4,948 results · Feed
-
Medium max 7.5ALAS2023-2023-111 2 CVEs
Moderate: harfbuzz security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-25193: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back f…
first Feb 21, 2023 -
Low max 6.4ALAS2023-2023-110 1 CVE
Low: tpm2-tss security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-22745: tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In affec…
first Feb 17, 2023 -
Medium max 9.1ALAS2023-2023-114 3 CVEs
Moderate: curl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-23916: curl: HTTP multi-header compression denial of service CVE-2023-23915: A flaw was found in the Curl package, where the HSTS mechanism could fail when mu…
first Feb 21, 2023 -
High max 8.1ALAS2023-2023-001 2 CVEs
Important: rsyslog security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-24903: A flaw was found in rsyslog's reception TCP modules. This flaw allows an attacker to craft a malicious message leading to a heap-based buffer overflow.…
first Feb 17, 2023 -
MediumALAS2-2023-1949 1 CVE
Moderate: postgresql security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-23214: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can in…
first Feb 17, 2023 -
Medium max 6.5ALAS2-2023-1948 1 CVE
Moderate: protobuf security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-22570: A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads to a Null pointer derefe…
first Feb 17, 2023 -
High max 7.1ALAS2-2023-1947 1 CVE
Important: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-27792: A heap-based buffer over write vulnerability was found in GhostScript's lp8000_print_page() function in gdevlp8k.c file. An attacker could trick a user to…
first Feb 17, 2023 -
Medium max 5.3ALAS2-2023-1946 1 CVE
Moderate: httpcomponents-client security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-13956: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.…
first Feb 17, 2023 -
High max 9.0ALAS2-2023-1938 3 CVEs
Important: httpd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-37436: Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated…
first Feb 17, 2023 -
Medium max 5.3ALAS2-2023-1963 1 CVE
Moderate: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-21830: Improve CORBA communication: CORBA deserialization can result in outbound network connections with data passed in.
first Feb 17, 2023 -
High max 8.8ALAS2-2023-1962 3 CVEs
Important: libXpm security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-4883: A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying …
first Feb 17, 2023 -
Medium max 6.5ALAS2-2023-1961 2 CVEs
Moderate: ImageMagick security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-44268: ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the c…
first Feb 17, 2023 -
High max 8.8ALAS2-2023-1960 1 CVE
Important: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-42823: A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1…
first Feb 17, 2023 -
Medium max 4.8ALAS2-2023-1959 2 CVEs
Moderate: rust security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-36114: Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed arch…
first Feb 17, 2023 -
High max 6.8ALAS2-2023-1957 1 CVE
Important: ca-certificates security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-23491: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Cer…
first Feb 17, 2023 -
Medium max 6.5ALAS2-2023-1950 7 CVEs
Moderate: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41317: A flaw was found in squid. A trusted client can directly access the cache manager information, bypassing the manager ACL protection and resulting in infor…
first Feb 17, 2023 -
Critical max 9.8ALAS2-2023-1964 2 CVEs
Critical: clamav security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-20052: A possible remote information leak vulnerability in the DMG file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 an…
first Feb 20, 2023 -
Medium max 7.5ALAS2-2021-1641 3 CVEs
Moderate: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-31799: An operating system command injection flaw was found in RDoc. Using the rdoc command to generate documentation for a malicious Ruby source code could lead…
first May 20, 2021 -
Medium max 7.5ALAS2-2021-1612 3 CVEs
Moderate: openssl11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-23841: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained …
first Mar 18, 2021 -
High max 5.5ALAS2-2020-1465 9 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-12771: An issue was discovered in the Linux kernel through 5.6.11. btree_gc_coalesce in drivers/md/bcache/btree.c has a deadlock if a coalescing operation fails.…
first Jul 21, 2020 -
Critical max 9.8ALAS2-2023-1936 2 CVEs
Critical: apr security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-24963: Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond boun…
first Feb 13, 2023 -
High max 7.5ALAS2-2023-1935 3 CVEs
Important: openssl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0286: A type confusion vulnerability was found in OpenSSL when OpenSSL X.400 addresses processing inside an X.509 GeneralName. When CRL checking is enabled (for …
first Feb 3, 2023 -
High max 7.5ALAS2-2023-1934 4 CVEs
Important: openssl11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0286: A type confusion vulnerability was found in OpenSSL when OpenSSL X.400 addresses processing inside an X.509 GeneralName. When CRL checking is enabled (for …
first Feb 3, 2023 -
High max 5.9ALAS2-2023-1930 9 CVEs
Important: freerdp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41877: FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in `drive` channel. A mali…
first Jan 31, 2023 -
MediumALAS2-2023-1929 3 CVEs
Moderate: autotrace security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-19005: A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a malformed bitmap image. This may occur after the …
first Jan 31, 2023 -
High max 7.8ALAS2-2023-1928 1 CVE
Important: emacs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-45939: GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the s…
first Jan 30, 2023 -
Medium max 7.8ALAS2-2023-1927 2 CVEs
Moderate: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0049: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. CVE-2022-4292: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
first Jan 30, 2023 -
Medium max 5.3ALAS2-2023-1926 1 CVE
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41717: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent…
first Jan 30, 2023 -
Medium max 7.0ALAS2-2023-1925 1 CVE
Moderate: sysstat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-39377: sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate…
first Jan 30, 2023 -
Medium max 7.5ALAS2-2023-1924 3 CVEs
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-43552: A vulnerability was found in curl. In this issue, curl can be asked to tunnel all protocols virtually it supports through an HTTP proxy. HTTP proxies can …
first Jan 30, 2023 -
High max 9.8ALAS2-2023-1923 2 CVEs
Important: git security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41903: Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is al…
first Jan 30, 2023 -
Medium max 5.3ALAS2-2023-1922 4 CVEs
Moderate: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-21628: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions …
first Jan 30, 2023 -
LowALAS2-2023-1921 1 CVE
Low: udisks2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3802: A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to kernel panic. The highest threat from…
first Jan 30, 2023 -
LowALAS2-2023-1920 1 CVE
Low: util-linux security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-37600: ** DISPUTED ** An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources i…
first Jan 30, 2023 -
Medium max 6.3ALAS2-2021-1712 4 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-20141: In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening an…
first Oct 4, 2021 -
Medium max 5.3ALAS2-2023-1919 2 CVEs
Moderate: java-17-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-21843: Better Banking of Sounds: JARSoundbankReader can load classes from remote URLs. CVE-2023-21835: Enhance DTLS performance: DTLS does not avail itself of th…
first Jan 18, 2023 -
Medium max 5.3ALAS2-2023-1918 2 CVEs
Moderate: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-21843: Better Banking of Sounds: JARSoundbankReader can load classes from remote URLs. CVE-2023-21835: Enhance DTLS performance: DTLS does not avail itself of th…
first Jan 18, 2023 -
High max 8.6ALAS2-2023-1907 2 CVEs
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41318: A flaw was found in Squid. An incorrect integer overflow protection in the Squid SSPI and SMB authentication helpers is vulnerable to a buffer overflow at…
first Jan 18, 2023 -
HighALAS2-2023-1904 1 CVE
Important: libpng security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2015-8540: Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x an…
first Jan 18, 2023 -
High max 7.5ALAS2-2023-1917 1 CVE
Important: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-45061: An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) …
first Jan 18, 2023