4,948 results · Feed
-
High max 8.2ALAS2023-2023-165 6 CVEs
Important: ecs-service-connect-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-27496: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, th…
first Apr 27, 2023 -
Medium max 5.5ALAS2023-2023-164 2 CVEs
Moderate: redis6 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28856: Authenticated users can use the HINCRBYFLOAT command to create an invalid hash field that may later crash Redis on access. CVE-2023-28425: Redis is an …
first Apr 27, 2023 -
High max 9.1ALAS2023-2023-174 2 CVEs
Important: apache-ivy security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-37866: When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include place…
first Apr 27, 2023 -
Medium max 7.5ALAS2023-2023-173 1 CVE
Moderate: future security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-40899: An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header fro…
first Apr 27, 2023 -
HighALAS2023-2023-172 1 CVE
Important: nasm security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-44370: NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
first Apr 27, 2023 -
High max 7.4ALAS2023-2023-171 1 CVE
Important: gnutls security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-0361: A timing side-channel vulnerability was found in RSA ClientKeyExchange messages in GnuTLS. This side-channel may be sufficient to recover the key encryp…
first Apr 27, 2023 -
Medium max 5.5ALAS2023-2023-170 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1906: Possible heap-based buffer overflow attack in ImportMultiSpectralQuantum() in MagickCore/quantum-import.c for ImageMagick
first Apr 27, 2023 -
HighALAS2023-2023-177 1 CVE
Important: openldap security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-27212: In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion ... NOTE: https://bugs.openldap.org/show_bug.cgi?id=9454 NOTE: trunk: https://git…
first Apr 27, 2023 -
High max 7.5ALAS2023-2023-176 3 CVEs
Important: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28708: When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cook…
first Apr 27, 2023 -
High max 9.8ALAS2023-2023-175 15 CVEs
Important: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-24538: Templates did not properly consider backticks (`) as Javascript string delimiters, and as such did not escape them as expected. Backticks are used, sin…
first Apr 27, 2023 -
HighALAS2-2023-2033 11 CVEs
Important: openldap security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-27212: In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion ... NOTE: https://bugs.openldap.org/show_bug.cgi?id=9454 NOTE: trunk: https://git.op…
first Apr 27, 2023 -
MediumALAS2-2023-2032 1 CVE
Moderate: ldns security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-19860: When ldns version 1.7.1 verifies a zone file, the ldns_rr_new_frm_str_internal function has a heap out of bounds read vulnerability. An attacker can leak …
first Apr 27, 2023 -
MediumALAS2-2023-2031 2 CVEs
Moderate: libwebp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-36331: A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerabil…
first Apr 27, 2023 -
High max 5.3ALAS2-2023-2030 1 CVE
Important: xstream security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-21342: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed strea…
first Apr 27, 2023 -
HighALAS2-2023-2029 1 CVE
Important: nasm security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-44370: NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
first Apr 27, 2023 -
High max 7.4ALAS2-2023-2026 7 CVEs
Important: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-21968: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affec…
first Apr 27, 2023 -
High max 7.4ALAS2-2023-2025 7 CVEs
Important: java-17-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-21968: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affec…
first Apr 27, 2023 -
Medium max 7.5ALAS2-2023-2024 1 CVE
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-24537: Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integ…
first Apr 27, 2023 -
Low max 6.5ALAS2-2023-2023 1 CVE
Low: screen security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-24626: socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to sen…
first Apr 27, 2023 -
Medium max 5.3ALAS2-2023-2022 1 CVE
Moderate: pcs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-27539: The Ruby on Rails advisory describes this vulnerability as follows: Carefully crafted input can cause header parsing in Rack to take an unexpected amount …
first Apr 27, 2023 -
Medium max 6.5ALAS2-2023-2021 2 CVEs
Moderate: libxml2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29469: libxml2 Hashing of empty dict strings isn't deterministic. When hashing empty strings which aren't null-terminated, xmlDictComputeFastKey could produce in…
first Apr 27, 2023 -
High max 9.8ALAS2-2023-2019 1 CVE
Important: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28879: In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base…
first Apr 27, 2023 -
High max 6.5ALAS2023-2023-155 5 CVEs
Important: mariadb105 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-47015: MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereferenc…
first Mar 30, 2023 -
HighALAS2-2023-2018 6 CVEs
Important: jasper security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3467: A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder…
first Apr 13, 2023 -
Medium max 5.0ALAS2-2023-2017 1 CVE
Moderate: mysql-connector-java security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-2934: Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.19 and prior and 5.1.4…
first Apr 13, 2023 -
HighALAS2-2023-2016 1 CVE
Important: pki-core security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-2414: Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially ret…
first Apr 13, 2023 -
Medium max 5.5ALAS2-2023-2014 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1289: A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote at…
first Apr 13, 2023 -
High max 7.5ALAS2-2023-2013 3 CVEs
Important: liblouis security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-26769: Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a denial of service via the resolveSubtable function …
first Apr 13, 2023 -
High max 7.8ALAS2-2023-2012 1 CVE
Important: emacs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28617: org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory…
first Apr 13, 2023 -
High max 7.5ALAS2023-2023-161 8 CVEs
Important: bind security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-3924: This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a…
first Apr 13, 2023 -
Medium max 5.5ALAS2023-2023-159 1 CVE
Moderate: pkgconf security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-24056: In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. …
first Apr 13, 2023 -
High max 7.5ALAS2023-2023-158 2 CVEs
Important: ruby3.2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28756: A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific char…
first Apr 13, 2023 -
MediumALAS2-2023-2011 1 CVE
Moderate: gstreamer-plugins-good security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3497: GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.
first Mar 30, 2023 -
Medium max 7.8ALAS2-2023-2010 1 CVE
Moderate: babel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-42771: Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, le…
first Mar 30, 2023 -
MediumALAS2-2023-2009 1 CVE
Moderate: booth security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-2553: The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that d…
first Mar 30, 2023 -
Medium max 5.4ALAS2-2023-2008 1 CVE
Moderate: python-twisted-web security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-39348: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.…
first Mar 30, 2023 -
High max 8.2ALAS2-2023-2007 1 CVE
Important: xstream security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41966: XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack over…
first Mar 30, 2023 -
Medium max 6.5ALAS2-2023-2006 3 CVEs
Moderate: dbus security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-42012: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemo…
first Mar 30, 2023 -
Medium max 8.4ALAS2-2023-2005 4 CVEs
Moderate: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1355: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. CVE-2023-1264: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.…
first Mar 30, 2023 -
High max 7.8ALAS2-2023-2004 1 CVE
Important: systemd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-26604: systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemct…
first Mar 30, 2023