Skip to content
OpenAdvisories

Source

Amazon Linux Security Center (ALAS)

Source: https://alas.aws.amazon.com/

All Critical High Medium Low With exploited CVEs

2,507 results · Clear filters · Feed

  • High max 9.8
    ALAS2023-2026-1605 10 CVEs

    Important: nerdctl security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-39984: Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in th…

    first Apr 27, 2026
  • High max 7.5
    ALAS2023-2026-1604 1 CVE

    Important: openssh security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-35385: In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is…

    first Apr 27, 2026
  • High max 8.8
    ALAS2023-2026-1602 1 CVE

    Important: maven3.9 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-67030: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d…

    first Apr 27, 2026
  • High max 9.3
    ALAS2023-2026-1601 2 CVEs

    Important: flatpak security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34079: Arbitrary file deletion on the host filesystem in Flatpak before 1.16.4. The caching for ld.so removes outdated cache files without properly checking t…

    first Apr 27, 2026
  • High max 9.8
    ALAS2023-2026-1593 9 CVEs

    Important: golang security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content. This could cause…

    first Apr 27, 2026
  • High max 5.3
    ALAS2023-2026-1590 1 CVE

    Important: python-jwcrypto security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-39373: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory b…

    first Apr 27, 2026
  • High max 6.5
    ALAS2-2026-3279 4 CVEs

    Important: cups security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34990: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged us…

    first Apr 27, 2026
  • High max 7.5
    ALAS2-2026-3278 9 CVEs

    Important: ImageMagick security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-40312: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, an off by one error in the MSL …

    first Apr 27, 2026
  • High max 7.4
    ALAS2-2026-3277 1 CVE

    Important: jetty security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-5795: In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial che…

    first Apr 27, 2026
  • High max 8.1
    ALAS2-2026-3275 4 CVEs

    Important: edk2 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-28390: Possible NULL dereference when processing CMS KeyTransportRecipientInfo CVE-2026-28389: Possible NULL dereference when processing CMS KeyAgreeRecipientInf…

    first Apr 27, 2026
  • High max 7.8
    ALAS2-2026-3273 4 CVEs

    Important: tigervnc security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes() CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap() CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerF…

    first Apr 27, 2026
  • High max 7.5
    ALAS2-2026-3272 1 CVE

    Important: glibc security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4046: The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM139…

    first Apr 27, 2026
  • High max 9.8
    ALAS2-2026-3271 3 CVEs

    Important: thunderbird security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-5734: Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of …

    first Apr 27, 2026
  • High max 7.8
    ALAS2-2026-3268 4 CVEs

    Important: xorg-x11-server security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes() CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap() CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerF…

    first Apr 27, 2026
  • High max 8.6
    ALAS2-2026-3267 2 CVEs

    Important: OpenEXR security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34588: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.…

    first Apr 27, 2026
  • High max 9.8
    ALAS2-2026-3265 10 CVEs

    Important: nerdctl security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-39984: Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the V…

    first Apr 27, 2026
  • High max 9.1
    ALAS2-2026-3264 1 CVE

    Important: rclone security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the H…

    first Apr 27, 2026
  • High max 7.5
    ALAS2-2026-3262 1 CVE

    Important: openssh security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-35385: In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is pe…

    first Apr 27, 2026
  • High max 9.3
    ALAS2-2026-3261 1 CVE

    Important: flatpak security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34078: A complete sandbox escape vulnerability exists in Flatpak before 1.16.4. The Flatpak portal accepts paths in the sandbox-expose options which can be app-c…

    first Apr 27, 2026
  • High max 9.8
    ALAS2-2026-3259 9 CVEs

    Important: golang security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content. This could cause ac…

    first Apr 27, 2026
  • High max 8.1
    ALAS2-2026-3258 2 CVEs

    Important: LibRaw security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-24660: A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can l…

    first Apr 27, 2026
  • High max 7.5
    ALAS2-2026-3257 1 CVE

    Important: libarchive security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-5121: A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker…

    first Apr 27, 2026
  • High max 9.8
    ALAS2-2026-3255 2 CVEs

    Important: LibRaw security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-21413: A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially cra…

    first Apr 27, 2026
  • High max 5.3
    ALAS2-2026-3254 1 CVE

    Important: python-jwcrypto security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-39373: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by s…

    first Apr 27, 2026
  • High max 7.4
    ALAS2-2026-3252 2 CVEs

    Important: dovecot security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-27857: Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection.…

    first Apr 13, 2026
  • High max 8.2
    ALAS2-2026-3251 1 CVE

    Important: vim security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34982: A modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip and printheader optio…

    first Apr 13, 2026
  • High max 7.8
    ALAS2023-2026-1553 4 CVEs

    Important: gdk-pixbuf2 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-5201: A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of …

    first Apr 13, 2026
  • High max 8.1
    ALAS2-2026-3249 4 CVEs

    Important: openssl11 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-28390: Possible NULL dereference when processing CMS KeyTransportRecipientInfo CVE-2026-28389: Possible NULL dereference when processing CMS KeyAgreeRecipientInf…

  • High max 9.1
    ALAS2-2026-3248 4 CVEs

    Important: amazon-cloudwatch-agent security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the H…

  • High max 7.5
    ALAS2-2026-3245 5 CVEs

    Important: amazon-efs-utils security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4428: A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows…

  • High max 7.5
    ALAS2-2026-3244 1 CVE

    Important: libpng security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33416: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.…

  • High max 7.5
    ALAS2-2026-3243 1 CVE

    Important: libpng12 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33416: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.…

  • High max 9.2
    ALAS2-2026-3242 2 CVEs

    Important: squid security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33526: Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic…

  • High max 10.0
    ALAS2-2026-3241 41 CVEs

    Important: thunderbird security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4721: Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evid…

  • High max 7.5
    ALAS2-2026-3240 1 CVE

    Important: gdk-pixbuf2 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-5201: A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of col…

  • High max 7.5
    ALAS2-2026-3238 6 CVEs

    Important: freerdp security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33986: H.264 YUV Buffer Dimension Desync - Heap OOB Write NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h6qw-wxvm-hf97 CVE-2026-33985: ClearC…

  • High max 9.1
    ALAS2-2026-3236 2 CVEs

    Important: cri-tools security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the H…

  • High max 7.8
    ALAS2-2026-3235 1 CVE

    Important: libtiff security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4775: A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function b…

  • High max 7.8
    ALAS2-2026-3234 1 CVE

    Important: compat-libtiff3 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4775: A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function b…

  • High max 8.8
    ALAS2-2026-3233 1 CVE

    Important: plexus-utils security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-67030: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b2…