Alibaba Security Advisories · October 2019 — Alibaba Security Advisories
67 advisories 225 CVEs 1 EXPLOITED

Alibaba Cloud Linux 2 advisories and cross-source Alibaba/Aliyun CVEs for 2019-10. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 1 is already weaponised in the wild — see the Exploited section.

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

Advisories

ALINUX2-SA-2019:0101

ALINUX 2ExploitedVulnCheck KEV listedHIGH2019-10-22

ALINUX2-SA-2019:0101: linux-firmware security, bug fix, and enhancement update (Important)

CVEs:CVE-2018-5383

Affected products

ProductStatusVendorPackageEcosystem
linux-firmware affected Alibaba Cloud linux-firmware —
Upstream advisory

ALINUX2-SA-2019:0085

ALINUX 2Weaponized exploitMEDIUM2019-10-10

ALINUX2-SA-2019:0085: openssh security, bug fix, and enhancement update (Low)

CVEs:CVE-2018-15473

Affected products

ProductStatusVendorPackageEcosystem
openssh affected Alibaba Cloud openssh —
Upstream advisory

ALINUX2-SA-2019:0074

ALINUX 2Weaponized exploitHIGH2019-10-09

ALINUX2-SA-2019:0074: libreoffice security and bug fix update (Low)

CVEs:CVE-2018-16858

Affected products

ProductStatusVendorPackageEcosystem
libreoffice affected Alibaba Cloud libreoffice —
Upstream advisory

ALINUX2-SA-2019:0117

ALINUX 2Weaponized exploitHIGH2019-10-28

ALINUX2-SA-2019:0117: ntp security, bug fix, and enhancement update (Low)

CVEs:CVE-2018-12327

Affected products

ProductStatusVendorPackageEcosystem
ntp affected Alibaba Cloud ntp —
Upstream advisory

ALINUX2-SA-2019:0089

ALINUX 2Weaponized exploitMEDIUM2019-10-10

ALINUX2-SA-2019:0089: procps-ng security and bug fix update (Moderate)

CVEs:CVE-2018-1122

Affected products

ProductStatusVendorPackageEcosystem
procps-ng affected Alibaba Cloud procps-ng —
Upstream advisory

ALINUX2-SA-2019:0096

ALINUX 2Active exploitation (sightings)MEDIUM2019-10-18

ALINUX2-SA-2019:0096: poppler security, bug fix, and enhancement update (Moderate)

CVEs:CVE-2018-16646CVE-2018-18897CVE-2018-19058CVE-2018-19059CVE-2018-19060CVE-2018-19149CVE-2018-20481CVE-2018-20650CVE-2018-20662CVE-2019-7310CVE-2019-9200CVE-2019-9631

Affected products

ProductStatusVendorPackageEcosystem
evince affected Alibaba Cloud evince —
okular affected Alibaba Cloud okular —
poppler affected Alibaba Cloud poppler —
Upstream advisory

ALINUX2-SA-2019:0104

ALINUX 2PoC exploitMEDIUM2019-10-23

ALINUX2-SA-2019:0104: nss, nss-softokn, nss-util, and nspr security, bug fix, and enhancement update (Moderate)

CVEs:CVE-2018-0495CVE-2018-12404

Affected products

ProductStatusVendorPackageEcosystem
nspr affected Alibaba Cloud nspr —
nss affected Alibaba Cloud nss —
nss-softokn affected Alibaba Cloud nss-softokn —
nss-util affected Alibaba Cloud nss-util —
Upstream advisory

ALINUX2-SA-2019:0076

ALINUX 2PoC exploitLOW2019-10-09

ALINUX2-SA-2019:0076: Xorg security and bug fix update (Moderate)

CVEs:CVE-2018-14598CVE-2018-14599CVE-2018-14600CVE-2018-15853CVE-2018-15854CVE-2018-15855CVE-2018-15856CVE-2018-15857CVE-2018-15859CVE-2018-15861CVE-2018-15862CVE-2018-15863CVE-2018-15864

Affected products

ProductStatusVendorPackageEcosystem
gdm affected Alibaba Cloud gdm —
libX11 affected Alibaba Cloud libX11 —
libxkbcommon affected Alibaba Cloud libxkbcommon —
mesa-libGLw affected Alibaba Cloud mesa-libGLw —
xorg-x11-drv-ati affected Alibaba Cloud xorg-x11-drv-ati —
xorg-x11-drv-vesa affected Alibaba Cloud xorg-x11-drv-vesa —
xorg-x11-drv-wacom affected Alibaba Cloud xorg-x11-drv-wacom —
xorg-x11-server affected Alibaba Cloud xorg-x11-server —
Upstream advisory

ALINUX2-SA-2019:0090

ALINUX 2PoC exploitLOW2019-10-10

ALINUX2-SA-2019:0090: python-requests security update (Low)

CVEs:CVE-2018-18074

Affected products

ProductStatusVendorPackageEcosystem
python-requests affected Alibaba Cloud python-requests —
Upstream advisory

