2,033 results · Clear filters · Feed
-
Medium max 7.4ALAS2023-2023-076 1 CVE
Moderate: python-jwt security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-29217: A vulnerability was found in python-jwt. This issue happens when PyJWT supports multiple different JWT signing algorithms. This flaw allows an attacker…
first Feb 17, 2023 -
MediumALAS2023-2023-071 3 CVEs
Moderate: libarchive security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-26280: An out-of-bounds read flaw was found in libarchive. This flaw allows an attacker who can supply a specially crafted zip file to libarchive to cause an …
first Feb 17, 2023 -
MediumALAS2023-2023-080 2 CVEs
Moderate: dbus-broker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-31213: An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file. CVE-2022-…
first Feb 17, 2023 -
Medium max 7.5ALAS2023-2023-079 4 CVEs
Moderate: containerd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-36109: A flaw was found in Moby. This flaw allows an attacker to bypass primary group restrictions due to a flaw in the supplementary group access setup. CVE-…
first Feb 17, 2023 -
Medium max 7.5ALAS2023-2023-078 3 CVEs
Moderate: unbound security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-3204: A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation A…
first Feb 17, 2023 -
MediumALAS2023-2023-087 1 CVE
Moderate: gnupg2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-34903: A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the write_status_text_and_buffer() function in g10/cpr.c. This…
first Feb 17, 2023 -
MediumALAS2023-2023-085 1 CVE
Moderate: libldb security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-32746: A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database modu…
first Feb 17, 2023 -
Medium max 7.8ALAS2023-2023-097 2 CVEs
Moderate: xmlsec1 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-40304: An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequen…
first Feb 17, 2023 -
Medium max 7.8ALAS2023-2023-096 4 CVEs
Moderate: libxml2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-40304: An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequen…
first Feb 17, 2023 -
Medium max 7.0ALAS2023-2023-094 1 CVE
Moderate: sysstat security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-39377: sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, alloc…
first Feb 17, 2023 -
MediumALAS2023-2023-093 1 CVE
Moderate: libdwarf security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-39170: A double-free vulnerability was found in libdwarf's dwarf_expand_frame_instructions() function of the dwarf_frame.c file. A carefully crafted object fi…
first Feb 17, 2023 -
Medium max 7.8ALAS2023-2023-091 1 CVE
Moderate: bash security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-3715: A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.
first Feb 17, 2023 -
Medium max 6.5ALAS2023-2023-100 3 CVEs
Moderate: dbus security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-42012: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-da…
first Feb 17, 2023 -
Medium max 6.2ALAS2023-2023-113 2 CVEs
Moderate: git security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-23946: Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.…
first Feb 21, 2023 -
Medium max 7.5ALAS2023-2023-111 2 CVEs
Moderate: harfbuzz security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-25193: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back f…
first Feb 21, 2023 -
Medium max 9.1ALAS2023-2023-114 3 CVEs
Moderate: curl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-23916: curl: HTTP multi-header compression denial of service CVE-2023-23915: A flaw was found in the Curl package, where the HSTS mechanism could fail when mu…
first Feb 21, 2023 -
MediumALAS2-2023-1949 1 CVE
Moderate: postgresql security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-23214: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can in…
first Feb 17, 2023 -
Medium max 6.5ALAS2-2023-1948 1 CVE
Moderate: protobuf security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-22570: A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads to a Null pointer derefe…
first Feb 17, 2023 -
Medium max 5.3ALAS2-2023-1946 1 CVE
Moderate: httpcomponents-client security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-13956: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.…
first Feb 17, 2023 -
Medium max 5.3ALAS2-2023-1963 1 CVE
Moderate: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-21830: Improve CORBA communication: CORBA deserialization can result in outbound network connections with data passed in.
first Feb 17, 2023 -
Medium max 6.5ALAS2-2023-1961 2 CVEs
Moderate: ImageMagick security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-44268: ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the c…
first Feb 17, 2023 -
Medium max 4.8ALAS2-2023-1959 2 CVEs
Moderate: rust security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-36114: Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed arch…
first Feb 17, 2023 -
Medium max 6.5ALAS2-2023-1950 7 CVEs
Moderate: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41317: A flaw was found in squid. A trusted client can directly access the cache manager information, bypassing the manager ACL protection and resulting in infor…
first Feb 17, 2023 -
Medium max 7.5ALAS2-2021-1641 3 CVEs
Moderate: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-31799: An operating system command injection flaw was found in RDoc. Using the rdoc command to generate documentation for a malicious Ruby source code could lead…
first May 20, 2021 -
Medium max 7.5ALAS2-2021-1612 3 CVEs
Moderate: openssl11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-23841: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained …
first Mar 18, 2021 -
MediumALAS2-2023-1929 3 CVEs
Moderate: autotrace security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-19005: A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a malformed bitmap image. This may occur after the …
first Jan 31, 2023 -
Medium max 7.8ALAS2-2023-1927 2 CVEs
Moderate: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0049: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. CVE-2022-4292: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
first Jan 30, 2023 -
Medium max 5.3ALAS2-2023-1926 1 CVE
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41717: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent…
first Jan 30, 2023 -
Medium max 7.0ALAS2-2023-1925 1 CVE
Moderate: sysstat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-39377: sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate…
first Jan 30, 2023 -
Medium max 7.5ALAS2-2023-1924 3 CVEs
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-43552: A vulnerability was found in curl. In this issue, curl can be asked to tunnel all protocols virtually it supports through an HTTP proxy. HTTP proxies can …
first Jan 30, 2023 -
Medium max 5.3ALAS2-2023-1922 4 CVEs
Moderate: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-21628: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions …
first Jan 30, 2023 -
Medium max 6.3ALAS2-2021-1712 4 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-20141: In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening an…
first Oct 4, 2021 -
Medium max 5.3ALAS2-2023-1919 2 CVEs
Moderate: java-17-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-21843: Better Banking of Sounds: JARSoundbankReader can load classes from remote URLs. CVE-2023-21835: Enhance DTLS performance: DTLS does not avail itself of th…
first Jan 18, 2023 -
Medium max 5.3ALAS2-2023-1918 2 CVEs
Moderate: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-21843: Better Banking of Sounds: JARSoundbankReader can load classes from remote URLs. CVE-2023-21835: Enhance DTLS performance: DTLS does not avail itself of th…
first Jan 18, 2023 -
Medium max 7.3ALAS2-2023-1912 1 CVE
Moderate: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-4141: The target's backtrace indicates that libc has detected a heap error or that the target was executing a heap function when it stopped. This could be due to…
first Jan 18, 2023 -
Medium max 6.1ALAS2-2023-1905 1 CVE
Moderate: pcs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11358: A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype c…
first Jan 18, 2023 -
MediumALAS2-2023-1909 3 CVEs
Moderate: freetype security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-27406: A segmentation fault was found in FreeType's FT_Request_Size() function in the ftobjs.c file. This flaw allows an attacker to access a memory location in …
first Jan 18, 2023 -
Medium max 9.8ALAS2-2022-1882 4 CVEs
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-42916: A vulnerability was found in curl. The issue occurs because curl's HSTS check can be bypassed to trick it to keep using HTTP. Using its HSTS support, it c…
first Dec 1, 2022 -
Medium max 5.5ALAS2-2022-1880 1 CVE
Moderate: ant security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-36374: When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an o…
first Dec 1, 2022 -
Medium max 6.5ALAS2-2022-1879 1 CVE
Moderate: 389-ds-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-2850: A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a spe…
first Dec 1, 2022