Source

Amazon Linux Security Center (ALAS)

Source: https://alas.aws.amazon.com/

All Critical High Medium Low With exploited CVEs

2,033 results · Clear filters · Feed

Medium max 4.3

ALAS2023-2025-1302 1 CVE

Moderate: rsync security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-10158: A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array inde…

Dec 8, 2025
Medium max 3.3

ALAS2023-2025-1301 1 CVE

Moderate: binutils security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-11412: A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Lin…

Dec 8, 2025
Medium max 5.9

ALAS2023-2025-1300 2 CVEs

Moderate: postgresql17 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-12818: Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersi…

Dec 8, 2025
Medium max 5.9

ALAS2023-2025-1299 1 CVE

Moderate: libpq security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-12818: Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersi…

Dec 8, 2025
Medium max 1.8

ALAS2023-2025-1296 2 CVEs

Moderate: exiv2 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-55304: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was fou…

Dec 8, 2025
Medium max 5.9

ALAS2023-2025-1292 1 CVE

Moderate: fetchmail security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-61962: In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.

Dec 8, 2025
Medium max 4.0

ALAS2023-2025-1291 3 CVEs

Moderate: cups-filters security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-64524: cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In…

Dec 8, 2025
Medium max 5.7

ALAS2-2025-3095 1 CVE

Moderate: unbound security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-11411: NLnet Labs Unbound up to and including version 1.24.0 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS …

Dec 8, 2025
Medium max 8.6

ALAS2-2025-3093 1 CVE

Moderate: bind security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-40778: Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issu…

Dec 8, 2025
Medium max 4.6

ALAS2-2025-3088 1 CVE

Moderate: curl security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-11563: wcurl path traversal with percent-encoded slashes URLs containing percent-encoded slashes (/ or \) can trick wcurl into saving the output file outside of …

Dec 8, 2025
Medium max 7.5

ALAS2-2025-3087 1 CVE

Moderate: audiofile security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-50950: Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.

Dec 8, 2025
Medium max 1.8

ALAS2-2025-3086 2 CVEs

Moderate: exiv2 security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-55304: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found …

Dec 8, 2025
Medium max 5.5

ALAS2-2025-3083 1 CVE

Moderate: python-ldap security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-61911: python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.esca…

Dec 8, 2025
Medium max 4.0

ALAS2-2025-3082 3 CVEs

Moderate: cups-filters security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-64524: cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In ve…

Dec 8, 2025
Medium max 5.3

ALAS2-2025-3074 1 CVE

Moderate: qt5-qt3d security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-11277: A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/As…

Nov 10, 2025
Medium max 7.5

ALAS2-2025-3072 2 CVEs

Moderate: java-1.8.0-openjdk security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-53066: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported vers…

Nov 10, 2025
Medium max 5.3

ALAS2-2025-3067 1 CVE

Moderate: tomcat security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-61795: Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipa…

Nov 10, 2025
Medium max 6.5

ALAS2-2025-3063 1 CVE

Moderate: fontforge security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-50949: FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.

Nov 10, 2025
Medium max 5.3

ALAS2-2025-3060 1 CVE

Moderate: nerdctl security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-11065: go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data

Nov 10, 2025
Medium max 5.5

ALAS2-2025-3058 1 CVE

Moderate: python-ldap security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-61912: python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 in…

Nov 10, 2025
Medium max 7.8

ALAS2-2025-3057 1 CVE

Moderate: pam security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-8941: A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and ra…

Nov 10, 2025
Medium

ALAS2023-2025-1282 1 CVE

Moderate: kernel security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-40019: In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption

Nov 10, 2025
Medium max 4.7

ALAS2023-2025-1264 2 CVEs

Moderate: libssh security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-8277: A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free me…

Nov 10, 2025
Medium max 6.5

ALAS2023-2025-1262 1 CVE

Moderate: fontforge security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-50949: FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.

Nov 10, 2025
Medium max 7.8

ALAS2023-2025-1261 1 CVE

Moderate: wireshark security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-5601: Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 allows denial of service via packet injection or crafted capture file

Nov 10, 2025
Medium max 5.3

ALAS2023-2025-1259 1 CVE

Moderate: nerdctl security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-11065: go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data

Nov 10, 2025
Medium max 7.8

ALAS2023-2025-1257 1 CVE

Moderate: pam security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-8941: A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and…

Nov 10, 2025
Medium max 6.8

ALAS2023-2023-230 6 CVEs

Moderate: libtiff security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-30774: A vulnerability was found in libtiff library. This security flaw causes a heap buffer overflow issue via TIFFTAG_INKNAMES and TIFFTAG_NUMBEROFINKS valu…

Nov 5, 2025
first Jun 21, 2023
Medium max 5.6

ALAS2023-2025-966 2 CVEs

Moderate: nodejs22 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-52099: Integer Overflow vulnerability in SQLite SQLite3 v.3.50.0 allows a remote attacker to cause a denial of service via the setupLookaside function CVE-202…

Oct 29, 2025
first May 7, 2025
Medium max 7.5

ALAS2-2025-3048 2 CVEs

Moderate: java-11-amazon-corretto security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-53066: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported vers…

Oct 27, 2025
Medium max 7.5

ALAS2-2025-3047 2 CVEs

Moderate: java-17-amazon-corretto security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-53066: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported vers…

Oct 27, 2025
Medium max 4.3

ALAS2-2025-3041 1 CVE

Moderate: python3 security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-8291: The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the …

Oct 27, 2025
Medium max 5.9

ALAS2-2025-3040 1 CVE

Moderate: glibc security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-8058: The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished ei…

Oct 27, 2025
Medium max 7.5

ALAS2023-2025-1244 2 CVEs

Moderate: java-1.8.0-amazon-corretto security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-53066: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported v…

Oct 27, 2025
Medium max 7.5

ALAS2023-2025-1243 2 CVEs

Moderate: java-11-amazon-corretto security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-53066: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported v…

Oct 27, 2025
Medium max 7.5

ALAS2023-2025-1242 2 CVEs

Moderate: java-17-amazon-corretto security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-53066: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported v…

Oct 27, 2025
Medium max 7.5

ALAS2023-2025-1241 3 CVEs

Moderate: java-21-amazon-corretto security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-61748: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Suppor…

Oct 27, 2025
Medium max 7.5

ALAS2023-2025-1240 3 CVEs

Moderate: java-25-amazon-corretto security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-61748: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Suppor…

Oct 27, 2025
Medium max 4.3

ALAS2023-2025-1237 1 CVE

Moderate: python3.9 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-8291: The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate t…

Oct 27, 2025
Medium max 4.3

ALAS2023-2025-1236 1 CVE

Moderate: python3.11 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-8291: The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate t…

Oct 27, 2025