2,507 results · Clear filters · Feed
-
High max 7.7ALAS2023-2023-206 5 CVEs
Important: samba security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext CVE-2023-0614: Access controlled AD LDAP attributes can be discovered CVE-2023-0225: Samb…
first Jun 5, 2023 -
High max 7.8ALAS2023-2023-204 2 CVEs
Important: byacc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-33642: When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function. CVE-2021-33641: When processing files, malloc stores t…
first Jun 5, 2023 -
High max 9.1ALAS2023-2023-201 1 CVE
Important: libtasn1 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-46848: GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
first Jun 5, 2023 -
High max 8.6ALAS2023-2023-198 5 CVEs
Important: c-ares security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-32067: Denial of Service. Attack Steps: The target resolver sends a query The attacker forges a malformed UDP packet with a length of 0 and returns them to th…
first Jun 5, 2023 -
High max 7.8ALAS2023-2023-194 2 CVEs
Important: vim security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2610: Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. CVE-2023-2609: NULL Pointer Dereference in GitHub repository vim/vim prio…
first Jun 5, 2023 -
High max 7.8ALAS2023-2023-191 1 CVE
Important: sysstat security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-33204: sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for…
first Jun 5, 2023 -
High max 5.3ALAS2023-2023-185 1 CVE
Important: libwebp security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1999: A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.
first May 25, 2023 -
High max 7.5ALAS2023-2023-183 1 CVE
Important: python-flask security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-30861: Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client…
first May 25, 2023 -
High max 8.1ALAS2023-2023-182 1 CVE
Important: perl-CPAN security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-31484: HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in t…
first May 25, 2023 -
High max 8.8ALAS2-2022-1881 2 CVEs
Important: bluez security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-39177: A vulnerability was found in BlueZ. This flaw allows physically proximate attackers to cause a denial of service due to malformed and invalid capabilities…
first Dec 1, 2022 -
HighALAS2-2023-2066 1 CVE
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-10003: Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mist…
first May 25, 2023 -
HighALAS2-2023-2065 2 CVEs
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-18676: An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Deni…
first May 25, 2023 -
HighALAS2-2023-2063 1 CVE
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14058: An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate valid…
first May 25, 2023 -
HighALAS2-2023-2062 1 CVE
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-8517: An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write t…
first May 25, 2023 -
High max 5.9ALAS2-2023-2053 1 CVE
Important: jettison security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1436: An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This …
first May 25, 2023 -
High max 7.3ALAS2-2023-2052 1 CVE
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-24539: html/template: improper sanitization of CSS values Angle brackets (<>) were not considered dangerous characters when inserted into CSS contexts. Templates…
first May 25, 2023 -
High max 8.8ALAS2-2023-2051 7 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32215: Mozilla developers and community members reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of …
first May 25, 2023 -
High max 7.8ALAS2-2023-2050 1 CVE
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32233: In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and writ…
first May 25, 2023 -
High max 8.1ALAS2023-2023-178 1 CVE
Important: perl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-31484: HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in t…
first May 11, 2023 -
High max 8.1ALAS2-2023-2034 1 CVE
Important: perl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-31484: HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to v…
first May 11, 2023 -
High max 9.8ALAS2-2023-2041 1 CVE
Important: libksba security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-47629: Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.
first May 11, 2023 -
High max 6.3ALAS2-2023-2040 2 CVEs
Important: wireshark security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0417: Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file …
first May 11, 2023 -
High max 7.4ALAS2-2023-2038 7 CVEs
Important: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-21968: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affec…
first May 11, 2023 -
High max 7.5ALAS2-2023-2037 1 CVE
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-24534: HTTP and MIME header parsing could allocate large amounts of memory, even when parsing small inputs. Certain unusual patterns of input data could cause th…
first May 11, 2023 -
HighALAS2-2023-2044 1 CVE
Important: gd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-40145: ** DISPUTED ** gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 i…
first May 11, 2023 -
High max 8.1ALAS2-2023-2042 1 CVE
Important: samba security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-38023: Netlogon RPC Elevation of Privilege Vulnerability.
first May 11, 2023 -
HighALAS2-2023-2049 2 CVEs
Important: glib2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-16429: GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str(). CVE-2018-16428: In GNOME …
first May 11, 2023 -
High max 7.5ALAS2-2023-2047 3 CVEs
Important: tomcat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-13935: A flaw was found in Apache Tomcat, where the payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an inf…
first May 11, 2023 -
High max 7.5ALAS2-2023-2020 2 CVEs
Important: tomcat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28708: When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies…
first Apr 27, 2023 -
High max 7.5ALAS2023-2023-046 17 CVEs
Important: golist security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-41716: Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, inva…
first Feb 17, 2023 -
High max 7.5ALAS2023-2023-047 14 CVEs
Important: golang-github-cpuguy83-md2man security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a…
first Feb 17, 2023 -
High max 7.5ALAS2-2022-1865 15 CVEs
Important: golang-github-syndtr-gocapability security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1864 15 CVEs
Important: golang-github-kr-pty security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1863 15 CVEs
Important: go-rpm-macros security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1862 15 CVEs
Important: golang-googlecode-sqlite security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1861 15 CVEs
Important: golang-googlecode-net security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1860 15 CVEs
Important: golang-github-gorilla-mux security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1859 15 CVEs
Important: golang-github-gorilla-context security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1858 15 CVEs
Important: golang-github-godbus-dbus security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1847 14 CVEs
Important: golist security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Sep 15, 2022