial of service (crash) via a large compression method value in the central directory file     header. (CVE-2016-9844)

  - A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-     protected archives that allows an attacker to perform a denial of service or to possibly achieve code     execution. (CVE-2018-1000035)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.219-161.340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1600 advisory.

  - A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was     a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a     denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege     to a kernel information leak threat. (CVE-2020-27825)

  - In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking     in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal     in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker     has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are     proxied via an attacker-selected backstore. (CVE-2020-28374)

  - ** DISPUTED ** fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a     subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via     READDIRPLUS. NOTE: some parties argue that such a subdirectory export is not intended to prevent this     attack; see also the exports(5) no_subtree_check default behavior. (CVE-2021-3178)

  - An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free     during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.
    (CVE-2021-3347)

  - nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-     free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a     certain point during device setup, aka CID-b98e762e3d71. (CVE-2021-3348)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cloud-init installed on the remote host is prior to 19.3-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1595 advisory.

  - A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some     Linux images that use cloud-init, aka 'Azure SSH Keypairs Security Feature Bypass Vulnerability'.
    (CVE-2019-0816)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ImageMagick installed on the remote host is prior to 6.9.10.68-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1596 advisory.

  - ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows     setting a password for password-protected PDF files. The user-controlled password was not properly     escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.
    (CVE-2020-29599)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of openssl installed on the remote host is prior to 1.0.2k-19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1608 advisory.

  - OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to     support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack     when unpadding an RSA signature. Clients that support SSL or TLS versions greater than SSLv2 are supposed     to use a special form of padding. A server that supports greater than SSLv2 is supposed to reject     connection attempts from a client where this special form of padding is present, because this indicates     that a version rollback has occurred (i.e. both client and server support greater than SSLv2, and yet this     is the version that is being requested). The implementation of this padding check inverted the logic so     that the connection attempt is accepted if the padding is present, and rejected if it is absent. This     means that such as server will accept a connection if a version rollback attack has occurred. Further the     server will erroneously reject a connection if a normal SSLv2 connection attempt is made. Only OpenSSL     1.0.2 servers from version 1.0.2s to 1.0.2x are affected by this issue. In order to be vulnerable a 1.0.2     server must: 1) have configured SSLv2 support at compile time (this is off by default), 2) have configured     SSLv2 support at runtime (this is off by default), 3) have configured SSLv2 ciphersuites (these are not in     the default ciphersuite list) OpenSSL 1.1.1 does not have SSLv2 support and therefore is not vulnerable to     this issue. The underlying error is in the implementation of the RSA_padding_check_SSLv23() function. This     also affects the RSA_SSLV23_PADDING padding mode used by various other functions. Although 1.1.1 does not     support SSLv2 the RSA_padding_check_SSLv23() function still exists, as does the RSA_SSLV23_PADDING padding     mode. Applications that directly call that function or use that padding mode will encounter this issue.
    However since there is no support for the SSLv2 protocol in 1.1.1 this is considered a bug and not a     security issue in that version. OpenSSL 1.0.2 is out of support and no longer receiving public updates.
    Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j.
    Fixed in OpenSSL 1.0.2y (Affected 1.0.2s-1.0.2x). (CVE-2021-23839)

  - Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument     in some cases where the input length is close to the maximum permissable length for an integer on the     platform. In such cases the return value from the function call will be 1 (indicating success), but the     output length value will be negative. This could cause applications to behave incorrectly or crash.
    OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to     OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out     of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should     upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i).
    Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). (CVE-2021-23840)

  - The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based     on the issuer and serial number data contained within an X509 certificate. However it fails to correctly     handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is     maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a     potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by     OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on     certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are     affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x     and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving     public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should     upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected     1.0.2-1.0.2x). (CVE-2021-23841)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of glibc installed on the remote host is prior to 2.26-41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1605 advisory.

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2020-29562)

  - An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc     2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative     value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the     'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-     of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows     for program execution to continue in scenarios where a segmentation fault or crash should have occurred.
    The dangers occur in that subsequent execution and iterations of this code will be executed with this     corrupted data. (CVE-2020-6096)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of php-pear installed on the remote host is prior to 1.10.12-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1602 advisory.

  - Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate     checking of symbolic links, a related issue to CVE-2020-28948. (CVE-2020-36193)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of glibc installed on the remote host is prior to 2.26-40. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1599 advisory.

