2,507 results · Clear filters · Feed
-
High max 9.8ALAS2023-2023-162 1 CVE
Important: ghostscript security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28879: In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in b…
first Apr 27, 2023 -
High max 7.4ALAS2023-2023-168 7 CVEs
Important: java-1.8.0-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-21968: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are af…
first Apr 27, 2023 -
High max 7.4ALAS2023-2023-167 7 CVEs
Important: java-11-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-21968: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are af…
first Apr 27, 2023 -
High max 7.4ALAS2023-2023-166 7 CVEs
Important: java-17-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-21968: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are af…
first Apr 27, 2023 -
High max 8.2ALAS2023-2023-165 6 CVEs
Important: ecs-service-connect-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-27496: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, th…
first Apr 27, 2023 -
High max 9.1ALAS2023-2023-174 2 CVEs
Important: apache-ivy security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-37866: When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include place…
first Apr 27, 2023 -
HighALAS2023-2023-172 1 CVE
Important: nasm security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-44370: NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
first Apr 27, 2023 -
High max 7.4ALAS2023-2023-171 1 CVE
Important: gnutls security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-0361: A timing side-channel vulnerability was found in RSA ClientKeyExchange messages in GnuTLS. This side-channel may be sufficient to recover the key encryp…
first Apr 27, 2023 -
HighALAS2023-2023-177 1 CVE
Important: openldap security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-27212: In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion ... NOTE: https://bugs.openldap.org/show_bug.cgi?id=9454 NOTE: trunk: https://git…
first Apr 27, 2023 -
High max 7.5ALAS2023-2023-176 3 CVEs
Important: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28708: When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cook…
first Apr 27, 2023 -
High max 9.8ALAS2023-2023-175 15 CVEs
Important: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-24538: Templates did not properly consider backticks (`) as Javascript string delimiters, and as such did not escape them as expected. Backticks are used, sin…
first Apr 27, 2023 -
HighALAS2-2023-2033 11 CVEs
Important: openldap security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-27212: In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion ... NOTE: https://bugs.openldap.org/show_bug.cgi?id=9454 NOTE: trunk: https://git.op…
first Apr 27, 2023 -
High max 5.3ALAS2-2023-2030 1 CVE
Important: xstream security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-21342: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed strea…
first Apr 27, 2023 -
HighALAS2-2023-2029 1 CVE
Important: nasm security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-44370: NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
first Apr 27, 2023 -
High max 7.4ALAS2-2023-2026 7 CVEs
Important: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-21968: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affec…
first Apr 27, 2023 -
High max 7.4ALAS2-2023-2025 7 CVEs
Important: java-17-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-21968: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affec…
first Apr 27, 2023 -
High max 9.8ALAS2-2023-2019 1 CVE
Important: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28879: In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base…
first Apr 27, 2023 -
High max 6.5ALAS2023-2023-155 5 CVEs
Important: mariadb105 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-47015: MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereferenc…
first Mar 30, 2023 -
HighALAS2-2023-2018 6 CVEs
Important: jasper security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3467: A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder…
first Apr 13, 2023 -
HighALAS2-2023-2016 1 CVE
Important: pki-core security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-2414: Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially ret…
first Apr 13, 2023 -
High max 7.5ALAS2-2023-2013 3 CVEs
Important: liblouis security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-26769: Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a denial of service via the resolveSubtable function …
first Apr 13, 2023 -
High max 7.8ALAS2-2023-2012 1 CVE
Important: emacs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28617: org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory…
first Apr 13, 2023 -
High max 7.5ALAS2023-2023-161 8 CVEs
Important: bind security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-3924: This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a…
first Apr 13, 2023 -
High max 7.5ALAS2023-2023-158 2 CVEs
Important: ruby3.2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28756: A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific char…
first Apr 13, 2023 -
High max 8.2ALAS2-2023-2007 1 CVE
Important: xstream security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41966: XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack over…
first Mar 30, 2023 -
High max 7.8ALAS2-2023-2004 1 CVE
Important: systemd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-26604: systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemct…
first Mar 30, 2023 -
High max 5.5ALAS2023-2023-153 1 CVE
Important: tar security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-48303: GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the f…
first Mar 30, 2023 -
High max 7.8ALAS2023-2023-147 1 CVE
Important: emacs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28617: org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or direct…
first Mar 30, 2023 -
High max 7.5ALAS2023-2023-142 1 CVE
Important: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-41723: http2/hpack: avoid quadratic complexity in hpack decoding
first Mar 20, 2023 -
High max 7.7ALAS2023-2023-139 3 CVEs
Important: php8.1 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-0662: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumptio…
first Mar 20, 2023 -
High max 7.8ALAS2023-2023-134 2 CVEs
Important: emacs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-27986: emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quo…
first Mar 20, 2023 -
High max 9.8ALAS2023-2023-136 2 CVEs
Important: httpd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-27522: HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Spe…
first Mar 20, 2023 -
High max 7.5ALAS2023-2023-140 1 CVE
Important: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-42252: If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via set…
first Mar 20, 2023 -
HighALAS2023-2023-141 1 CVE
Important: device-mapper-multipath security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-41974: multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Lo…
first Mar 20, 2023 -
High max 9.8ALAS2023-2023-146 11 CVEs
Important: python-pillow security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-45199: Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. CVE-2022-45198: Pillow before 9.2.0 performs Improper Handling of Highly Compressed G…
first Mar 20, 2023 -
High max 7.5ALAS2-2023-2001 4 CVEs
Important: bind security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-38178: By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradu…
first Mar 17, 2023 -
High max 8.8ALAS2-2023-1995 1 CVE
Important: sssd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-4254: A vulnerability was found in SSSD, in the libsss_certmap functionality. PKINIT enables a client to authenticate to the KDC using an X.509 certificate and t…
first Mar 17, 2023 -
High max 5.5ALAS2-2023-1994 1 CVE
Important: tar security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-48303: GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow…
first Mar 17, 2023 -
High max 8.8ALAS2-2023-1992 1 CVE
Important: nss security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0767: firefox-esr , thunderbird and nss only are affected by this package.
first Mar 17, 2023 -
High max 9.8ALAS2-2023-1989 2 CVEs
Important: httpd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-27522: HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Specia…
first Mar 17, 2023