AWS-2014-001
AWS BulletinExploitedCISA KEV listed2019-10-09
HeartBleed Bug Concern
CVEs:CVE-2014-0160
Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 19 are already weaponised in the wild — see the Exploited section.
The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.
HeartBleed Bug Concern
CVEs:CVE-2014-0160
AWS Services Updated to Address OpenSSL Vulnerability
CVEs:CVE-2014-0160
HeartBleed Bug Update
CVEs:CVE-2014-0160
CVE-2014-6271 Advisory
ALAS-2019-1315: php71, php72, php73, php56 (critical)
CVEs:CVE-2019-11043
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| php71, php72, php73, php56 | affected | Amazon | php71, php72, php73, php56 | — |
ISC BIND Security Advisory (CVE-2015-5477)
CVEs:CVE-2015-5477
Android Security Advisory
CVEs:CVE-2015-1538CVE-2015-1539CVE-2015-3824CVE-2015-3826CVE-2015-3827CVE-2015-3828CVE-2015-3829
Possible Insecure Elasticsearch Configuration
CVEs:CVE-2014-3120
JBoss Worm Spreading via Unpatched or Unsecured JBoss Application Server
CVEs:CVE-2010-0738
Juniper Security Advisory
ALAS-2019-1310: exim (critical)
CVEs:CVE-2019-16928
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| exim | affected | Amazon | exim | — |
MS14-066 Advisory
CVEs:CVE-2014-6321
OpenSSL Security Advisory
CVEs:CVE-2014-0224
CVE-2015-7547 Advisory
CVEs:CVE-2015-7547
ALAS-2019-1311: httpd24 (medium)
CVEs:CVE-2019-10081CVE-2019-10082CVE-2019-10092CVE-2019-10097CVE-2019-10098CVE-2019-9517
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| httpd24 | affected | Amazon | httpd24 | — |
Amazon RDS - MySQL Security Advisory (CVE-2016-6662)
CVEs:CVE-2016-6662
ALAS-2019-1313: openssh (medium)
CVEs:CVE-2018-20685CVE-2019-6109CVE-2019-6111
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| openssh | affected | Amazon | openssh | — |
Linux kernal vulnerability in certain EC2 AMIs
CVEs:CVE-2009-2692
Linux kernel IA32 System Call Emulation Vulnerability
CVE-2014-3566 Advisory (POODLE)
CVE-2015-0235 Advisory (Ghost)
CVEs:CVE-2015-0235
CVE-2016-0800 Advisory
CVEs:CVE-2016-0800
Microsoft Windows RDP Vulnerability
CVEs:CVE-2012-0002
Microsoft Windows RDP Vulnerability
OpenSSL Security Advisory - July 2015
CVEs:CVE-2015-1793
Xen Security Advisories
ALAS-2019-1306: libtiff (medium)
CVEs:CVE-2016-3186CVE-2018-10779CVE-2018-10963CVE-2018-12900CVE-2018-17100CVE-2018-17101CVE-2018-18557CVE-2018-18661CVE-2018-7456CVE-2018-8905
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| libtiff | affected | Amazon | libtiff | — |
Amazon RDS Security Advisory (CVE-2016-6663 and CVE-2016-6664)
ALAS-2019-1309: sudo (important)
CVEs:CVE-2019-14287
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| sudo | affected | Amazon | sudo | — |
Microsoft and Samba Security Advisories
ISC BIND Security Advisory - September 2015
XSA Security Advisory CVE-2015-3456 "VENOM"
CVEs:CVE-2015-3456
Amazon RDS – MySQL Security Advisory
ALAS-2019-1314: python27, python34, python35, python36 (medium)
CVEs:CVE-2019-16056
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| python27, python34, python35, python36 | affected | Amazon | python27, python34, python35, python36 | — |
ISC BIND Security Advisory - March 2016
ALAS-2019-1312: patch (important)
CVEs:CVE-2016-10713CVE-2018-20969CVE-2018-6952CVE-2019-13638
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| patch | affected | Amazon | patch | — |
ALAS-2019-1308: libarchive (medium)
CVEs:CVE-2017-14503CVE-2018-1000877CVE-2018-1000878CVE-2019-1000019CVE-2019-1000020
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| libarchive | affected | Amazon | libarchive | — |
ALAS-2019-1307: sssd (medium)
CVEs:CVE-2018-16838CVE-2019-3811
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| sssd | affected | Amazon | sssd | — |
XSA Security Advisory (XSA-179)
XSA Security Advisory (XSA-182)
CVEs:CVE-2016-6258
Amazon RDS - Oracle Security Advisory
CVEs:CVE-2014-2478
XSA Security Advisory 108
CVEs:CVE-2014-7188
Xen Security Advisories
CVEs:CVE-2012-3494CVE-2012-3495CVE-2012-3496CVE-2012-3497CVE-2012-3498CVE-2012-3515CVE-2012-3516CVE-2012-4411
MIT and UC San Diego researchers publish report
UDP traffic to EC2 instances
Linux 2.6 kernel vulnerability in certain EC2 AMIs
SSL and TLS renegotiation vulnerabilities
Zeus Botnet Controller
SIP abuse
Gmail Accounts Accessed by EC2 IPs
Possible Insecure memcached Configuration
Amazon Payments Signature Validation
Windows CIFS Browser Protocol Heap Corruption Vulnerability
Reminder about Safely Sharing and Using Public AMIs
Morto Worm Spreading via Remote Desktop Protocol
Reported SOAP Request Parsing Vulnerabilities
Reported SSL Certificate Validation Errors in API Tools and SDKs
Red Hat and Other Third-party Public AMIs Security Concern
RDS PostgreSQL Updated to Address OpenSSL Vulnerability
OpenSSL Security Advisory (January)
Oracle Critical Patch (January 2015)
SSL Issue "FREAK Attack"
XSA Security Advisories
OpenSSL Security Advisory - March 2015
AWS to Switch to SHA256 Hash Algorithm for SSL Certificates
Update on AWS's Switch to SHA256 for SSL Certificates
MS15-078 Advisory
XSA Security Advisory CVE-2015-5154
MS15-093 Advisory
XSA Security Advisories
XSA Security Advisories
OpenSSL Security Advisory - May 2016
Xen Security Advisories - September 2016
Xen Security Advisories - November 2016
Xen Security Advisory 200 (XSA-200)
Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.