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1597 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug     was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary     code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and     before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by     its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their     own subprocesses in a new sandbox instance, either with the same security settings as the caller or with     more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as     Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a     more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service     passes caller-specified environment variables to non-sandboxed processes on the host system, and in     particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or     compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and     use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be     mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many     Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0. (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
149305	Amazon Linux 2 : xorg-x11-server (ALAS-2021-1633)	medium
148922	Amazon Linux 2 : pki-core (ALAS-2021-1630)	medium
148921	Amazon Linux 2 : ipa (ALAS-2021-1626)	medium
148920	Amazon Linux 2 : squid (ALAS-2021-1631)	medium
148919	Amazon Linux 2 : kernel (ALAS-2021-1627)	high
148915	Amazon Linux 2 : nettle (ALAS-2021-1629)	medium
148914	Amazon Linux 2 : libldb (ALAS-2021-1628)	medium
148913	Amazon Linux 2 : thunderbird (ALAS-2021-1632)	medium
148899	Amazon Linux AMI : libldb (ALAS-2021-1494)	medium
148898	Amazon Linux AMI : nvidia (ALAS-2021-1495)	medium
148378	Amazon Linux AMI : tomcat7 (ALAS-2021-1493)	medium
148377	Amazon Linux AMI : screen (ALAS-2021-1492)	high
148337	Amazon Linux 2 : flatpak (ALAS-2021-1625)	medium
148196	Amazon Linux 2 : openssl11 (ALAS-2021-1622)	medium
148195	Amazon Linux 2 : screen (ALAS-2021-1623)	high
148194	Amazon Linux 2 : wpa_supplicant (ALAS-2021-1624)	medium
148193	Amazon Linux 2 : git (ALAS-2021-1621)	medium
148132	Amazon Linux AMI : tomcat8 (ALAS-2021-1491)	medium
148131	Amazon Linux AMI : git (ALAS-2021-1490)	medium
148126	Amazon Linux AMI : php72, php73 (ALAS-2020-1425)	low
147919	Amazon Linux AMI : kernel (ALAS-2021-1487)	medium
147918	Amazon Linux AMI : qemu-kvm (ALAS-2021-1488)	medium
147917	Amazon Linux AMI : cloud-init (ALAS-2021-1486)	low
147916	Amazon Linux AMI : bind (ALAS-2021-1485)	medium
147915	Amazon Linux AMI : xterm (ALAS-2021-1489)	high
147914	Amazon Linux 2 : kernel (ALAS-2021-1616)	medium
147913	Amazon Linux 2 : bind (ALAS-2021-1614)	medium
147912	Amazon Linux 2 : glibc (ALAS-2021-1615)	medium
147911	Amazon Linux 2 : xterm (ALAS-2021-1619)	high
147910	Amazon Linux 2 : openssl11 (ALAS-2021-1612)	medium
147909	Amazon Linux 2 : qemu (ALAS-2021-1617)	medium
147908	Amazon Linux 2 : thunderbird (ALAS-2021-1618)	medium
147907	Amazon Linux 2 : cloud-init (ALAS-2021-1620)	low
147906	Amazon Linux 2 : ansible (ALAS-2021-1613)	medium
147715	Amazon Linux 2 : p11-kit (ALAS-2021-1601)	medium
146819	Amazon Linux AMI : python27, python36, python38 (ALAS-2021-1484)	high
146818	Amazon Linux AMI : openssl (ALAS-2021-1482)	medium
146814	Amazon Linux AMI : subversion (ALAS-2021-1483)	medium
146635	Amazon Linux 2 : golang (ALAS-2021-1609)	medium
146634	Amazon Linux 2 : thunderbird (ALAS-2021-1603)	medium
146633	Amazon Linux 2 : ghostscript (ALAS-2021-1598)	high
146632	Amazon Linux 2 : unzip (ALAS-2021-1604)	medium
146631	Amazon Linux 2 : kernel (ALAS-2021-1600)	high
146630	Amazon Linux 2 : cloud-init (ALAS-2021-1595)	low
146629	Amazon Linux 2 : ImageMagick (ALAS-2021-1596)	medium
146628	Amazon Linux 2 : openssl (ALAS-2021-1608)	medium
146627	Amazon Linux 2 : glibc (ALAS-2021-1605)	medium
146626	Amazon Linux 2 : php-pear (ALAS-2021-1602)	medium
146625	Amazon Linux 2 : glibc (ALAS-2021-1599)	high
146624	Amazon Linux 2 : flatpak (ALAS-2021-1597)	high

Amazon Linux Local Security Checks Family for Nessus

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

high

medium

medium

high

medium

medium

medium

medium

low

medium

medium

low

medium

high

medium

medium

medium

high

medium

medium

medium

low

medium

medium

high

medium

medium

medium

medium

high

medium

high

low

medium

medium

medium

medium

high

high