2,033 results · Clear filters · Feed
-
Medium max 6.5ALAS2023-2024-492 1 CVE
Moderate: nss security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5388: It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are…
first Jan 19, 2024 -
MediumALAS2-2024-2431 1 CVE
Moderate: vsftpd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3618: ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates…
first Jan 19, 2024 -
Medium max 6.5ALAS2-2024-2428 1 CVE
Moderate: dbus security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-34969: D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.free…
first Jan 19, 2024 -
Medium max 6.1ALAS2-2024-2426 1 CVE
Moderate: rust security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-40030: Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature name…
first Jan 19, 2024 -
MediumALAS2-2024-2421 1 CVE
Moderate: qt5-qtbase security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-51714: An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. net…
first Jan 19, 2024 -
Medium max 6.5ALAS2-2024-2419 1 CVE
Moderate: nss-softokn security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5388: It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are ze…
first Jan 19, 2024 -
MediumALAS2-2021-1702 4 CVEs
Moderate: gcc10-binutils security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3487: There's a flaw in the BFD library of binutils. An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality…
first Sep 8, 2021 -
MediumALAS2-2021-1683 12 CVEs
Moderate: unbound security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-28935: A symbolic link traversal vulnerability was found in unbound in the way it writes its PID file while starting up. This flaw allows a local attacker with a…
first Jul 1, 2021 -
MediumALAS2-2024-2412 8 CVEs
Moderate: ncurses security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-19190: Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted co…
first Jan 3, 2024 -
Medium max 6.2ALAS2-2024-2392 1 CVE
Moderate: avahi security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38473: A reachable assertion was found in avahi_alternative_host_name.
first Jan 3, 2024 -
Medium max 8.6ALAS2-2024-2381 1 CVE
Moderate: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-49286: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to …
first Jan 3, 2024 -
MediumALAS2-2024-2380 1 CVE
Moderate: ncurses security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-50495: NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().
first Jan 3, 2024 -
Medium max 5.5ALAS2-2024-2389 1 CVE
Moderate: libXpm security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-43786: A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available syst…
first Jan 3, 2024 -
Medium max 5.3ALAS2-2024-2388 3 CVEs
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-45284: path/filepath: recognize device names with trailing spaces and superscripts The IsLocal function did not correctly detect reserved names in some cases: - …
first Jan 3, 2024 -
Medium max 4.2ALAS2-2024-2387 1 CVE
Moderate: python-urllib3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-45803: urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using s…
first Jan 3, 2024 -
Medium max 5.5ALAS2-2024-2398 2 CVEs
Moderate: resteasy-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0482: In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with i…
first Jan 3, 2024 -
Medium max 5.3ALAS2-2024-2397 2 CVEs
Moderate: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-22081: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle J…
first Jan 3, 2024 -
Medium max 7.1ALAS2-2024-2395 1 CVE
Moderate: dmidecode security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-30630: Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plau…
first Jan 3, 2024 -
Medium max 3.5ALAS2-2024-2394 1 CVE
Moderate: jetty security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-36479: Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may h…
first Jan 3, 2024 -
Medium max 6.2ALAS2-2024-2393 1 CVE
Moderate: avahi security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38472: A reachable assertion was found in avahi_rdata_parse.
first Jan 3, 2024 -
Medium max 5.3ALAS2-2024-2408 1 CVE
Moderate: jetty security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-28169: For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protecte…
first Jan 3, 2024 -
Medium max 5.5ALAS2-2024-2407 1 CVE
Moderate: gstreamer-plugins-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3522: A flaw was found in gstreamer-plugins-base where an out-of-bounds read when handling certain ID3v2 tags is possible. The highest threat from this vulnerabi…
first Jan 3, 2024 -
Medium max 6.5ALAS2-2024-2406 1 CVE
Moderate: python-ldap security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-46823: python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression d…
first Jan 3, 2024 -
MediumALAS2-2024-2404 1 CVE
Moderate: libsndfile security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-33065: Multiple signed integers overflow in function au_read_header in src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c in Libsndfile, allo…
first Jan 3, 2024 -
Medium max 6.5ALAS2-2024-2403 2 CVEs
Moderate: snakeyaml security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-38751: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an at…
first Jan 3, 2024 -
Medium max 6.5ALAS2-2024-2402 1 CVE
Moderate: net-snmp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-44793: handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remot…
first Jan 3, 2024 -
Medium max 6.5ALAS2-2024-2401 8 CVEs
Moderate: binutils security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1972: Potential heap based buffer overflow found in _bfd_elf_slurp_version_tables() in bfd/elf.c. CVE-2022-48064: GNU Binutils before 2.40 was discovered to cont…
first Jan 3, 2024 -
MediumALAS2-2024-2400 1 CVE
Moderate: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-48566: An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator v…
first Jan 3, 2024 -
Medium max 8.6ALAS2-2024-2399 3 CVEs
Moderate: c-ares security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-31130: ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares onl…
first Jan 3, 2024 -
Medium max 5.5ALAS2-2024-2413 1 CVE
Moderate: python-pillow security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-9189: Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer O…
first Jan 3, 2024 -
Medium max 8.2ALAS2-2024-2411 1 CVE
Moderate: xmlgraphics-commons security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-11988: Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a …
first Jan 3, 2024 -
Medium max 7.5ALAS2023-2024-471 1 CVE
Moderate: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46589: Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 throug…
first Jan 3, 2024 -
Medium max 5.9ALAS2023-2024-468 1 CVE
Moderate: libssh security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-48795: AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has …
first Jan 3, 2024 -
MediumALAS2023-2024-466 1 CVE
Moderate: ncurses security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-50495: NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().
first Jan 3, 2024 -
Medium max 7.1ALAS2023-2024-465 1 CVE
Moderate: ansible-core security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5764: The upstream bug report describes this issue as follows: A flaw was found in Ansible, where a user's controller is vulnerable to template injection when…
first Jan 3, 2024 -
Medium max 5.9ALAS2023-2024-463 1 CVE
Moderate: gnutls security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5981: A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with c…
first Jan 3, 2024 -
MediumALAS2023-2024-481 1 CVE
Moderate: p7zip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-47069: p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at CPP/7zip/Archiv…
first Jan 3, 2024 -
Medium max 5.5ALAS2023-2024-479 1 CVE
Moderate: bouncycastle security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-33202: Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class…
first Jan 3, 2024 -
Medium max 7.5ALAS2023-2024-478 1 CVE
Moderate: jtidy security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-34623: An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic …
first Jan 3, 2024 -
Medium max 5.3ALAS2023-2024-477 3 CVEs
Moderate: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45284: path/filepath: recognize device names with trailing spaces and superscripts The IsLocal function did not correctly detect reserved names in some cases:…
first Jan 3, 2024