4,948 results · Feed
-
High max 8.8ALAS2-2023-2051 7 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32215: Mozilla developers and community members reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of …
first May 25, 2023 -
High max 7.8ALAS2-2023-2050 1 CVE
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32233: In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and writ…
first May 25, 2023 -
Medium max 5.5ALAS2-2023-2067 1 CVE
Moderate: libplist security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2015-10082: A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the…
first May 25, 2023 -
High max 8.1ALAS2023-2023-178 1 CVE
Important: perl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-31484: HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in t…
first May 11, 2023 -
Medium max 7.5ALAS2023-2023-181 4 CVEs
Moderate: openssl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1255: Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, le…
first May 11, 2023 -
Medium max 7.5ALAS2023-2023-180 2 CVEs
Moderate: git security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29007: Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a speci…
first May 11, 2023 -
MediumALAS2023-2023-066 1 CVE
Moderate: apr-util security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-25147: Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond b…
first Feb 17, 2023 -
MediumALAS2-2023-1937 1 CVE
Moderate: apr-util security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-25147: Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond boun…
first Feb 13, 2023 -
MediumALAS2-2023-2036 1 CVE
Moderate: qt5-qtbase security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-24607: When using the Qt SQL ODBC driver plugin, then it is possible to trigger a DOS with a specifically crafted string RESERVED NOTE: https://www.qt.io/blog/se…
first May 11, 2023 -
Medium max 7.8ALAS2-2023-2035 2 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-31436: qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. CVE-2023-251…
first May 11, 2023 -
High max 8.1ALAS2-2023-2034 1 CVE
Important: perl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-31484: HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to v…
first May 11, 2023 -
High max 9.8ALAS2-2023-2041 1 CVE
Important: libksba security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-47629: Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.
first May 11, 2023 -
High max 6.3ALAS2-2023-2040 2 CVEs
Important: wireshark security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0417: Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file …
first May 11, 2023 -
Medium max 7.5ALAS2-2023-2039 3 CVEs
Moderate: openssl11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0466: The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However t…
first May 11, 2023 -
High max 7.4ALAS2-2023-2038 7 CVEs
Important: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-21968: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affec…
first May 11, 2023 -
High max 7.5ALAS2-2023-2037 1 CVE
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-24534: HTTP and MIME header parsing could allocate large amounts of memory, even when parsing small inputs. Certain unusual patterns of input data could cause th…
first May 11, 2023 -
HighALAS2-2023-2044 1 CVE
Important: gd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-40145: ** DISPUTED ** gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 i…
first May 11, 2023 -
Medium max 7.8ALAS2-2023-2043 3 CVEs
Moderate: inkscape security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-42704: Inkscape version 0.91 is vulnerable to an out-of-bounds write, which may allow an attacker to arbitrary execute code. CVE-2021-42702: Inkscape version 0.9…
first May 11, 2023 -
High max 8.1ALAS2-2023-2042 1 CVE
Important: samba security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-38023: Netlogon RPC Elevation of Privilege Vulnerability.
first May 11, 2023 -
Medium max 5.0ALAS2-2023-2046 2 CVEs
Moderate: libssh2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3860: An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises…
first May 11, 2023 -
Medium max 7.5ALAS2-2023-2045 1 CVE
Moderate: jdom security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-33813: An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.
first May 11, 2023 -
HighALAS2-2023-2049 2 CVEs
Important: glib2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-16429: GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str(). CVE-2018-16428: In GNOME …
first May 11, 2023 -
High max 7.5ALAS2-2023-2047 3 CVEs
Important: tomcat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-13935: A flaw was found in Apache Tomcat, where the payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an inf…
first May 11, 2023 -
High max 7.5ALAS2-2023-2020 2 CVEs
Important: tomcat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28708: When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies…
first Apr 27, 2023 -
High max 7.5ALAS2023-2023-046 17 CVEs
Important: golist security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-41716: Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, inva…
first Feb 17, 2023 -
High max 7.5ALAS2023-2023-047 14 CVEs
Important: golang-github-cpuguy83-md2man security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a…
first Feb 17, 2023 -
High max 7.5ALAS2-2022-1865 15 CVEs
Important: golang-github-syndtr-gocapability security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1864 15 CVEs
Important: golang-github-kr-pty security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1863 15 CVEs
Important: go-rpm-macros security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1862 15 CVEs
Important: golang-googlecode-sqlite security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1861 15 CVEs
Important: golang-googlecode-net security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1860 15 CVEs
Important: golang-github-gorilla-mux security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1859 15 CVEs
Important: golang-github-gorilla-context security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1858 15 CVEs
Important: golang-github-godbus-dbus security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Oct 17, 2022 -
High max 7.5ALAS2-2022-1847 14 CVEs
Important: golist security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Re…
first Sep 15, 2022 -
Medium max 6.5ALAS2023-2023-163 2 CVEs
Moderate: libxml2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29469: libxml2 Hashing of empty dict strings isn't deterministic. When hashing empty strings which aren't null-terminated, xmlDictComputeFastKey could produce…
first Apr 27, 2023 -
High max 9.8ALAS2023-2023-162 1 CVE
Important: ghostscript security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28879: In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in b…
first Apr 27, 2023 -
High max 7.4ALAS2023-2023-168 7 CVEs
Important: java-1.8.0-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-21968: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are af…
first Apr 27, 2023 -
High max 7.4ALAS2023-2023-167 7 CVEs
Important: java-11-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-21968: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are af…
first Apr 27, 2023 -
High max 7.4ALAS2023-2023-166 7 CVEs
Important: java-17-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-21968: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are af…
first Apr 27, 2023