ALINUX2-SA-2019:0088

ALINUX 2PoC exploitMEDIUM2019-10-10

ALINUX2-SA-2019:0088: perl-Archive-Tar security update (Moderate)

CVEs:CVE-2018-12015

Affected products

ProductStatusVendorPackageEcosystem
perl-Archive-Tar affected Alibaba Cloud perl-Archive-Tar —
Upstream advisory

ALINUX2-SA-2019:0067

ALINUX 2PoC exploitMEDIUM2019-10-09

ALINUX2-SA-2019:0067: libcgroup security update (Moderate)

CVEs:CVE-2018-14348

Affected products

ProductStatusVendorPackageEcosystem
libcgroup affected Alibaba Cloud libcgroup —
Upstream advisory

ALINUX2-SA-2019:0112

ALINUX 2PoC exploitMEDIUM2019-10-24

ALINUX2-SA-2019:0112: glibc security and bug fix update (Moderate)

CVEs:CVE-2016-10739

Affected products

ProductStatusVendorPackageEcosystem
glibc affected Alibaba Cloud glibc —
Upstream advisory

ALINUX2-SA-2019:0118

ALINUX 2Coalition ESS < 30%MEDIUM2019-10-28

ALINUX2-SA-2019:0118: dhcp security and bug fix update (Moderate)

CVEs:CVE-2019-6470

Affected products

ProductStatusVendorPackageEcosystem
dhcp affected Alibaba Cloud dhcp —
Upstream advisory

ALINUX2-SA-2019:0054

ALINUX 2Coalition ESS < 30%MEDIUM2019-10-08

ALINUX2-SA-2019:0054: bind security, bug fix, and enhancement update (Moderate)

CVEs:CVE-2018-5741

Affected products

ProductStatusVendorPackageEcosystem
bind affected Alibaba Cloud bind —
Upstream advisory

ALINUX2-SA-2019:0095

ALINUX 2Coalition ESS < 30%LOW2019-10-18

ALINUX2-SA-2019:0095: qt5 security, bug fix, and enhancement update (Moderate)

CVEs:CVE-2018-15518CVE-2018-19869CVE-2018-19870CVE-2018-19871CVE-2018-19873

Affected products

ProductStatusVendorPackageEcosystem
qt5-qt3d affected Alibaba Cloud qt5-qt3d —
qt5-qtbase affected Alibaba Cloud qt5-qtbase —
qt5-qtcanvas3d affected Alibaba Cloud qt5-qtcanvas3d —
qt5-qtconnectivity affected Alibaba Cloud qt5-qtconnectivity —
qt5-qtdeclarative affected Alibaba Cloud qt5-qtdeclarative —
qt5-qtdoc affected Alibaba Cloud qt5-qtdoc —
qt5-qtgraphicaleffects affected Alibaba Cloud qt5-qtgraphicaleffects —
qt5-qtimageformats affected Alibaba Cloud qt5-qtimageformats —
qt5-qtlocation affected Alibaba Cloud qt5-qtlocation —
qt5-qtmultimedia affected Alibaba Cloud qt5-qtmultimedia —
qt5-qtquickcontrols affected Alibaba Cloud qt5-qtquickcontrols —
qt5-qtquickcontrols2 affected Alibaba Cloud qt5-qtquickcontrols2 —
qt5-qtscript affected Alibaba Cloud qt5-qtscript —
qt5-qtsensors affected Alibaba Cloud qt5-qtsensors —
qt5-qtserialbus affected Alibaba Cloud qt5-qtserialbus —
qt5-qtserialport affected Alibaba Cloud qt5-qtserialport —
qt5-qtsvg affected Alibaba Cloud qt5-qtsvg —
qt5-qttools affected Alibaba Cloud qt5-qttools —
qt5-qttranslations affected Alibaba Cloud qt5-qttranslations —
qt5-qtwayland affected Alibaba Cloud qt5-qtwayland —
qt5-qtwebchannel affected Alibaba Cloud qt5-qtwebchannel —
qt5-qtwebsockets affected Alibaba Cloud qt5-qtwebsockets —
qt5-qtx11extras affected Alibaba Cloud qt5-qtx11extras —
qt5-qtxmlpatterns affected Alibaba Cloud qt5-qtxmlpatterns —
Upstream advisory

ALINUX2-SA-2019:0057

ALINUX 2Coalition ESS < 30%LOW2019-10-08

ALINUX2-SA-2019:0057: compat-libtiff3 security update (Low)

CVEs:CVE-2018-7456

Affected products

ProductStatusVendorPackageEcosystem
compat-libtiff3 affected Alibaba Cloud compat-libtiff3 —
Upstream advisory

ALINUX2-SA-2019:0103

ALINUX 2Coalition ESS < 30%LOW2019-10-23

ALINUX2-SA-2019:0103: exiv2 security, bug fix, and enhancement update (Low)

