2,033 results · Clear filters · Feed
-
MediumALAS2023-2023-221 1 CVE
Moderate: opensmtpd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29323: ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable through 7.0.0-portable, can abort upon …
first Jun 21, 2023 -
Medium max 7.5ALAS2023-2023-219 1 CVE
Moderate: openldap security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2953: A vulnerability was found in openldap that can cause a null pointer dereference in the ber_memalloc_x() function.
first Jun 21, 2023 -
Medium max 7.5ALAS2023-2023-215 1 CVE
Moderate: cups security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-32324: OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to…
first Jun 21, 2023 -
Medium max 6.5ALAS2023-2023-213 1 CVE
Moderate: dbus security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-34969: D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.f…
first Jun 21, 2023 -
Medium max 7.1ALAS2023-2023-207 1 CVE
Moderate: opensc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2977: A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can sup…
first Jun 7, 2023 -
Medium max 8.8ALAS2023-2023-212 1 CVE
Moderate: bluez security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-0204: A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files cau…
first Jun 7, 2023 -
Medium max 4.2ALAS2023-2023-210 1 CVE
Moderate: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-23920: An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentia…
first Jun 7, 2023 -
Medium max 7.8ALAS2-2023-2089 1 CVE
Moderate: xmlrpc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-5002: XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct …
first Jun 7, 2023 -
Medium max 7.5ALAS2-2023-2087 1 CVE
Moderate: python-pillow security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-25290: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.
first Jun 7, 2023 -
Medium max 7.5ALAS2-2023-2084 1 CVE
Moderate: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28756: A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific charact…
first Jun 7, 2023 -
Medium max 7.8ALAS2-2023-2079 1 CVE
Moderate: libfastjson security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-12762: A flaw was found in json-c. In printbuf_memappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundary. …
first Jun 5, 2023 -
MediumALAS2-2023-2078 5 CVEs
Moderate: OpenEXR security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3605: There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application link…
first Jun 5, 2023 -
MediumALAS2-2023-2077 1 CVE
Moderate: mod_auth_mellon security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3639: A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks…
first Jun 5, 2023 -
MediumALAS2-2023-2075 2 CVEs
Moderate: poppler security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-38784: Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a…
first Jun 5, 2023 -
Medium max 9.8ALAS2-2023-2074 1 CVE
Moderate: rsync security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-37434: A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the inflate.c function via a large gzip header extra fiel…
first Jun 5, 2023 -
Medium max 7.5ALAS2-2023-2073 4 CVEs
Moderate: openssl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-2650: Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use O…
first Jun 5, 2023 -
Medium max 7.5ALAS2-2023-2072 2 CVEs
Moderate: git security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29007: Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a speciall…
first Jun 5, 2023 -
Medium max 9.8ALAS2-2023-2070 6 CVEs
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-27538: The curl advisory describes this issue as follows: libcurl would reuse a previously created connection even when an SSH related option had been changed th…
first Jun 5, 2023 -
Medium max 7.5ALAS2-2023-2069 1 CVE
Moderate: dnsmasq security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28450: An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.
first Jun 5, 2023 -
MediumALAS2-2023-2082 2 CVEs
Moderate: pcre security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2015-8394: PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or…
first Jun 5, 2023 -
Medium max 7.8ALAS2023-2023-205 1 CVE
Moderate: libfastjson security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2020-12762: A flaw was found in json-c. In printbuf_memappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundar…
first Jun 5, 2023 -
Medium max 6.6ALAS2023-2023-203 1 CVE
Moderate: wayland security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-3782: An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained …
first Jun 5, 2023 -
Medium max 6.5ALAS2023-2023-200 1 CVE
Moderate: snakeyaml security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-38750: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an…
first Jun 5, 2023 -
Medium max 5.5ALAS2023-2023-196 1 CVE
Moderate: cloud-init security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1786: Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibl…
first Jun 5, 2023 -
Medium max 9.8ALAS2023-2023-193 6 CVEs
Moderate: curl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-27538: The curl advisory describes this issue as follows: libcurl would reuse a previously created connection even when an SSH related option had been changed…
first Jun 5, 2023 -
Medium max 7.5ALAS2023-2023-192 1 CVE
Moderate: dnsmasq security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28450: An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2…
first Jun 5, 2023 -
MediumALAS2023-2023-188 1 CVE
Moderate: freetype security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2004: An integer overflow vulnerability was discovered in Freetype in tt_hvadvance_adjust() function in src/truetype/ttgxvar.c.
first May 25, 2023 -
Medium max 7.7ALAS2023-2023-187 1 CVE
Moderate: libldb security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-0614: Access controlled AD LDAP attributes can be discovered
first May 25, 2023 -
MediumALAS2023-2023-186 2 CVEs
Moderate: libssh security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2283: A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in thepki_verify_data_signature function in…
first May 25, 2023 -
Medium max 7.5ALAS2-2023-2064 1 CVE
Moderate: tar security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9923: pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
first May 25, 2023 -
Medium max 6.5ALAS2-2023-2061 6 CVEs
Moderate: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-4144: An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure poi…
first May 25, 2023 -
Medium max 6.5ALAS2-2023-2059 1 CVE
Moderate: apache-commons-io security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-29425: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the resul…
first May 25, 2023 -
MediumALAS2-2023-2058 1 CVE
Moderate: glib2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3800: A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged o…
first May 25, 2023 -
MediumALAS2-2023-2057 10 CVEs
Moderate: mariadb security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-31624: MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c method log_statement_ex, the held lo…
first May 25, 2023 -
MediumALAS2-2023-2054 1 CVE
Moderate: fribidi security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-25309: A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.…
first May 25, 2023 -
Medium max 5.5ALAS2-2023-2067 1 CVE
Moderate: libplist security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2015-10082: A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the…
first May 25, 2023 -
Medium max 7.5ALAS2023-2023-181 4 CVEs
Moderate: openssl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1255: Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, le…
first May 11, 2023 -
Medium max 7.5ALAS2023-2023-180 2 CVEs
Moderate: git security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29007: Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a speci…
first May 11, 2023 -
MediumALAS2023-2023-066 1 CVE
Moderate: apr-util security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-25147: Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond b…
first Feb 17, 2023 -
MediumALAS2-2023-1937 1 CVE
Moderate: apr-util security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-25147: Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond boun…
first Feb 13, 2023