2,507 results · Clear filters · Feed
-
HighALAS2-2020-1490 3 CVEs
Important: httpd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-9490: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the …
first Sep 15, 2020 -
HighALAS2-2020-1489 3 CVEs
Important: dovecot security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-12674: In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. 1866317: CVE-202…
first Sep 15, 2020 -
High max 6.7ALAS2-2020-1488 1 CVE
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14386: 99999:
first Sep 3, 2020 -
HighALAS2-2020-1487 4 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-6514: Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit h…
first Sep 1, 2020 -
High max 7.7ALAS2-2020-1482 1 CVE
Important: postgresql-jdbc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-13692: PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. 1852985: CVE-2020-13692 postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML
first Sep 1, 2020 -
High max 8.8ALAS2-2020-1466 6 CVEs
Important: libxml2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-14567: libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEML…
-
HighALAS2-2020-1462 4 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-12410: Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we …
first Jul 14, 2020 -
HighALAS2-2020-1463 1 CVE
Important: unbound security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-10772: An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable versions of Unbo…
first Jul 14, 2020 -
High max 7.0ALAS2-2020-1449 1 CVE
Important: tomcat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-9484: When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the…
first Jun 26, 2020 -
HighALAS2-2020-1448 4 CVEs
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-11945: An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are oth…
first Jun 26, 2020 -
High max 3.7ALAS2-2020-1445 1 CVE
Important: nghttp2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-11080: In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a maliciou…
first Jun 26, 2020 -
HighALAS2-2020-1439 1 CVE
Important: zsh security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-20044: In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, s…
first Jun 16, 2020 -
HighALAS2-2020-1434 1 CVE
Important: fribidi security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-18397: A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a d…
-
High max 7.5ALAS2-2020-1431 5 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-1749: A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted …
first Jun 1, 2020 -
HighALAS2-2020-1430 2 CVEs
Important: unbound security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-12663: No description is available for this CVE. 99999: CVE-2020-12663 unbound: infinite loop via malformed DNS answers received from upstream servers CVE-2020-1…
first May 19, 2020 -
High max 9.8ALAS2-2020-1428 2 CVEs
Important: python-twisted-web security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-10109: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the…
first May 19, 2020 -
High max 8.6ALAS2-2020-1426 2 CVEs
Important: bind security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-8617: An assertion failure was found in BIND, which checks the validity of messages containing TSIG resource records. This flaw allows an attacker that knows or …
first May 19, 2020 -
High max 8.3ALAS2-2020-1424 8 CVEs
Important: java-1.7.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-2830: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251,…
first May 8, 2020 -
High max 8.8ALAS2-2020-1423 2 CVEs
Important: ipa security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-14867: A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal fun…
first May 8, 2020 -
High max 5.9ALAS2-2020-1425 1 CVE
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-10711: 99999:
first May 11, 2020 -
High max 8.3ALAS2-2020-1421 10 CVEs
Important: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-2830: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251,…
first May 5, 2020 -
High max 4.0ALAS2-2020-1416 1 CVE
Important: git security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-11008: Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is…
first May 5, 2020 -
HighALAS2-2020-1418 1 CVE
Important: icu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow…
first May 5, 2020 -
HighALAS2-2020-1417 1 CVE
Important: http-parser security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-15605: HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed 1800364: CVE-2019-15605 nodejs: HTT…
first May 5, 2020 -
High max 7.7ALAS2-2020-1420 1 CVE
Important: ipmitool security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-5208: It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to b…
first May 5, 2020 -
HighALAS2-2020-1422 1 CVE
Important: telnet security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-10188: utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer …
first May 5, 2020 -
High max 9.8ALAS2-2020-1412 2 CVEs
Important: python-pillow security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-5312: libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. 1789533: CVE-2020-5312 python-pillow: improperly restricted operations on m…
first Apr 20, 2020 -
High max 8.8ALAS2-2020-1411 1 CVE
Important: libvncserver security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-15690: No description is available for this CVE. 1811948: CVE-2019-15690 libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overfl…
first Apr 20, 2020 -
HighALAS2-2020-1415 1 CVE
Important: xerces-c security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1311: The Apache Xerces-C 3.0.0 to 3.2.2 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addres…
first Apr 20, 2020 -
HighALAS2-2020-1414 7 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-6814: Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we pres…
first Apr 20, 2020 -
High max 8.3ALAS2-2020-1410 13 CVEs
Important: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-2830: No description is available for this CVE. 99999: CVE-2020-2830 OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) CVE-2020-2816: A flaw was …
first Apr 14, 2020 -
High max 9.3ALAS2-2020-1409 1 CVE
Important: git security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-5260: With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a wrong host. The attack…
first Apr 13, 2020 -
HighALAS2-2020-1408 6 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-6800: Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memo…
first Mar 23, 2020 -
High max 7.7ALAS2-2020-1407 2 CVEs
Important: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-7039: tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-ba…
first Mar 23, 2020 -
HighALAS2-2020-1406 2 CVEs
Important: openssl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-1563: In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large n…
first Mar 23, 2020 -
HighALAS2-2019-1371 9 CVEs
Important: git security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-19604: Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 b…
first Dec 13, 2019 -
HighALAS2-2020-1404 1 CVE
Important: sudo security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-18634: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedba…
first Mar 16, 2020 -
High max 8.1ALAS2-2020-1403 7 CVEs
Important: java-1.7.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-2659: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 a…
first Mar 16, 2020 -
HighALAS2-2020-1399 2 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-20096: In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service, aka CID-1d3ff0950e2b…
first Mar 2, 2020 -
High max 9.8ALAS2-2020-1400 1 CVE
Important: ppp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-8597: eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions. 1800727: CVE-2020-8597 ppp: Buffer…
first Mar 2, 2020