2,033 results · Clear filters · Feed
-
Medium max 4.7ALAS2023-2024-707 1 CVE
Moderate: nginx security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-7347: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulti…
first Aug 28, 2024 -
Medium max 9.8ALAS2023-2024-697 2 CVEs
Moderate: containerd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24790: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would …
first Aug 1, 2024 -
Medium max 9.8ALAS2-2024-2618 5 CVEs
Moderate: nerdctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-28180: Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing c…
first Aug 1, 2024 -
Medium max 7.5ALAS2-2024-2627 1 CVE
Moderate: apache-commons-compress security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-36090: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even f…
first Aug 14, 2024 -
Medium max 8.4ALAS2023-2024-705 2 CVEs
Moderate: p7zip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-52169: The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buf…
first Aug 14, 2024 -
Medium max 6.6ALAS2023-2024-704 2 CVEs
Moderate: ruby3.2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-27282: ruby: Arbitrary memory address read vulnerability with Regex search CVE-2024-27281: ruby: RCE vulnerability with .rdoc_options in RDoc
first Aug 14, 2024 -
Medium max 4.3ALAS2023-2024-703 1 CVE
Moderate: tpm2-tss security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-29040: tpm2-tss: arbitrary quote data may go undetected by Fapi_VerifyQuote
first Aug 14, 2024 -
Medium max 7.8ALAS2023-2024-665 8 CVEs
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-42096: In the Linux kernel, the following vulnerability has been resolved: x86: stop playing stack games in profile_pc() CVE-2024-42090: In the Linux kernel, …
first Jul 18, 2024 -
Medium max 8.8ALAS2-2021-1727 7 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-47203: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() CVE-2021-47189: In the Linux…
first Dec 8, 2021 -
Medium max 9.8ALAS2-2024-2621 2 CVEs
Moderate: openssl11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-5535: Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents …
first Aug 9, 2024 -
Medium max 6.1ALAS2-2024-2620 1 CVE
Moderate: python-lxml security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-28957: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Clean…
first Aug 1, 2024 -
Medium max 5.7ALAS2-2024-2617 1 CVE
Moderate: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-6349: A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a h…
first Aug 1, 2024 -
Medium max 7.5ALAS2-2024-2614 2 CVEs
Moderate: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-29511: Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of err…
first Aug 1, 2024 -
Medium max 6.3ALAS2-2024-2612 2 CVEs
Moderate: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-33870: NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=79aef19c685984…
first Aug 1, 2024 -
Medium max 4.4ALAS2-2024-2610 1 CVE
Moderate: vte291 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-37535: GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2…
first Aug 1, 2024 -
Medium max 6.3ALAS2-2024-2609 1 CVE
Moderate: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-37894: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is sus…
first Aug 1, 2024 -
Medium max 9.1ALAS2-2024-2604 1 CVE
Moderate: openssl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-5535: Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents …
first Aug 1, 2024 -
MediumALAS2023-2024-499 1 CVE
Moderate: containerd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39326: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network t…
first Jan 19, 2024 -
MediumALAS2023-2024-701 1 CVE
Moderate: libsndfile security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-33065: Multiple signed integers overflow in function au_read_header in src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c in Libsndfile, a…
first Aug 1, 2024 -
Medium max 7.5ALAS2023-2024-700 3 CVEs
Moderate: nerdctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-28180: Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containin…
first Aug 1, 2024 -
Medium max 7.4ALAS2023-2024-699 1 CVE
Moderate: python3.9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-0397: A defect was discovered in the Python "ssl" module where there is a memory race condition with the ssl.SSLContext methods "cert_store_stats()" and "get_…
first Aug 1, 2024 -
Medium max 6.5ALAS2023-2024-694 3 CVEs
Moderate: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-30261: Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to…
first Aug 1, 2024 -
Medium max 9.1ALAS2023-2024-693 2 CVEs
Moderate: tpm2-tools security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-29039: tpm2-tools: pcr selection value is not compared with the attest CVE-2024-29038: tpm2-tools: arbitrary quote data may go undetected by tpm2_checkquote
first Aug 1, 2024 -
Medium max 8.8ALAS2023-2024-692 5 CVEs
Moderate: ghostscript security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-29511: Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of …
first Aug 1, 2024 -
Medium max 6.3ALAS2023-2024-691 2 CVEs
Moderate: ghostscript security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-33870: NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=79aef19c685…
first Aug 1, 2024 -
Medium max 4.8ALAS2023-2024-690 1 CVE
Moderate: python-tqdm security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-34062: tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed t…
first Aug 1, 2024 -
Medium max 5.4ALAS2023-2024-689 1 CVE
Moderate: mod_http2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-36387: Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degr…
first Aug 1, 2024 -
Medium max 9.1ALAS2023-2024-688 2 CVEs
Moderate: krb5 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-37371: In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with…
first Aug 1, 2024 -
Medium max 6.3ALAS2023-2024-687 1 CVE
Moderate: squid security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-37894: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is …
first Aug 1, 2024 -
Medium max 6.8ALAS2023-2024-684 1 CVE
Moderate: rapidjson security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-38517: Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjso…
first Aug 1, 2024 -
Medium max 5.9ALAS2023-2024-678 2 CVEs
Moderate: php8.2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-5458: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when val…
first Aug 1, 2024 -
Medium max 9.8ALAS2023-2024-677 3 CVEs
Moderate: openssl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-5535: Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory conten…
first Aug 1, 2024 -
Medium max 7.5ALAS2023-2024-672 1 CVE
Moderate: ecs-init security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45288: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HP…
first Jul 18, 2024 -
Medium max 7.5ALAS2023-2024-666 1 CVE
Moderate: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24791: The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (2…
first Jul 18, 2024 -
Medium max 4.4ALAS2023-2024-660 1 CVE
Moderate: cups security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-35235: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the c…
first Jul 18, 2024 -
Medium max 7.8
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-36971: In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race
first Jul 18, 2024 -
Medium max 9.1ALAS2023-2024-657 1 CVE
Moderate: wget security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-38428: url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data tha…
first Jul 18, 2024 -
Medium max 5.9ALAS2023-2024-654 2 CVEs
Moderate: php8.1 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-5458: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when val…
first Jul 18, 2024 -
Medium max 6.2ALAS2023-2024-653 1 CVE
Moderate: python3.11-setuptools security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-5569: A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when p…
first Jul 18, 2024 -
Medium max 6.7ALAS2023-2024-652 1 CVE
Moderate: nano security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-5742: nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file
first Jul 18, 2024