CVEs:CVE-2017-17724CVE-2018-10772CVE-2018-10958CVE-2018-10998CVE-2018-11037CVE-2018-12264CVE-2018-12265CVE-2018-14046CVE-2018-17282CVE-2018-17581CVE-2018-18915CVE-2018-19107CVE-2018-19108CVE-2018-19535CVE-2018-19607CVE-2018-20096CVE-2018-20097CVE-2018-20098CVE-2018-20099CVE-2018-8976CVE-2018-8977CVE-2018-9305

Affected products

ProductStatusVendorPackageEcosystem
exiv2 affected Alibaba Cloud exiv2 —
Upstream advisory

ALINUX2-SA-2019:0109

ALINUX 2Coalition ESS < 30%MEDIUM2019-10-24

ALINUX2-SA-2019:0109: zsh security and bug fix update (Moderate)

CVEs:CVE-2018-13259

Affected products

ProductStatusVendorPackageEcosystem
zsh affected Alibaba Cloud zsh —
Upstream advisory

ALINUX2-SA-2019:0102

ALINUX 2Coalition ESS < 30%MEDIUM2019-10-22

ALINUX2-SA-2019:0102: freerdp and vinagre security, bug fix, and enhancement update (Low)

CVEs:CVE-2018-1000852

Affected products

ProductStatusVendorPackageEcosystem
freerdp affected Alibaba Cloud freerdp —
vinagre affected Alibaba Cloud vinagre —
Upstream advisory

ALINUX2-SA-2019:0068

ALINUX 2Coalition ESS < 30%HIGH2019-10-09

ALINUX2-SA-2019:0068: spice-gtk security and bug fix update (Moderate)

CVEs:CVE-2018-10893

Affected products

ProductStatusVendorPackageEcosystem
libgovirt affected Alibaba Cloud libgovirt —
spice-gtk affected Alibaba Cloud spice-gtk —
spice-vdagent affected Alibaba Cloud spice-vdagent —
virt-viewer affected Alibaba Cloud virt-viewer —
Upstream advisory

ALINUX2-SA-2019:0061

ALINUX 2Coalition ESS < 30%MEDIUM2019-10-08

ALINUX2-SA-2019:0061: fence-agents security, bug fix, and enhancement update (Moderate)

CVEs:CVE-2019-10153

Affected products

ProductStatusVendorPackageEcosystem
fence-agents affected Alibaba Cloud fence-agents —
Upstream advisory

ALINUX2-SA-2019:0064

ALINUX 2Coalition ESS < 30%MEDIUM2019-10-09

ALINUX2-SA-2019:0064: kde-workspace security and bug fix update (Low)

CVEs:CVE-2018-6790

Affected products

ProductStatusVendorPackageEcosystem
kdelibs affected Alibaba Cloud kdelibs —
kde-workspace affected Alibaba Cloud kde-workspace —
kmag affected Alibaba Cloud kmag —
virtuoso-opensource affected Alibaba Cloud virtuoso-opensource —
Upstream advisory

ALINUX2-SA-2019:0056

ALINUX 2Coalition ESS < 30%MEDIUM2019-10-08

ALINUX2-SA-2019:0056: blktrace security update (Low)

CVEs:CVE-2018-10689

Affected products

ProductStatusVendorPackageEcosystem
blktrace affected Alibaba Cloud blktrace —
Upstream advisory

ALINUX2-SA-2019:0083

ALINUX 2Coalition ESS < 30%HIGH2019-10-09

ALINUX2-SA-2019:0083: udisks2 security, bug fix, and enhancement update (Moderate)

CVEs:CVE-2018-17336

Affected products

ProductStatusVendorPackageEcosystem
udisks2 affected Alibaba Cloud udisks2 —
Upstream advisory

ALINUX2-SA-2019:0069

ALINUX 2Coalition ESS < 30%LOW2019-10-09

ALINUX2-SA-2019:0069: libguestfs-winsupport security update (Low)

CVEs:CVE-2019-9755

Affected products

ProductStatusVendorPackageEcosystem
libguestfs-winsupport affected Alibaba Cloud libguestfs-winsupport —
Upstream advisory

ALINUX2-SA-2019:0107

ALINUX 2Coalition ESS < 30%HIGH2019-10-23

ALINUX2-SA-2019:0107: keepalived security and bug fix update (Moderate)

CVEs:CVE-2018-19044

Affected products

ProductStatusVendorPackageEcosystem
keepalived affected Alibaba Cloud keepalived —
Upstream advisory

ALINUX2-SA-2019:0065

ALINUX 2Coalition ESS < 30%LOW2019-10-09

ALINUX2-SA-2019:0065: keycloak-httpd-client-install security, bug fix, and enhancement update (Low)

CVEs:CVE-2017-15111CVE-2017-15112

Affected products

ProductStatusVendorPackageEcosystem
keycloak-httpd-client-install affected Alibaba Cloud keycloak-httpd-client-install —
Upstream advisory

ALINUX2-SA-2019:0062

ALINUX 2Coalition ESS < 30%HIGH2019-10-08

ALINUX2-SA-2019:0062: gvfs security and bug fix update (Moderate)

CVEs:CVE-2019-3827

Affected products

ProductStatusVendorPackageEcosystem
gvfs affected Alibaba Cloud gvfs —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.