Vulnerabilities

 24 via 30 paths

Dependencies

 30

Source

 Group 6 Copy Created with Sketch. Docker

Target OS

 alpine:3.7.1
Test your Docker Hub image against our market leading vulnerability database Sign up for free
Severity
  • 4
  • 6
  • 13
  • 1
Status
  • 24
  • 0
  • 0

critical severity

Out-of-bounds Write

  • Vulnerable module: bzip2/libbz2
  • Introduced through: bzip2/libbz2@1.0.6-r6
  • Fixed in: 1.0.6-r7

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › bzip2/libbz2@1.0.6-r6

NVD Description

Note: Versions mentioned in the description apply only to the upstream bzip2 package and not the bzip2 package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

Remediation

Upgrade Alpine:3.7 bzip2 to version 1.0.6-r7 or higher.

References

Out-of-bounds Write vulnerability report

critical severity

Double Free

  • Vulnerable module: gd/libgd
  • Introduced through: gd/libgd@2.2.5-r0
  • Fixed in: 2.2.5-r2

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › gd/libgd@2.2.5-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream gd package and not the gd package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.

Remediation

Upgrade Alpine:3.7 gd to version 2.2.5-r2 or higher.

References

Double Free vulnerability report

critical severity

CVE-2019-11068

  • Vulnerable module: libxslt/libxslt
  • Introduced through: libxslt/libxslt@1.1.31-r0
  • Fixed in: 1.1.31-r1

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › libxslt/libxslt@1.1.31-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxslt package and not the libxslt package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

Remediation

Upgrade Alpine:3.7 libxslt to version 1.1.31-r1 or higher.

References

CVE-2019-11068 vulnerability report

critical severity

Out-of-bounds Write

  • Vulnerable module: musl/musl
  • Introduced through: musl/musl@1.1.18-r3 and musl/musl-utils@1.1.18-r3
  • Fixed in: 1.1.18-r4

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › musl/musl@1.1.18-r3
  • Introduced through: nginx@1.14.0-alpine › musl/musl-utils@1.1.18-r3

NVD Description

Note: Versions mentioned in the description apply only to the upstream musl package and not the musl package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.

Remediation

Upgrade Alpine:3.7 musl to version 1.1.18-r4 or higher.

References

Out-of-bounds Write vulnerability report

high severity

Double Free

  • Vulnerable module: gd/libgd
  • Introduced through: gd/libgd@2.2.5-r0
  • Fixed in: 2.2.5-r1

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › gd/libgd@2.2.5-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream gd package and not the gd package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

Libgd version 2.2.5 contains a Double Free Vulnerability vulnerability in gdImageBmpPtr Function that can result in Remote Code Execution . This attack appear to be exploitable via Specially Crafted Jpeg Image can trigger double free. This vulnerability appears to have been fixed in after commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

Remediation

Upgrade Alpine:3.7 gd to version 2.2.5-r1 or higher.

References

Double Free vulnerability report

high severity

Out-of-bounds Write

  • Vulnerable module: gd/libgd
  • Introduced through: gd/libgd@2.2.5-r0
  • Fixed in: 2.2.5-r2

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › gd/libgd@2.2.5-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream gd package and not the gd package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.

Remediation

Upgrade Alpine:3.7 gd to version 2.2.5-r2 or higher.

References

Out-of-bounds Write vulnerability report

high severity

Out-of-bounds Write

  • Vulnerable module: libpng/libpng
  • Introduced through: libpng/libpng@1.6.34-r1
  • Fixed in: 1.6.37-r0

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › libpng/libpng@1.6.34-r1

NVD Description

Note: Versions mentioned in the description apply only to the upstream libpng package and not the libpng package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png.

Remediation

Upgrade Alpine:3.7 libpng to version 1.6.37-r0 or higher.

References

Out-of-bounds Write vulnerability report

high severity

Excessive Iteration

  • Vulnerable module: libjpeg-turbo/libjpeg-turbo
  • Introduced through: libjpeg-turbo/libjpeg-turbo@1.5.2-r0
  • Fixed in: 1.5.3-r2

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › libjpeg-turbo/libjpeg-turbo@1.5.2-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream libjpeg-turbo package and not the libjpeg-turbo package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.

