2,033 results · Clear filters · Feed
-
Medium max 7.5ALAS2-2024-2550 2 CVEs
Moderate: amazon-cloudwatch-agent security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-24786: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling in…
first May 23, 2024 -
Medium max 8.6ALAS2-2024-2546 2 CVEs
Moderate: uriparser security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-34403: An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string. CVE-2024-34402: An iss…
first May 23, 2024 -
Medium max 7.5ALAS2023-2024-625 2 CVEs
Moderate: amazon-cloudwatch-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24786: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling…
first May 23, 2024 -
Medium max 6.5ALAS2023-2024-621 1 CVE
Moderate: libreswan security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-3652: The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES…
first May 23, 2024 -
Medium max 6.0ALAS2023-2024-633 1 CVE
Moderate: fdupes security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-48682: In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink.
first May 23, 2024 -
Medium max 7.5ALAS2023-2024-632 2 CVEs
Moderate: oci-add-hooks security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45288: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HP…
first May 23, 2024 -
Medium max 7.5ALAS2023-2024-631 2 CVEs
Moderate: amazon-ecr-credential-helper security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45288: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HP…
first May 23, 2024 -
Medium max 7.5ALAS2023-2024-630 1 CVE
Moderate: cni-plugins security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45288: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HP…
first May 23, 2024 -
Medium max 7.5ALAS2023-2024-629 6 CVEs
Moderate: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24785: If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/t…
first May 23, 2024 -
Medium max 5.5ALAS2023-2024-628 1 CVE
Moderate: ghostscript security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-52722: An issue was discovered in Artifex Ghostscript through 10.01.0. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standar…
first May 23, 2024 -
Medium max 7.1ALAS2-2021-1636 9 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-46974: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix masking negation logic upon negative dst register CVE-2021-46915: In the Linu…
first May 20, 2021 -
MediumALAS2023-2024-618 1 CVE
Moderate: cni-plugins security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39326: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network t…
first May 9, 2024 -
MediumALAS2023-2024-619 1 CVE
Moderate: ecs-init security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39326: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network t…
first May 9, 2024 -
MediumALAS2-2024-2543 1 CVE
Moderate: cni-plugins security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-39326: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than…
first May 9, 2024 -
Medium max 5.9ALAS2-2024-2539 1 CVE
Moderate: edk2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-2511: Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker ma…
first May 9, 2024 -
Medium max 7.5ALAS2-2023-2056 4 CVEs
Moderate: microcode_ctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-38090: Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentiall…
first May 25, 2023 -
Medium max 9.8ALAS2-2021-1728 8 CVEs
Moderate: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3974: A flaw was found in vim. A possible use-after-free vulnerability could allow an attacker to input a specially crafted file leading to a crash or code execu…
first Dec 8, 2021 -
Medium max 7.5ALAS2023-2024-533 2 CVEs
Moderate: lua security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-33099: An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. CVE-2021-45985: In Lua 5…
first Feb 15, 2024 -
Medium max 5.5ALAS2023-2023-314 2 CVEs
Moderate: libtiff security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-3627: LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing …
first Aug 17, 2023 -
Medium max 7.5ALAS2023-2023-189 4 CVEs
Moderate: microcode_ctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-38090: Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potenti…
first May 25, 2023 -
Medium max 7.3ALAS2023-2024-607 2 CVEs
Moderate: httpd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24795: HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applicatio…
-
Medium max 6.5ALAS2023-2024-606 1 CVE
Moderate: curl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46218: This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or pos…
-
Medium max 6.2ALAS2023-2024-605 1 CVE
Moderate: python3.9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulne…
-
Medium max 8.6ALAS2023-2024-596 2 CVEs
Moderate: curl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-2398: When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed li…
-
Medium max 5.3ALAS2023-2024-591 2 CVEs
Moderate: gnutls security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-28835: A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "cer…
-
Medium max 7.8ALAS2023-2024-590 1 CVE
Moderate: wireshark security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-2955: T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file
-
MediumALAS2-2024-2534 1 CVE
Moderate: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-31810: An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::…
-
Medium max 7.3ALAS2-2024-2532 2 CVEs
Moderate: httpd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-24795: HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications …
-
Medium max 6.5ALAS2-2024-2531 1 CVE
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-46218: This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possib…
-
Medium max 7.5ALAS2-2024-2529 1 CVE
Moderate: jose security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-50967: latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
-
Medium max 8.6ALAS2-2024-2526 2 CVEs
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-2398: When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit…
-
Medium max 5.7ALAS2-2024-2525 2 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-26602: In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_…
-
Medium max 7.8ALAS2-2024-2522 1 CVE
Moderate: wireshark security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-2955: T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file
-
Medium max 8.2ALAS2-2024-2518 1 CVE
Moderate: flatpak security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-43860: Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the perm…
first Apr 11, 2024 -
Medium max 6.2ALAS2-2024-2515 1 CVE
Moderate: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerab…
first Apr 11, 2024 -
Medium max 6.2ALAS2-2024-2513 3 CVEs
Moderate: libvirt security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-2496: NULL pointer dereference in udevConnectListAllInterfaces() CVE-2024-2494: A flaw was found in the RPC library APIs of libvirt. The RPC server deserializati…
first Apr 11, 2024 -
Medium max 7.5ALAS2-2024-2512 2 CVEs
Moderate: krb5 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-26461: Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. CVE-2024-26458: Kerberos 5 (aka krb5) 1.21.2 co…
first Apr 11, 2024 -
Medium max 6.2ALAS2023-2024-588 1 CVE
Moderate: python3.11 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulne…
first Apr 10, 2024 -
Medium max 6.5ALAS2023-2024-587 1 CVE
Moderate: libreswan security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-2357: The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use…
first Apr 10, 2024 -
Medium max 7.5ALAS2023-2024-586 3 CVEs
Moderate: krb5 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-26462: Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c. CVE-2024-26461: Kerberos 5 (aka krb5) 1.21.2 contains a memor…
first Apr 10, 2024