2,507 results · Clear filters · Feed
-
HighALAS2-2023-2208 2 CVEs
Important: cni-plugins security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29409: Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA ke…
first Aug 17, 2023 -
High max 7.5ALAS2023-2023-316 5 CVEs
Important: samba security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-34968: Spotlight server-side Share Path Disclosure NOTE: https://www.samba.org/samba/security/CVE-2023-34968.html CVE-2023-34967: Samba Spotlight mdssvc RPC R…
first Aug 17, 2023 -
High max 7.5ALAS2023-2023-313 2 CVEs
Important: nerdctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire re…
first Aug 17, 2023 -
High max 7.8ALAS2023-2023-312 2 CVEs
Important: containerd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire re…
first Aug 17, 2023 -
HighALAS2023-2023-311 1 CVE
Important: runc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire re…
first Aug 17, 2023 -
High max 9.8ALAS2023-2023-304 3 CVEs
Important: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-32559: The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.…
first Aug 17, 2023 -
High max 8.1ALAS2023-2023-302 1 CVE
Important: dotnet6.0 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-33170: ASP.NET and Visual Studio Security Feature Bypass Vulnerability
first Aug 17, 2023 -
High max 8.6ALAS2023-2023-300 5 CVEs
Important: ecs-service-connect-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-35945: Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receivin…
first Aug 17, 2023 -
High max 6.5ALAS2023-2023-298 1 CVE
Important: libtiff security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3618: A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libti…
first Aug 17, 2023 -
High max 7.5ALAS2023-2023-297 1 CVE
Important: ca-certificates security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-37920: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. …
first Aug 17, 2023 -
HighALAS2023-2023-295 1 CVE
Important: librsvg2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38633: A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local fi…
first Aug 17, 2023 -
HighALAS2023-2023-294 1 CVE
Important: libqb security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39976: log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.
first Aug 17, 2023 -
High max 7.0ALAS2023-2023-291 1 CVE
Important: redis6 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-24834: A heap-based buffer overflow flaw was found in Redis. This flaw allows an attacker to trick an authenticated user into executing a specially crafted Lu…
first Aug 3, 2023 -
High max 7.5ALAS2023-2023-290 2 CVEs
Important: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-35945: Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receivin…
first Aug 3, 2023 -
HighALAS2023-2023-283 1 CVE
Important: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire re…
first Aug 3, 2023 -
High max 7.5ALAS2023-2023-281 1 CVE
Important: ca-certificates security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-32803: An initial fix in Amazon Linux ca-certificates package relating to CVE-2022-23491 did not properly remove root certificates from TrustCor from the root…
first Aug 3, 2023 -
High max 7.5ALAS2023-2023-278 1 CVE
Important: nghttp2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-35945: Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receivin…
first Aug 3, 2023 -
HighALAS2023-2023-276 1 CVE
Important: ghostscript security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-36664: Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
first Aug 3, 2023 -
HighALAS2023-2023-274 1 CVE
Important: iperf3 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38403: iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.
first Aug 3, 2023 -
High max 9.8ALAS2023-2023-273 1 CVE
Important: openssh security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38408: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if the target …
first Aug 3, 2023 -
High max 7.5ALAS2-2023-2203 1 CVE
Important: ca-certificates security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32803: An initial fix in Amazon Linux ca-certificates package relating to CVE-2022-23491 did not properly remove root certificates from TrustCor from the root st…
first Aug 3, 2023 -
HighALAS2-2023-2186 1 CVE
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire reque…
first Aug 3, 2023 -
HighALAS2-2023-2185 1 CVE
Important: golist security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire reque…
first Aug 3, 2023 -
High max 7.5ALAS2-2023-2180 1 CVE
Important: nghttp2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-35945: Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `…
first Aug 3, 2023 -
High max 8.8
Important: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-37450: A vulnerability was found in webkitgtk. This issue occurs when processing web content, which may lead to arbitrary code execution.
first Aug 3, 2023 -
High max 9.8ALAS2-2023-2176 1 CVE
Important: openssh security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38408: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if the target use…
first Aug 3, 2023 -
High max 7.5ALAS2-2023-2194 2 CVEs
Important: cri-tools security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire reque…
first Aug 3, 2023 -
High max 7.5ALAS2-2023-2193 2 CVEs
Important: nerdctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire reque…
first Aug 3, 2023 -
High max 7.5ALAS2-2023-2192 1 CVE
Important: cni-plugins security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41723: http2/hpack: avoid quadratic complexity in hpack decoding
first Aug 3, 2023 -
High max 9.8ALAS2023-2023-269 4 CVEs
Important: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29405: The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any…
first Jul 19, 2023 -
High max 7.6ALAS2-2023-2155 1 CVE
Important: gstreamer1-plugins-good security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-37327: Integer overflow leading to heap overwrite in FLAC image tag handling
first Jul 20, 2023 -
High max 7.6ALAS2-2023-2154 1 CVE
Important: gstreamer1-plugins-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-37327: Integer overflow leading to heap overwrite in FLAC image tag handling
first Jul 20, 2023 -
HighALAS2-2023-2153 1 CVE
Important: iperf3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38403: iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.
first Jul 20, 2023 -
High max 9.8ALAS2-2023-2163 10 CVEs
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29405: The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any ot…
first Jul 20, 2023 -
HighALAS2-2023-2156 5 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-37211: Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we pres…
first Jul 20, 2023 -
High max 7.5ALAS2-2023-2165 1 CVE
Important: apache-ivy security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-37866: When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placehol…
first Jul 20, 2023 -
High max 7.8ALAS2023-2023-242 7 CVEs
Important: dotnet6.0 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-33135: .NET and Visual Studio Elevation of Privilege Vulnerability CVE-2023-32032: .NET and Visual Studio Elevation of Privilege Vulnerability CVE-2023-29337:…
first Jul 5, 2023 -
High max 7.2ALAS2023-2023-241 1 CVE
Important: postgresql15 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2454: This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. Database owners have that right by…
first Jul 5, 2023 -
High max 7.5ALAS2023-2023-240 2 CVEs
Important: bind security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2911: If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a…
first Jul 5, 2023 -
High max 7.5ALAS2023-2023-238 1 CVE
Important: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28709: The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-def…
first Jul 5, 2023