2,033 results · Clear filters · Feed
-
MediumALAS2-2023-2036 1 CVE
Moderate: qt5-qtbase security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-24607: When using the Qt SQL ODBC driver plugin, then it is possible to trigger a DOS with a specifically crafted string RESERVED NOTE: https://www.qt.io/blog/se…
first May 11, 2023 -
Medium max 7.8ALAS2-2023-2035 2 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-31436: qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. CVE-2023-251…
first May 11, 2023 -
Medium max 7.5ALAS2-2023-2039 3 CVEs
Moderate: openssl11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0466: The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However t…
first May 11, 2023 -
Medium max 7.8ALAS2-2023-2043 3 CVEs
Moderate: inkscape security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-42704: Inkscape version 0.91 is vulnerable to an out-of-bounds write, which may allow an attacker to arbitrary execute code. CVE-2021-42702: Inkscape version 0.9…
first May 11, 2023 -
Medium max 5.0ALAS2-2023-2046 2 CVEs
Moderate: libssh2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3860: An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises…
first May 11, 2023 -
Medium max 7.5ALAS2-2023-2045 1 CVE
Moderate: jdom security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-33813: An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.
first May 11, 2023 -
Medium max 6.5ALAS2023-2023-163 2 CVEs
Moderate: libxml2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29469: libxml2 Hashing of empty dict strings isn't deterministic. When hashing empty strings which aren't null-terminated, xmlDictComputeFastKey could produce…
first Apr 27, 2023 -
Medium max 5.5ALAS2023-2023-164 2 CVEs
Moderate: redis6 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28856: Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that may later crash Redis on access. CVE-2023-28425: Redis is an …
first Apr 27, 2023 -
Medium max 7.5ALAS2023-2023-173 1 CVE
Moderate: future security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-40899: An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header fro…
first Apr 27, 2023 -
Medium max 5.5ALAS2023-2023-170 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1906: Possible heap-based buffer overflow attack in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c for ImageMagick
first Apr 27, 2023 -
MediumALAS2-2023-2032 1 CVE
Moderate: ldns security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-19860: When ldns version 1.7.1 verifies a zone file, the ldns_rr_new_frm_str_internal function has a heap out of bounds read vulnerability. An attacker can leak …
first Apr 27, 2023 -
MediumALAS2-2023-2031 2 CVEs
Moderate: libwebp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-36331: A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerabil…
first Apr 27, 2023 -
Medium max 7.5ALAS2-2023-2024 1 CVE
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-24537: Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integ…
first Apr 27, 2023 -
Medium max 5.3ALAS2-2023-2022 1 CVE
Moderate: pcs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-27539: The Ruby on Rails advisory describes this vulnerability as follows: Carefully crafted input can cause header parsing in Rack to take an unexpected amount …
first Apr 27, 2023 -
Medium max 6.5ALAS2-2023-2021 2 CVEs
Moderate: libxml2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29469: libxml2 Hashing of empty dict strings isn't deterministic. When hashing empty strings which aren't null-terminated, xmlDictComputeFastKey could produce in…
first Apr 27, 2023 -
Medium max 5.0ALAS2-2023-2017 1 CVE
Moderate: mysql-connector-java security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-2934: Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.19 and prior and 5.1.4…
first Apr 13, 2023 -
Medium max 5.5ALAS2-2023-2014 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1289: A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote at…
first Apr 13, 2023 -
Medium max 5.5ALAS2023-2023-159 1 CVE
Moderate: pkgconf security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-24056: In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. …
first Apr 13, 2023 -
MediumALAS2-2023-2011 1 CVE
Moderate: gstreamer-plugins-good security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3497: GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
first Mar 30, 2023 -
Medium max 7.8ALAS2-2023-2010 1 CVE
Moderate: babel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-42771: Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, le…
first Mar 30, 2023 -
MediumALAS2-2023-2009 1 CVE
Moderate: booth security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-2553: The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that d…
first Mar 30, 2023 -
Medium max 5.4ALAS2-2023-2008 1 CVE
Moderate: python-twisted-web security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-39348: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.…
first Mar 30, 2023 -
Medium max 6.5ALAS2-2023-2006 3 CVEs
Moderate: dbus security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-42012: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemo…
first Mar 30, 2023 -
Medium max 8.4ALAS2-2023-2005 4 CVEs
Moderate: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1355: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. CVE-2023-1264: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.…
first Mar 30, 2023 -
MediumALAS2023-2023-157 2 CVEs
Moderate: yasm security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-33459: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in nasm_parser_directive() in modules/parsers/nasm/nasm-parse.c. CVE…
first Mar 30, 2023 -
Medium max 6.2ALAS2023-2023-156 3 CVEs
Moderate: containerd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-25173: containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not se…
first Mar 30, 2023 -
Medium max 5.5ALAS2023-2023-154 4 CVEs
Moderate: redis6 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-25155: Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` comm…
first Mar 30, 2023 -
Medium max 6.3ALAS2023-2023-152 1 CVE
Moderate: wireshark security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or crafted capture…
first Mar 30, 2023 -
Medium max 8.4ALAS2023-2023-151 4 CVEs
Moderate: vim security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1355: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. CVE-2023-1264: NULL Pointer Dereference in GitHub repository vim/vim prior to 9…
first Mar 30, 2023 -
Medium max 5.5ALAS2023-2023-150 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1289: A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote…
first Mar 30, 2023 -
Medium max 2.6ALAS2023-2023-149 1 CVE
Moderate: python-werkzeug security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-23934: Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulne…
first Mar 30, 2023 -
Medium max 7.4ALAS2-2023-2002 2 CVEs
Moderate: xdg-utils security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-4055: When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that…
first Mar 17, 2023 -
Medium max 5.5ALAS2-2023-2000 1 CVE
Moderate: gstreamer1-plugins-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3522: A flaw was found in gstreamer-plugins-base where an out-of-bounds read when handling certain ID3v2 tags is possible. The highest threat from this vulnerabi…
first Mar 17, 2023 -
MediumALAS2-2023-1999 1 CVE
Moderate: openjpeg security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3575: A heap-based buffer overflow was found in OpenJPEG. This flaw allows an attacker to execute arbitrary code with the permissions of the application compiled…
first Mar 17, 2023 -
MediumALAS2-2023-1998 1 CVE
Moderate: libsndfile security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-4156: An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a u…
first Mar 17, 2023 -
MediumALAS2-2023-1997 1 CVE
Moderate: audiofile security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-24599: In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker to leak sensit…
first Mar 17, 2023 -
Medium max 7.8ALAS2-2023-1996 2 CVEs
Moderate: libxml2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-40304: An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent l…
first Mar 17, 2023 -
Medium max 7.5ALAS2-2023-1990 1 CVE
Moderate: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-24329: An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank ch…
first Mar 17, 2023 -
Medium max 5.4ALAS2023-2023-130 1 CVE
Moderate: python-twisted security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-39348: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twist…
first Mar 11, 2023 -
Medium max 6.5ALAS2023-2023-121 2 CVEs
Moderate: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-44268: ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded th…
first Mar 6, 2023