Source

Amazon Linux Security Center (ALAS)

Source: https://alas.aws.amazon.com/

All Critical High Medium Low With exploited CVEs

2,033 results · Clear filters · Feed

Medium max 7.5

ALAS2-2026-3382 3 CVEs

Moderate: golist security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-42507: When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject mislead…

Jun 22, 2026
Medium max 8.8

ALAS2-2026-3381 16 CVEs

Moderate: webkitgtk4 security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-43660: A validation issue was addressed with improved logic. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Ta…

Jun 22, 2026
Medium max 9.8

ALAS2-2026-3379 11 CVEs

Moderate: httpd security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-44631: Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4…

Jun 22, 2026
Medium max 4.7

ALAS2-2026-3378 1 CVE

Moderate: amazon-ssm-agent security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-41506: go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication cre…

Jun 22, 2026
Medium max 8.2

ALAS2-2026-3377 1 CVE

Moderate: python-urllib3 security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-44431: urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connectio…

Jun 22, 2026
Medium max 8.2

ALAS2-2026-3376 1 CVE

Moderate: python3-urllib3 security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-44431: urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connectio…

Jun 22, 2026
Medium max 7.8

ALAS2-2026-3375 1 CVE

Moderate: rust security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-44471: gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, perm…

Jun 22, 2026
Medium max 2.1

ALAS2-2026-3366 1 CVE

Moderate: python security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-6019: http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser…

Jun 22, 2026
Medium max 6.2

ALAS2-2026-3360 1 CVE

Moderate: libusbx security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-23679: libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB co…

Jun 22, 2026
Medium max 4.0

ALAS2-2026-3359 1 CVE

Moderate: lcms2 security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-41254: Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.

Jun 22, 2026
Medium max 7.5

ALAS2023-2026-1891 3 CVEs

Moderate: perl-Crypt-PBKDF2 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-9641: Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should…

Jun 22, 2026
Medium max 8.2

ALAS2023-2026-1883 1 CVE

Moderate: giflib security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-26740: Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existin…

Jun 22, 2026
Medium max 9.8

ALAS2023-2026-1880 11 CVEs

Moderate: httpd security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-44631: Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from …

Jun 22, 2026
Medium max 4.7

ALAS2023-2026-1879 1 CVE

Moderate: amazon-ssm-agent security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-41506: go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication …

Jun 22, 2026
Medium max 7.5

ALAS2023-2026-1878 3 CVEs

Moderate: golang security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42507: When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misl…

Jun 22, 2026
Medium max 7.5

ALAS2023-2026-1877 3 CVEs

Moderate: golang-github-burntsushi-toml security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42507: When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misl…

Jun 22, 2026
Medium max 7.5

ALAS2023-2026-1876 3 CVEs

Moderate: golang-github-burntsushi-toml-test security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42507: When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misl…

Jun 22, 2026
Medium max 7.5

ALAS2023-2026-1875 3 CVEs

Moderate: golang-github-cpuguy83-md2man security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42507: When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misl…

Jun 22, 2026
Medium max 7.5

ALAS2023-2026-1874 3 CVEs

Moderate: golist security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42507: When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misl…

Jun 22, 2026
Medium max 7.8

ALAS2023-2026-1872 3 CVEs

Moderate: rust-cargo-c security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-7598: A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. S…

Jun 22, 2026
Medium max 7.8

ALAS2023-2026-1871 1 CVE

Moderate: rust security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-44471: gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, p…

Jun 22, 2026
Medium max 7.2

ALAS2023-2026-1854 1 CVE

Moderate: python-click security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-7246: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS…

Jun 22, 2026
Medium max 6.2

ALAS2023-2026-1848 1 CVE

Moderate: libusbx security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-23679: libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB…

Jun 22, 2026
Medium max 7.7

ALAS2023-2026-1846 1 CVE

Moderate: python-mako security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-41205: Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // …

Jun 22, 2026
Medium max 8.2

ALAS2023-2026-1843 1 CVE

Moderate: python-urllib3 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-44431: urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connec…

Jun 22, 2026
Medium max 5.7

ALAS2023-2026-1832 2 CVEs

Moderate: python3.11 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6019: http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML par…

Jun 22, 2026
first Jun 11, 2026
Medium max 6.2

ALAS2023-2026-1831 1 CVE

Moderate: perl-Unicode-LineBreak security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-8594: Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. Text::LineFold splits the input …

Jun 22, 2026
first Jun 11, 2026
Medium max 7.5

ALAS2023-2026-1829 1 CVE

Moderate: perl-Cpanel-JSON-XS security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-9516: BOM-shift PV-corruption SIGABRT

Jun 22, 2026
first Jun 11, 2026
Medium max 7.5

ALAS2023-2026-1826 15 CVEs

Moderate: ImageMagick security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-47166: An attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server process (as per: https://github.com/I…

Jun 22, 2026
first Jun 11, 2026
Medium max 4.0

ALAS2023-2026-1657 2 CVEs

Moderate: lcms2 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42798: Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c. CVE-2026-41254: Little CMS (lcms2) through 2.18 ha…

Jun 12, 2026
first May 11, 2026
Medium max 6.5

ALAS2023-2026-1827 2 CVEs

Moderate: mariadb114 security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-3494: In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or…

Jun 12, 2026
first Jun 11, 2026
Medium max 7.3

ALAS2023-2026-1516 1 CVE

Moderate: dnsmasq security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-2291: dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could resu…

Jun 8, 2026
first Mar 30, 2026
Medium max 5.3

ALAS2-2026-3353 2 CVEs

Moderate: bind security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-5950: Avoid unbounded recursion loop CVE-2026-3592: Limit resolver server list size

Jun 8, 2026
Medium max 7.3

ALAS2-2026-3352 1 CVE

Moderate: perl security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-8376: Buffer overflow in Perl_study_chunk

Jun 8, 2026
Medium max 4.8

ALAS2-2026-3351 1 CVE

Moderate: capstone security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-68114: Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnpr…

Jun 8, 2026
Medium max 8.2

ALAS2-2026-3349 1 CVE

Moderate: vorbis-tools security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34253: A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c. This …

Jun 8, 2026
Medium max 7.5

ALAS2-2026-3346 15 CVEs

Moderate: ImageMagick security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-47166: An attacker who can connect to a magick -distribute-cache service can cause a heap buffer over-read in the server process (as per: https://github.com/Imag…

Jun 8, 2026
Medium max 6.1

ALAS2-2026-3345 1 CVE

Moderate: perl-Template-Toolkit security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-5090: emplate::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTM…

Jun 8, 2026
Medium max 7.5

ALAS2-2026-3343 1 CVE

Moderate: perl-Crypt-PasswdMD5 security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-6659: Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. The built-in rand function is predictable, and unsuitable for c…

Jun 8, 2026
Medium max 7.5

ALAS2-2026-3342 1 CVE

Moderate: perl-XML-LibXML security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-8177: XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node n…

Jun 8, 2026