2,507 results · Clear filters · Feed
-
High max 7.7ALAS2023-2025-822 3 CVEs
Important: nodejs20 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-23085: A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was d…
first Jan 30, 2025 -
High max 7.5ALAS2-2025-2751 2 CVEs
Important: bind security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-12705: Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue …
first Jan 30, 2025 -
High max 9.1ALAS2-2025-2749 2 CVEs
Important: nerdctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-45338: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing…
first Jan 30, 2025 -
High max 8.6ALAS2-2025-2746 1 CVE
Important: gstreamer1 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-47606: GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_e…
first Jan 30, 2025 -
High max 8.8ALAS2-2025-2745 7 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-50230: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of checked flag CVE-2024-50067: In the …
first Jan 30, 2025 -
High max 8.2ALAS2-2025-2742 1 CVE
Important: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-6519: A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.
first Jan 30, 2025 -
High max 9.2ALAS2-2025-2739 2 CVEs
Important: amazon-ssm-agent security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-21614: go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions pri…
first Jan 30, 2025 -
High max 9.8ALAS2-2023-1951 29 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-23605: The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Fi…
first Feb 17, 2023 -
High max 7.0ALAS2023-2025-818 1 CVE
Important: redis6 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-46981: Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garba…
first Jan 21, 2025 -
High max 7.5ALAS2023-2025-812 1 CVE
Important: iperf3 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-53580: iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function.
first Jan 21, 2025 -
High max 5.4ALAS2023-2025-811 2 CVEs
Important: ansible-core security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-56326: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an att…
first Jan 21, 2025 -
High max 5.4ALAS2023-2025-810 1 CVE
Important: python-jinja2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-56326: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an att…
first Jan 21, 2025 -
High max 8.7ALAS2023-2025-808 2 CVEs
Important: python3.12 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-9287: A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted proper…
first Jan 21, 2025 -
High max 7.5ALAS2-2025-2736 1 CVE
Important: iperf3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-53580: iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function.
first Jan 21, 2025 -
High max 5.4ALAS2-2025-2735 1 CVE
Important: python3-jinja2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-56326: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attack…
first Jan 21, 2025 -
High max 5.4ALAS2-2025-2734 1 CVE
Important: python-jinja2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-56326: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attack…
first Jan 21, 2025 -
High max 8.8ALAS2-2025-2733 1 CVE
Important: postgresql security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-7348: Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running …
first Jan 21, 2025 -
High max 7.5ALAS2-2025-2731 5 CVEs
Important: rsync security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-12747: A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encoun…
-
High max 7.5ALAS2023-2025-801 5 CVEs
Important: rsync security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-12747: A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when enc…
-
High max 7.5ALAS2023-2025-798 1 CVE
Important: jackson-databind security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-42004: In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to pr…
first Jan 6, 2025 -
High max 8.8
Important: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-44308: The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPa…
first Feb 1, 2024 -
High max 10.0ALAS2023-2024-674 5 CVEs
Important: docker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-41110: AWS is aware of CVE-2024-41110, an issue affecting the Moby open source project, packaged in Amazon Linux as "docker". Docker is a component of several…
first Jul 29, 2024 -
High max 8.8ALAS2-2024-2722 8 CVEs
Important: edk2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-9143: Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory re…
first Dec 5, 2024 -
High max 7.4ALAS2-2024-2720 10 CVEs
Important: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-21235: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported v…
first Dec 5, 2024 -
High max 10.0ALAS2-2024-2712 1 CVE
Important: flatpak security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-42472: A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user o…
first Dec 5, 2024 -
High max 9.8ALAS2-2024-2710 1 CVE
Important: expat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-45490: An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.
first Dec 5, 2024 -
High max 7.8ALAS2-2024-2708 3 CVEs
Important: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-46956: PostScript interpreter - fix buffer length check NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707895 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit…
first Dec 5, 2024 -
High max 7.5ALAS2-2024-2707 1 CVE
Important: xstream security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-47072: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream. XStream provides a BinaryStreamDriver wi…
first Dec 5, 2024 -
High max 7.5ALAS2-2024-2706 1 CVE
Important: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-47220: An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Tr…
first Dec 5, 2024 -
High max 7.5ALAS2-2024-2705 3 CVEs
Important: libsoup security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-52532: GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. CVE-2024-5…
first Dec 5, 2024 -
High max 7.5ALAS2-2021-1695 4 CVEs
Important: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-2388: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Ja…
first Aug 4, 2021 -
High max 8.8ALAS2023-2024-787 4 CVEs
Important: postgresql15 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-10979: Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables…
first Dec 5, 2024 -
High max 8.8ALAS2023-2024-786 4 CVEs
Important: postgresql16 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-10979: Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables…
first Dec 5, 2024 -
High max 8.1ALAS2023-2024-777 4 CVEs
Important: dotnet8.0 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-43485: .NET and Visual Studio Denial of Service Vulnerability CVE-2024-43484: .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2024…
first Dec 5, 2024 -
High max 7.5ALAS2023-2024-776 3 CVEs
Important: dotnet6.0 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-43485: .NET and Visual Studio Denial of Service Vulnerability CVE-2024-43484: .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2024…
first Dec 5, 2024 -
High max 8.4ALAS2023-2024-774 4 CVEs
Important: ghostscript security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-46956: PostScript interpreter - fix buffer length check NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707895 NOTE: https://cgit.ghostscript.com/cgi-bin/c…
first Dec 5, 2024 -
High max 9.1ALAS2023-2024-773 2 CVEs
Important: python-waitress security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-49769: Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunit…
first Dec 5, 2024 -
High max 7.5ALAS2023-2024-772 3 CVEs
Important: libsoup security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-52532: GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. CVE-202…
first Dec 5, 2024 -
High max 8.8ALAS2023-2024-748 7 CVEs
Important: microcode_ctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24980: Protection mechanism failure in some 3rd, 4th, and 5th Generation Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalat…
first Oct 24, 2024 -
High max 8.8ALAS2023-2024-519 24 CVEs
Important: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-35840: In the Linux kernel, the following vulnerability has been resolved: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() CVE-2024-35839: In t…
first Feb 15, 2024