Remediation

Upgrade Alpine:3.7 libjpeg-turbo to version 1.5.3-r2 or higher.

References

Excessive Iteration vulnerability report

high severity

NULL Pointer Dereference

  • Vulnerable module: libxml2/libxml2
  • Introduced through: libxml2/libxml2@2.9.7-r0
  • Fixed in: 2.9.8-r1

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › libxml2/libxml2@2.9.7-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.

Remediation

Upgrade Alpine:3.7 libxml2 to version 2.9.8-r1 or higher.

References

NULL Pointer Dereference vulnerability report

high severity

Use After Free

  • Vulnerable module: libxslt/libxslt
  • Introduced through: libxslt/libxslt@1.1.31-r0
  • Fixed in: 1.1.31-r2

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › libxslt/libxslt@1.1.31-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxslt package and not the libxslt package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.

Remediation

Upgrade Alpine:3.7 libxslt to version 1.1.31-r2 or higher.

References

Use After Free vulnerability report

medium severity

Divide By Zero

  • Vulnerable module: libjpeg-turbo/libjpeg-turbo
  • Introduced through: libjpeg-turbo/libjpeg-turbo@1.5.2-r0
  • Fixed in: 1.5.3-r1

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › libjpeg-turbo/libjpeg-turbo@1.5.2-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream libjpeg-turbo package and not the libjpeg-turbo package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.

Remediation

Upgrade Alpine:3.7 libjpeg-turbo to version 1.5.3-r1 or higher.

References

Divide By Zero vulnerability report

medium severity

NULL Pointer Dereference

  • Vulnerable module: libjpeg-turbo/libjpeg-turbo
  • Introduced through: libjpeg-turbo/libjpeg-turbo@1.5.2-r0
  • Fixed in: 1.5.3-r0

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › libjpeg-turbo/libjpeg-turbo@1.5.2-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream libjpeg-turbo package and not the libjpeg-turbo package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.

Remediation

Upgrade Alpine:3.7 libjpeg-turbo to version 1.5.3-r0 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

Out-of-bounds Read

  • Vulnerable module: libjpeg-turbo/libjpeg-turbo
  • Introduced through: libjpeg-turbo/libjpeg-turbo@1.5.2-r0
  • Fixed in: 1.5.3-r3

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › libjpeg-turbo/libjpeg-turbo@1.5.2-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream libjpeg-turbo package and not the libjpeg-turbo package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.

Remediation

Upgrade Alpine:3.7 libjpeg-turbo to version 1.5.3-r3 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

CVE-2018-14048

  • Vulnerable module: libpng/libpng
  • Introduced through: libpng/libpng@1.6.34-r1
  • Fixed in: 1.6.37-r0

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › libpng/libpng@1.6.34-r1

NVD Description

Note: Versions mentioned in the description apply only to the upstream libpng package and not the libpng package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image.

Remediation

Upgrade Alpine:3.7 libpng to version 1.6.37-r0 or higher.

References

CVE-2018-14048 vulnerability report

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: libxml2/libxml2
  • Introduced through: libxml2/libxml2@2.9.7-r0
  • Fixed in: 2.9.8-r1

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › libxml2/libxml2@2.9.7-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

Remediation

Upgrade Alpine:3.7 libxml2 to version 2.9.8-r1 or higher.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

medium severity

Cryptographic Issues

  • Vulnerable module: libgcrypt/libgcrypt
  • Introduced through: libgcrypt/libgcrypt@1.8.3-r0
  • Fixed in: 1.8.3-r1

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › libgcrypt/libgcrypt@1.8.3-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt package and not the libgcrypt package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack

Remediation

Upgrade Alpine:3.7 libgcrypt to version 1.8.3-r1 or higher.

