2,033 results · Clear filters · Feed
-
Medium max 6.7ALAS2023-2026-1705 1 CVE
Moderate: libgcrypt security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-41989: Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.
-
Medium max 5.5ALAS2023-2026-1704 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42050: Stack buffer overflow in XTileImage
-
Medium max 7.5ALAS2023-2026-1703 3 CVEs
Moderate: nss security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6772: Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10…
-
Medium max 9.8ALAS2023-2026-1700 8 CVEs
Moderate: soci-snapshotter security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content. This could cause…
first May 11, 2026 -
Medium max 7.5ALAS2023-2026-1699 1 CVE
Moderate: curl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-3805: When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
first May 11, 2026 -
Medium max 8.4ALAS2023-2026-1697 1 CVE
Moderate: perl-Text-CSV_XS security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-7111: CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or …
first May 11, 2026 -
Medium max 2.9ALAS2-2026-3298 1 CVE
Moderate: xdg-desktop-portal security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-40354: Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_f…
first May 11, 2026 -
MediumALAS2-2026-3293 0 CVEs
Moderate: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-5763: virtio-scsi request size mismatch NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/79971302935472232a68073faddb085177e3ca54 (v11.0.0-rc3) CVE-…
first May 11, 2026 -
Medium max 5.5ALAS2-2026-3291 1 CVE
Moderate: libXpm security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4367: As per upstream advisory: libXpm Out-of-bounds read in xpmNextWord()
first May 11, 2026 -
Medium max 7.5ALAS2-2026-3288 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33901: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffe…
first May 11, 2026 -
Medium max 7.2ALAS2-2026-3287 1 CVE
Moderate: python3-tornado security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-35536: In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not ch…
first May 11, 2026 -
Medium max 7.2ALAS2-2026-3286 1 CVE
Moderate: python-tornado security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-35536: In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not ch…
first May 11, 2026 -
Medium max 6.8ALAS2-2026-3283 1 CVE
Moderate: opencryptoki security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-23893: openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in pri…
first May 11, 2026 -
Medium max 5.9ALAS2023-2026-1680 2 CVEs
Moderate: krb5 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-40356: In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_conte…
first May 11, 2026 -
Medium max 9.1ALAS2023-2026-1673 9 CVEs
Moderate: tomcat10 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34500: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects…
first May 11, 2026 -
Medium max 9.1ALAS2023-2026-1672 9 CVEs
Moderate: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34500: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects…
first May 11, 2026 -
Medium max 9.8ALAS2023-2026-1671 10 CVEs
Moderate: runfinch-finch security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33748: BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insuffi…
first May 11, 2026 -
Medium max 5.1ALAS2023-2026-1670 1 CVE
Moderate: libpng security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34757: Use-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST in libpng before 1.6.57. Passing a pointer returned by the corresponding getter back into…
first May 11, 2026 -
Medium max 2.9ALAS2023-2026-1669 1 CVE
Moderate: xdg-desktop-portal security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-40354: Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on …
first May 11, 2026 -
Medium max 4.8ALAS2023-2026-1668 2 CVEs
Moderate: cups security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-41079: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can s…
first May 11, 2026 -
Medium max 9.8ALAS2023-2026-1663 1 CVE
Moderate: policycoreutils security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-56005: An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `…
first May 11, 2026 -
Medium max 9.8ALAS2023-2026-1661 8 CVEs
Moderate: runc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content. This could cause…
first May 11, 2026 -
Medium max 9.8ALAS2023-2026-1660 8 CVEs
Moderate: oci-add-hooks security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content. This could cause…
first May 11, 2026 -
Medium max 6.8ALAS2023-2026-1659 2 CVEs
Moderate: docker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-39882: OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response …
first May 11, 2026 -
Medium max 5.5ALAS2023-2026-1656 1 CVE
Moderate: libXpm security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4367: As per upstream advisory: libXpm Out-of-bounds read in xpmNextWord()
first May 11, 2026 -
Medium max 7.4ALAS2023-2026-1655 1 CVE
Moderate: mount-s3 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4428: A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which all…
first May 11, 2026 -
Medium max 9.8ALAS2023-2026-1645 8 CVEs
Moderate: amazon-ecr-credential-helper security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content. This could cause…
first May 11, 2026 -
Medium max 6.9ALAS2023-2026-1644 2 CVEs
Moderate: openvpn security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-40215: In a race condition an old TLS session could still try to send a packet but also get replaced by a new session. In this case, the buffer of the new ses…
first May 11, 2026 -
Medium max 4.2ALAS2023-2026-1643 1 CVE
Moderate: freerdp security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-40254: FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/…
first May 11, 2026 -
Medium max 8.6ALAS2023-2026-1642 1 CVE
Moderate: editorconfig security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-40489: editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a sta…
first May 11, 2026 -
Medium max 9.8ALAS2023-2026-1637 8 CVEs
Moderate: ecs-init security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content. This could cause…
first Apr 27, 2026 -
Medium max 5.5ALAS2023-2026-1636 1 CVE
Moderate: firewalld security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-4948: A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZ…
first Apr 27, 2026 -
Medium max 7.5ALAS2023-2026-1640 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-33901: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap bu…
-
Medium max 7.5ALAS2023-2026-1582 8 CVEs
Moderate: yq security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32288: tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in…
first Apr 13, 2026 -
Medium max 7.5ALAS2023-2026-1571 3 CVEs
Moderate: docker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-27142: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attri…
first Apr 13, 2026 -
Medium max 9.1ALAS2023-2026-1420 6 CVEs
Moderate: runfinch-finch security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-22703: Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfu…
first Feb 5, 2026 -
Medium max 9.8ALAS2023-2026-1515 8 CVEs
Moderate: kernel6.18 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-23249: In the Linux kernel, the following vulnerability has been resolved: xfs: check for deleted cursors when revalidating two btrees CVE-2026-23241: In the …
first Mar 30, 2026 -
Medium max 6.5ALAS2023-2026-1603 5 CVEs
Moderate: ecs-service-connect-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-7264: libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, …
first Apr 27, 2026 -
Medium max 3.1ALAS2023-2026-1632 1 CVE
Moderate: libssh security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-0968: libssh OOB Read in sftp_parse_longname()
first Apr 27, 2026 -
Medium max 5.3ALAS2023-2026-1631 1 CVE
Moderate: clamav1.5 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-20031: A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service …
first Apr 27, 2026