2,507 results · Clear filters · Feed
-
High max 10.0
Important: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-55957: Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed att…
first Mar 26, 2025 -
High max 7.6ALAS2-2026-3796 1 CVE
Important: 389-ds-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-11774: An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a cr…
first Jul 6, 2026 -
High max 9.6ALAS2-2026-3795 38 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-56412: libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within hand…
first Jul 6, 2026 -
High max 7.6ALAS2-2026-3794 1 CVE
Important: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-42246: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-t…
first Jul 6, 2026 -
High max 7.8ALAS2-2026-3792 1 CVE
Important: tigervnc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-50259: A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] inde…
first Jul 6, 2026 -
High max 8.8ALAS2-2026-3791 3 CVEs
Important: gstreamer-plugins-bad-free security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-52722: A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed inte…
first Jul 6, 2026 -
High max 8.0ALAS2-2026-3789 1 CVE
Important: util-linux security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-53615: Integer Overflow or Wraparound in libblkid/src/partitions/dos.c
first Jul 6, 2026 -
High max 7.6ALAS2-2026-3788 1 CVE
Important: gstreamer1-plugins-good security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-53705: A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the bu…
first Jul 6, 2026 -
High max 7.6ALAS2-2026-3787 1 CVE
Important: gstreamer-plugins-good security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-53705: A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the bu…
first Jul 6, 2026 -
High max 6.9ALAS2-2026-3495 1 CVE
Important: expat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-56132: In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when t…
first Jul 6, 2026 -
High max 9.0ALAS2-2026-3493 3 CVEs
Important: samba security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4480: Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character wi…
first Jul 6, 2026 -
High max 7.3ALAS2023-2026-1932 1 CVE
Important: ansible security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-11837: A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instea…
first Jul 6, 2026 -
High max 7.8ALAS2023-2026-1931 4 CVEs
Important: python3.12 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-8328: The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host ad…
first Jul 6, 2026 -
High max 7.8ALAS2023-2026-1930 4 CVEs
Important: python3.11 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-8328: The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host ad…
first Jul 6, 2026 -
High max 9.6ALAS2023-2026-1928 42 CVEs
Important: firefox security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-56412: libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within h…
first Jul 6, 2026 -
High max 7.6ALAS2023-2026-1926 1 CVE
Important: gstreamer1-plugins-good security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53705: A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the…
first Jul 6, 2026 -
High max 8.1ALAS2023-2026-1922 2 CVEs
Important: nginx security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-48142: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block…
first Jul 6, 2026 -
High max 7.8ALAS2023-2026-1921 17 CVEs
Important: nodejs22 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-9679: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into the…
first Jul 6, 2026 -
High max 6.5ALAS2023-2026-1919 2 CVEs
Important: libheif security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-49271: libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the uncompressed HEIF decoder validates explicit icef compressed-u…
first Jul 6, 2026 -
High max 7.1ALAS2023-2026-1918 3 CVEs
Important: libde265 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-49346: libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0, a crafted H.265 bitstream with large SPS dimensions and 16-…
first Jul 6, 2026 -
High max 8.8ALAS2023-2026-1917 6 CVEs
Important: gstreamer1-plugins-bad-free security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53702: A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the …
first Jul 6, 2026 -
High max 8.0ALAS2023-2026-1916 1 CVE
Important: util-linux security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53615: Integer Overflow or Wraparound in libblkid/src/partitions/dos.c
first Jul 6, 2026 -
High max 7.5ALAS2023-2026-1915 1 CVE
Important: haproxy security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-55204: HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fai…
first Jul 6, 2026 -
High max 6.9ALAS2023-2026-1913 3 CVEs
Important: expat security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-56407: libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. CVE-2026-56406: libexpat before 2.8.2…
first Jul 6, 2026 -
High max 8.2ALAS2023-2026-1910 7 CVEs
Important: python3.13 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-9669: bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decomp…
first Jul 6, 2026 -
High max 7.8ALAS2023-2026-1903 2 CVEs
Important: sqlite security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-11824: SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash …
first Jul 6, 2026 -
High max 9.6ALAS2023-2026-1902 9 CVEs
Important: ecs-init security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42507: When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misl…
first Jul 6, 2026 -
High max 7.5ALAS2023-2026-1901 4 CVEs
Important: docker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42507: When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misl…
first Jul 6, 2026 -
High max 6.9ALAS2023-2026-1900 1 CVE
Important: expat security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-56132: In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled whe…
first Jul 6, 2026 -
High max 8.0ALAS2023-2026-1899 1 CVE
Important: samba security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-3012: If the certificate auto-enrollment GPO is enabled on domain members (both in Samba's smb.conf and using Windows GPME tool), a CA certificate may be fetc…
first Jul 6, 2026 -
High max 9.8ALAS2-2026-3323 19 CVEs
Important: amazon-cloudwatch-agent security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-42499: Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. CVE-2026-42154: Prometheus is an open-sourc…
first May 25, 2026 -
High max 9.8ALAS2023-2026-1747 19 CVEs
Important: amazon-cloudwatch-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42499: Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. CVE-2026-42154: Prometheus is an open-so…
first May 25, 2026 -
High max 9.8ALAS2023-2026-1746 128 CVEs
Important: kernel6.18 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53080: In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_fw: fix NULL dereference of "old" filters before change() CVE-2026-4…
first May 25, 2026 -
High max 8.8ALAS2023-2026-1491 21 CVEs
Important: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-52945: In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enable threaded NAPI" CVE-2026-23273: In the Linux kerne…
first Mar 16, 2026 -
High max 7.5ALAS2023-2026-1611 7 CVEs
Important: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-56370: ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts…
first Apr 27, 2026 -
High max 8.6ALAS2023-2026-1478 32 CVEs
Important: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-56378: ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can t…
first Mar 16, 2026 -
High max 9.4ALAS2023-2026-1897 5 CVEs
Important: containerd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53492: Device and host mount injection via CDI annotations in checkpoint metadata (requires CDI enabled on node) NOTE: https://github.com/containerd/container…
first Jun 22, 2026 -
High max 9.8ALAS2023-2025-864 52 CVEs
Important: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-57947: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo: fix initial map fill CVE-2024-44970: In the Linux kernel,…
first Feb 26, 2025 -
High max 10.0ALAS2-2026-3389 7 CVEs
Important: amazon-cloudwatch-agent security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-46595: Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public …
-
High max 9.8ALAS2-2026-3387 1 CVE
Important: perl-GD security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-11526: command injection via 2-arg open() in _make_filehandle