References

Cryptographic Issues vulnerability report

medium severity

Information Exposure

  • Vulnerable module: openssl/libcrypto1.0
  • Introduced through: openssl/libcrypto1.0@1.0.2o-r1 and openssl/libssl1.0@1.0.2o-r1
  • Fixed in: 1.0.2r-r0

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › openssl/libcrypto1.0@1.0.2o-r1
  • Introduced through: nginx@1.14.0-alpine › openssl/libssl1.0@1.0.2o-r1

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

Remediation

Upgrade Alpine:3.7 openssl to version 1.0.2r-r0 or higher.

References

Information Exposure vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: openssl/libcrypto1.0
  • Introduced through: openssl/libcrypto1.0@1.0.2o-r1 and openssl/libssl1.0@1.0.2o-r1
  • Fixed in: 1.0.2q-r0

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › openssl/libcrypto1.0@1.0.2o-r1
  • Introduced through: nginx@1.14.0-alpine › openssl/libssl1.0@1.0.2o-r1

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

Remediation

Upgrade Alpine:3.7 openssl to version 1.0.2q-r0 or higher.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

Incorrect Conversion between Numeric Types

  • Vulnerable module: gd/libgd
  • Introduced through: gd/libgd@2.2.5-r0
  • Fixed in: 2.2.5-r2

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › gd/libgd@2.2.5-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream gd package and not the gd package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.

Remediation

Upgrade Alpine:3.7 gd to version 2.2.5-r2 or higher.

References

Incorrect Conversion between Numeric Types vulnerability report

medium severity

Use After Free

  • Vulnerable module: libpng/libpng
  • Introduced through: libpng/libpng@1.6.34-r1
  • Fixed in: 1.6.37-r0

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › libpng/libpng@1.6.34-r1

NVD Description

Note: Versions mentioned in the description apply only to the upstream libpng package and not the libpng package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

Remediation

Upgrade Alpine:3.7 libpng to version 1.6.37-r0 or higher.

References

Use After Free vulnerability report

medium severity

Loop with Unreachable Exit Condition ('Infinite Loop')

  • Vulnerable module: libxml2/libxml2
  • Introduced through: libxml2/libxml2@2.9.7-r0
  • Fixed in: 2.9.8-r1

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › libxml2/libxml2@2.9.7-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.

Remediation

Upgrade Alpine:3.7 libxml2 to version 2.9.8-r1 or higher.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

medium severity

CVE-2019-1547

  • Vulnerable module: openssl/libcrypto1.0
  • Introduced through: openssl/libcrypto1.0@1.0.2o-r1 and openssl/libssl1.0@1.0.2o-r1
  • Fixed in: 1.0.2t-r0

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › openssl/libcrypto1.0@1.0.2o-r1
  • Introduced through: nginx@1.14.0-alpine › openssl/libssl1.0@1.0.2o-r1

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Remediation

Upgrade Alpine:3.7 openssl to version 1.0.2t-r0 or higher.

References

CVE-2019-1547 vulnerability report

medium severity

Information Exposure

  • Vulnerable module: openssl/libcrypto1.0
  • Introduced through: openssl/libcrypto1.0@1.0.2o-r1 and openssl/libssl1.0@1.0.2o-r1
  • Fixed in: 1.0.2q-r0

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › openssl/libcrypto1.0@1.0.2o-r1
  • Introduced through: nginx@1.14.0-alpine › openssl/libssl1.0@1.0.2o-r1

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

Remediation

Upgrade Alpine:3.7 openssl to version 1.0.2q-r0 or higher.

References

Information Exposure vulnerability report

low severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: openssl/libcrypto1.0
  • Introduced through: openssl/libcrypto1.0@1.0.2o-r1 and openssl/libssl1.0@1.0.2o-r1
  • Fixed in: 1.0.2t-r0

Detailed paths

  • Introduced through: nginx@1.14.0-alpine › openssl/libcrypto1.0@1.0.2o-r1
  • Introduced through: nginx@1.14.0-alpine › openssl/libssl1.0@1.0.2o-r1

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.7 relevant fixed versions and status.

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Remediation

Upgrade Alpine:3.7 openssl to version 1.0.2t-r0 or higher.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report