2,507 results · Clear filters · Feed
-
High max 8.8ALAS2-2023-2287 2 CVEs
Important: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38546: An issue was found in libcurl which allows cookies to be inserted into a running program if specific conditions are met. The libcurl provided function, cu…
first Oct 10, 2023 -
High max 8.8ALAS2023-2023-377 2 CVEs
Important: curl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38546: An issue was found in libcurl which allows cookies to be inserted into a running program if specific conditions are met. The libcurl provided function,…
first Oct 10, 2023 -
High max 9.8ALAS2-2023-2286 3 CVEs
Important: python-pillow security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2014-3007: Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecif…
first Sep 27, 2023 -
High max 9.8ALAS2-2023-2285 1 CVE
Important: python-reportlab security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-19450: paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar elem…
first Sep 27, 2023 -
HighALAS2-2023-2278 1 CVE
Important: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-40433: An issue was discovered in function ciMethodBlocks::make_block_at in Oracle JDK (HotSpot VM) 11, 17 and OpenJDK (HotSpot VM) 8, 11, 17, allows attackers t…
first Sep 27, 2023 -
High max 7.5ALAS2-2023-2273 1 CVE
Important: bind security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3341: The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited…
first Sep 27, 2023 -
High max 7.5ALAS2-2023-2271 1 CVE
Important: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38039: HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1 NOTE: https://curl.se/docs/CVE-2023-38039.html NOTE: Introduced…
first Sep 27, 2023 -
High max 8.8ALAS2-2023-2270 13 CVEs
Important: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-40397: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. A remote attacker may be able to cause arbitrary javascript code …
first Sep 27, 2023 -
High max 7.8ALAS2-2023-2266 9 CVEs
Important: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4781: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. CVE-2023-4752: Use After Free in GitHub repository vim/vim prior to 9.0.1858. CV…
first Sep 27, 2023 -
High max 7.5ALAS2023-2023-372 1 CVE
Important: bind security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3341: The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limi…
first Sep 27, 2023 -
High max 7.8ALAS2023-2023-369 5 CVEs
Important: dotnet6.0 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-36799: .NET Core and Visual Studio Denial of Service Vulnerability CVE-2023-36796: Visual Studio Remote Code Execution Vulnerability CVE-2023-36794: Visual St…
first Sep 27, 2023 -
High max 7.5ALAS2023-2023-368 1 CVE
Important: curl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38039: HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1 NOTE: https://curl.se/docs/CVE-2023-38039.html NOTE: Introdu…
first Sep 27, 2023 -
HighALAS2023-2023-362 1 CVE
Important: ghostscript security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-43115: In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switc…
first Sep 27, 2023 -
High max 7.8ALAS2023-2023-360 8 CVEs
Important: vim security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-4781: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. CVE-2023-4752: Use After Free in GitHub repository vim/vim prior to 9.0.1858.…
first Sep 27, 2023 -
High max 7.8
Important: glibc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-4911: A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could …
first Sep 27, 2023 -
High max 8.8
Important: libwebp security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-4863: Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted H…
first Sep 27, 2023 -
High max 7.1ALAS2023-2023-350 1 CVE
Important: open-vm-tools security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-20900: VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor with man-in-the-middle (MITM) network positioning between vCenter …
first Sep 14, 2023 -
High max 5.5ALAS2023-2023-349 2 CVEs
Important: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2430: A vulnerability was found due to a missing lock for the IOPOLL in io_cqring_event_overflow() in io_uring.c in the Linux kernel. This flaw allows a local…
first Sep 14, 2023 -
HighALAS2023-2023-347 1 CVE
Important: oci-add-hooks security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire re…
first Sep 14, 2023 -
HighALAS2023-2023-346 2 CVEs
Important: amazon-ecr-credential-helper security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29409: Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA…
first Sep 14, 2023 -
HighALAS2023-2023-345 2 CVEs
Important: docker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29409: Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA…
first Sep 14, 2023 -
HighALAS2-2023-2258 1 CVE
Important: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-21890: Buffer Overflow vulnerability in clj_media_size function in devices/gdevclj.c in Artifex Ghostscript 9.50 allows remote attackers to cause a denial of ser…
first Sep 13, 2023 -
HighALAS2-2023-2257 1 CVE
Important: libssh2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-22218: An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory.
first Sep 13, 2023 -
High max 7.1ALAS2-2023-2250 1 CVE
Important: open-vm-tools security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-20900: VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor with man-in-the-middle (MITM) network positioning between vCenter ser…
first Sep 13, 2023 -
HighALAS2-2023-2248 3 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4584: Memory safety bug CVE-2023-4056: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.1…
first Sep 13, 2023 -
High max 9.4ALAS2023-2023-325 3 CVEs
Important: php8.1 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3824: In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insuffici…
first Aug 31, 2023 -
High max 7.5ALAS2023-2023-338 3 CVEs
Important: cni-plugins security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29409: Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA…
first Aug 31, 2023 -
High max 7.5ALAS2023-2023-337 1 CVE
Important: amazon-ecr-credential-helper security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-41723: http2/hpack: avoid quadratic complexity in hpack decoding
first Aug 31, 2023 -
High max 8.2ALAS2023-2023-336 1 CVE
Important: apache-ivy security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-46751: Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy…
first Aug 31, 2023 -
High max 7.5ALAS2023-2023-331 1 CVE
Important: clamav security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-20197: A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to ca…
first Aug 31, 2023 -
High max 9.4ALAS2023-2023-324 2 CVEs
Important: php8.2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3824: In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insuffici…
first Aug 31, 2023 -
High max 7.8ALAS2023-2023-323 1 CVE
Important: rust security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38497: Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did…
first Aug 31, 2023 -
High max 7.5ALAS2023-2023-322 1 CVE
Important: postgresql15 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39417: IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting …
first Aug 31, 2023 -
HighALAS2023-2023-319 1 CVE
Important: python3.9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-40217: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (su…
first Aug 31, 2023 -
HighALAS2023-2023-317 2 CVEs
Important: python3.11 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-41105: An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unex…
first Aug 31, 2023 -
High max 7.5ALAS2-2023-2224 1 CVE
Important: ca-certificates security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-37920: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Cer…
first Aug 31, 2023 -
High max 7.8ALAS2-2023-2223 1 CVE
Important: rust security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38497: Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did no…
first Aug 31, 2023 -
HighALAS2-2023-2222 1 CVE
Important: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-40217: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such …
first Aug 31, 2023 -
High max 7.5ALAS2-2023-2233 1 CVE
Important: clamav security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-20197: A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause…
first Aug 31, 2023 -
High max 7.8ALAS2-2023-2179 4 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3776: A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_inde…
first Aug 3, 2023