2,033 results · Clear filters · Feed
-
Medium max 7.5ALAS2-2024-2598 1 CVE
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-24791: The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 …
first Jul 18, 2024 -
Medium max 6.5ALAS2-2024-2596 1 CVE
Moderate: libreswan security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-3652: The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GM…
first Jul 18, 2024 -
Medium max 9.1ALAS2-2024-2595 2 CVEs
Moderate: krb5 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-37371: In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with in…
first Jul 18, 2024 -
Medium max 9.1ALAS2-2024-2591 1 CVE
Moderate: edk2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-5535: Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents …
first Jul 18, 2024 -
Medium max 6.7ALAS2-2024-2590 1 CVE
Moderate: nano security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-5742: nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file
first Jul 18, 2024 -
Medium max 5.5ALAS2023-2023-371 2 CVEs
Moderate: poppler security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-34872: A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted PDF file i…
first Sep 27, 2023 -
Medium max 7.5ALAS2-2024-2587 1 CVE
Moderate: harfbuzz security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-25193: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for …
first Jul 3, 2024 -
Medium max 7.8ALAS2-2024-2584 4 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-35809: In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal CVE-2024-26642: In the Linu…
first Jul 3, 2024 -
Medium max 7.8ALAS2023-2024-639 3 CVEs
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-35995: In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Use access_width over bit_width for system memory accesses CVE-2024-269…
first Jun 6, 2024 -
Medium max 9.8ALAS2023-2024-585 13 CVEs
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-36031: In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation CVE-2024-35809: In the Linux…
first Apr 10, 2024 -
Medium max 7.5ALAS2-2024-2580 1 CVE
Moderate: dnsmasq security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-49441: dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.
first Jun 19, 2024 -
Medium max 5.3ALAS2-2024-2579 1 CVE
Moderate: iperf3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-7250: It is possible for a malicious or malfunctioning client to send less than the expected amount of data to the server. If this happens, the server will hang …
first Jun 19, 2024 -
Medium max 6.0ALAS2-2024-2578 1 CVE
Moderate: edk2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-1298: EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A succes…
first Jun 19, 2024 -
Medium max 7.5
Moderate: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-27834: The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, macOS Sonoma 14.5. An…
first Jun 19, 2024 -
Medium max 9.8ALAS2-2024-2576 2 CVEs
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-24790: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would ret…
first Jun 19, 2024 -
Medium max 5.4ALAS2-2024-2574 1 CVE
Moderate: python-jinja2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-34064: Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML at…
first Jun 19, 2024 -
Medium max 5.4ALAS2-2024-2573 1 CVE
Moderate: python3-jinja2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-34064: Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML at…
first Jun 19, 2024 -
Medium max 7.1ALAS2023-2024-648 1 CVE
Moderate: sssd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3758: A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorizatio…
first Jun 19, 2024 -
Medium max 9.8ALAS2023-2024-646 2 CVEs
Moderate: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24790: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would …
first Jun 19, 2024 -
Medium max 5.4ALAS2023-2024-645 1 CVE
Moderate: python-jinja2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-34064: Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML…
first Jun 19, 2024 -
Medium max 5.4ALAS2023-2024-644 1 CVE
Moderate: ansible-core security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-34064: Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML…
first Jun 19, 2024 -
MediumALAS2-2024-2570 1 CVE
Moderate: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-32066: An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with …
first Jun 6, 2024 -
Medium max 7.5ALAS2-2024-2568 2 CVEs
Moderate: cri-tools security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-24786: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling in…
first Jun 6, 2024 -
Medium max 5.6ALAS2-2024-2566 1 CVE
Moderate: opensc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5992: A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the pote…
first Jun 6, 2024 -
Medium max 7.8ALAS2-2024-2565 1 CVE
Moderate: unixODBC security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-1013: An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go u…
first Jun 6, 2024 -
Medium max 5.9ALAS2-2024-2564 1 CVE
Moderate: openssl11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-2511: Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker ma…
first Jun 6, 2024 -
Medium max 7.5ALAS2-2024-2563 1 CVE
Moderate: freerdp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-32661: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `NULL` access a…
first Jun 6, 2024 -
MediumALAS2023-2024-642 1 CVE
Moderate: nasm security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38665: Null pointer dereference in ieee_write_file in nasm 2.16rc0 allows attackers to cause a denial of service (crash).
first Jun 6, 2024 -
Medium max 7.8ALAS2023-2024-641 1 CVE
Moderate: unixODBC security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-1013: An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may g…
first Jun 6, 2024 -
Medium max 5.9ALAS2023-2024-640 1 CVE
Moderate: openssl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-2511: Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker…
first Jun 6, 2024 -
Medium max 7.5ALAS2023-2024-636 2 CVEs
Moderate: bouncycastle security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-34447: An issue was discovered in Bouncy Castle Java Cryptography APIs before BC 1.78. When endpoint identification is enabled in the BCJSSE and an SSL socket…
first Jun 6, 2024 -
Medium max 6.2ALAS2023-2023-379 2 CVEs
Moderate: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5341: A vulnerability was found in ImageMagick where heap use-after-free was found in coders/bmp.c. CVE-2021-20309: A flaw was found in ImageMagick, where a d…
first Oct 12, 2023 -
Medium max 5.5ALAS2023-2023-055 6 CVEs
Moderate: microcode_ctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-21233: A flaw was found in hw. The APIC can operate in xAPIC mode (also known as a legacy mode), in which APIC configuration registers are exposed through a m…
first Feb 17, 2023 -
Medium max 9.8ALAS2-2024-2537 9 CVEs
Moderate: freerdp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-32660: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invali…
first May 9, 2024 -
MediumALAS2-2024-2560 1 CVE
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-19767: The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set…
first May 23, 2024 -
Medium max 5.0ALAS2-2024-2557 1 CVE
Moderate: hsqldb security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1183: A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of t…
first May 23, 2024 -
Medium max 7.5ALAS2-2024-2556 2 CVEs
Moderate: golist security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-45288: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK…
first May 23, 2024 -
Medium max 7.5ALAS2-2024-2555 1 CVE
Moderate: cni-plugins security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-45288: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK…
first May 23, 2024 -
Medium max 7.5ALAS2-2024-2554 6 CVEs
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-24785: If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/temp…
first May 23, 2024 -
Medium max 5.5ALAS2-2024-2553 1 CVE
Moderate: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-52722: An issue was discovered in Artifex Ghostscript through 10.01.0. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard.
first May 23, 2024