2,033 results · Clear filters · Feed
-
Medium max 6.1ALAS2-2023-2111 1 CVE
Moderate: python3-requests security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32681: A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifi…
first Jul 5, 2023 -
Medium max 6.1ALAS2-2023-2110 1 CVE
Moderate: python-requests security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32681: A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifi…
first Jul 5, 2023 -
Medium max 5.3ALAS2-2023-2109 1 CVE
Moderate: cups security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-34241: A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection has been closed, when …
first Jul 5, 2023 -
Medium max 5.9ALAS2-2023-2126 1 CVE
Moderate: libtiff security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3316: A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/nu…
first Jul 17, 2023 -
Medium max 5.9ALAS2-2023-2125 1 CVE
Moderate: compat-libtiff3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3316: A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/nu…
first Jul 17, 2023 -
Medium max 5.5ALAS2-2023-2124 1 CVE
Moderate: iniparser security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-33461: iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_getstring's retur…
first Jul 17, 2023 -
Medium max 6.2ALAS2-2023-2123 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3428: The upstream bug report describes this issue as follows: "A vulnerability was found in ImageMagick <=7.1.1, where heap-based buffer overflow was found in c…
first Jul 17, 2023 -
Medium max 9.1ALAS2-2023-2119 1 CVE
Moderate: tcpdump security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-15167: The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 3, a different vulnerability than CVE-2018-14…
first Jul 5, 2023 -
MediumALAS2-2023-2129 1 CVE
Moderate: libX11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3138: A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for th…
first Jul 17, 2023 -
MediumALAS2-2023-2128 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3195: stack overflow when parsing malicious tiff image
first Jul 17, 2023 -
Medium max 5.9ALAS2-2023-2135 1 CVE
Moderate: libmicrohttpd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-27371: GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD…
first Jul 17, 2023 -
Medium max 10.0ALAS2-2023-2134 1 CVE
Moderate: flatpak security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28100: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 …
first Jul 17, 2023 -
Medium max 6.1ALAS2-2023-2133 1 CVE
Moderate: python3-tornado security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28370: Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and…
first Jul 17, 2023 -
Medium max 6.1ALAS2-2023-2132 1 CVE
Moderate: python-tornado security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28370: Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and…
first Jul 17, 2023 -
MediumALAS2-2023-2152 4 CVEs
Moderate: squashfs-tools security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-41072: squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem th…
first Jul 17, 2023 -
MediumALAS2-2023-2151 1 CVE
Moderate: python-pip security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14422: A vulnerability was found in the way the ipaddress python module computes hash values in the IPv4Interface and IPv6Interface classes. This flaw allows an …
first Jul 17, 2023 -
Medium max 7.5ALAS2-2023-2150 1 CVE
Moderate: python-rsa security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-25658: A flaw was found in python-rsa, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decr…
first Jul 17, 2023 -
MediumALAS2-2023-2147 1 CVE
Moderate: mc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-36370: An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor d…
first Jul 17, 2023 -
MediumALAS2-2023-2145 1 CVE
Moderate: lynx security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-38165: Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear …
first Jul 17, 2023 -
MediumALAS2-2023-2144 1 CVE
Moderate: libzapojit security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-39360: In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vu…
first Jul 17, 2023 -
Medium max 5.5ALAS2-2023-2142 1 CVE
Moderate: protobuf-c security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-48468: protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.
first Jul 17, 2023 -
Medium max 7.5ALAS2-2023-2140 1 CVE
Moderate: zstd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-4899: In zstd, supplying an empty string as an argument to either --output-dir-flat or --output-dir-mirror may cause a buffer overrun.
first Jul 17, 2023 -
Medium max 7.8ALAS2023-2023-234 1 CVE
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3269: A flaw was found in the handling of stack expansion in the Linux kernel 6.1 through 6.4, aka "Stack Rot". The maple tree, responsible for managing virtu…
first Jun 30, 2023 -
Medium max 5.9ALAS2-2023-2101 1 CVE
Moderate: yajl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-24795: yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which le…
first Jun 21, 2023 -
MediumALAS2-2023-2099 1 CVE
Moderate: qpdf security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-34503: QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerability allows attackers to cause a Deni…
first Jun 21, 2023 -
Medium max 6.5ALAS2-2023-2097 1 CVE
Moderate: openssl11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-2650: Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use O…
first Jun 21, 2023 -
Medium max 7.5ALAS2-2023-2095 1 CVE
Moderate: openldap security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-2953: A vulnerability was found in openldap that can cause a null pointer dereference in the ber_memalloc_x() function.
first Jun 21, 2023 -
Medium max 6.5ALAS2-2023-2092 1 CVE
Moderate: qt5-qtsvg security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32573: In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled.
first Jun 21, 2023 -
Medium max 5.3ALAS2-2023-2091 1 CVE
Moderate: qt5-qtbase security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-34410: An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consi…
first Jun 21, 2023 -
Medium max 5.3ALAS2-2023-2090 1 CVE
Moderate: qt security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-34410: An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consi…
first Jun 21, 2023 -
MediumALAS2-2023-2107 2 CVEs
Moderate: glib2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2015-8394: PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or…
first Jun 21, 2023 -
MediumALAS2-2023-2106 1 CVE
Moderate: flac security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-0561: An out-of-bounds write vulnerability was found in libFlak. The vulnerability occurs due to a missing bounds check. This flaw allows a local attacker withou…
first Jun 21, 2023 -
Medium max 5.5ALAS2-2023-2105 1 CVE
Moderate: python-pillow security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-28675: An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of th…
first Jun 21, 2023 -
MediumALAS2-2023-2104 1 CVE
Moderate: qpdf security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-36978: QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in Pl_ASCII85Decoder::write (called from Pl_AES_PDF::flush and Pl_AES_PDF:…
first Jun 21, 2023 -
Medium max 6.6ALAS2-2023-2103 1 CVE
Moderate: wayland security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3782: An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as …
first Jun 21, 2023 -
Medium max 7.1ALAS2-2023-2102 5 CVEs
Moderate: opensc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-2977: A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply…
first Jun 21, 2023 -
Medium max 6.5ALAS2023-2023-229 1 CVE
Moderate: binutils security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1972: Potential heap based buffer overflow found in _bfd_elf_slurp_version_tables() in bfd/elf.c.
first Jun 21, 2023 -
Medium max 7.5ALAS2023-2023-226 1 CVE
Moderate: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-23919: In some cases Node.js did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subseq…
first Jun 21, 2023 -
Medium max 5.5ALAS2023-2023-225 5 CVEs
Moderate: glib2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-32665: GLib's GVariant deserialization prior to GLib 2.74.4 is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processi…
first Jun 21, 2023 -
Medium max 6.5ALAS2023-2023-222 1 CVE
Moderate: openssl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2650: Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that us…
first Jun 21, 2023