4,948 results · Feed
-
High max 8.8ALAS2-2023-1915 1 CVE
Important: krb5 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-42898: Integer overflow vulnerabilities in PAC parsing
first Jan 18, 2023 -
Medium max 7.3ALAS2-2023-1912 1 CVE
Moderate: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-4141: The target's backtrace indicates that libc has detected a heap error or that the target was executing a heap function when it stopped. This could be due to…
first Jan 18, 2023 -
High max 7.5ALAS2-2023-1911 1 CVE
Important: sqlite security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-35737: SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
first Jan 18, 2023 -
High max 5.5ALAS2-2023-1910 2 CVEs
Important: xorg-x11-server security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-3551: A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the fil…
first Jan 18, 2023 -
High max 9.1ALAS2-2023-1908 1 CVE
Important: libtasn1 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-46848: GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
first Jan 18, 2023 -
LowALAS2-2023-1906 3 CVEs
Low: unzip security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-0530: A flaw was found in Unzip. The vulnerability occurs during the conversion of a UTF-8 string to a local string that leads to a segmentation fault. This flaw…
first Jan 18, 2023 -
Medium max 6.1ALAS2-2023-1905 1 CVE
Moderate: pcs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11358: A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype c…
first Jan 18, 2023 -
HighALAS2-2023-1913 2 CVEs
Important: golist security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41715: Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp represent…
first Jan 18, 2023 -
High max 8.0ALAS2-2023-1914 1 CVE
Important: hsqldb security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41853: Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code e…
first Jan 18, 2023 -
MediumALAS2-2023-1909 3 CVEs
Moderate: freetype security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-27406: A segmentation fault was found in FreeType's FT_Request_Size() function in the ftobjs.c file. This flaw allows an attacker to access a memory location in …
first Jan 18, 2023 -
High max 9.8ALAS2-2023-1916 1 CVE
Important: bcel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-42920: Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing …
first Jan 18, 2023 -
Medium max 9.8ALAS2-2022-1882 4 CVEs
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-42916: A vulnerability was found in curl. The issue occurs because curl's HSTS check can be bypassed to trick it to keep using HTTP. Using its HSTS support, it c…
first Dec 1, 2022 -
Medium max 5.5ALAS2-2022-1880 1 CVE
Moderate: ant security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-36374: When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an o…
first Dec 1, 2022 -
Medium max 6.5ALAS2-2022-1879 1 CVE
Moderate: 389-ds-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-2850: A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a spe…
first Dec 1, 2022 -
MediumALAS2-2022-1878 1 CVE
Moderate: util-linux security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-7738: A command injection flaw was found in the way util-linux implements umount autocompletion in Bash. An attacker with the ability to mount a filesystem with …
first Nov 15, 2022 -
HighALAS2-2022-1887 2 CVEs
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41715: No description is available for this CVE. CVE-2022-2879: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archi…
first Dec 1, 2022 -
High max 8.5ALAS2-2022-1886 2 CVEs
Important: git security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-39260: Git is an open source, scalable, distributed revision control system. git shell is a restricted login shell that can be used to implement Git's push/pull …
first Dec 1, 2022 -
High max 7.5ALAS2-2022-1885 1 CVE
Important: expat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-43680: In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory si…
first Dec 1, 2022 -
Medium max 7.8ALAS2-2022-1884 1 CVE
Moderate: e2fsprogs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-1304: An out-of-bounds read/write vulnerability was found in e2fsprogs. This issue leads to a segmentation fault and possibly arbitrary code execution via a spec…
first Dec 1, 2022 -
HighALAS2-2022-1883 1 CVE
Important: device-mapper-multipath security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41974: multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local…
first Dec 1, 2022 -
High max 10.0ALAS2-2022-1895 2 CVEs
Important: pcs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-30123: A flaw was found in ruby gem-rack. This flaw allows a malicious actor to craft requests that can cause shell escape sequences to be written to the termina…
first Dec 1, 2022 -
LowALAS2-2022-1894 1 CVE
Low: openjpeg2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-1122: A flaw was found in the opj2_decompress program in openjpeg2 in the way it handles an input directory with a large number of files. When it fails to alloca…
first Dec 1, 2022 -
Medium max 7.1ALAS2-2022-1893 2 CVEs
Moderate: ncurses security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-29458: A segmentation fault vulnerability was found in ncurses's convert_strings() function of tinfo/read_entry.c file. This flaw occurs due to corrupted terminf…
first Dec 1, 2022 -
Medium max 4.3ALAS2-2022-1892 6 CVEs
Moderate: mutt security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-1328: A flaw was found in mutt. When reading unencoded messages, mutt uses the line length from the untrusted input without any validation. This flaw allows an a…
first Dec 1, 2022 -
High max 6.3ALAS2-2022-1891 2 CVEs
Important: libtiff security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-3970: A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c.…
first Dec 1, 2022 -
High max 9.8ALAS2-2022-1890 1 CVE
Important: libksba security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-3515: A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code exe…
first Dec 1, 2022 -
High max 5.5ALAS2-2022-1889 1 CVE
Important: libbpf security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-3534: A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of …
first Dec 1, 2022 -
HighALAS2-2022-1898 1 CVE
Important: samba security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-32744: A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a …
first Dec 1, 2022 -
High max 9.8ALAS2-2022-1897 1 CVE
Important: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-37454: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbit…
first Dec 1, 2022 -
Medium max 5.5ALAS2-2022-1901 1 CVE
Moderate: util-linux security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-0563: A flaw was found in the Linux kernel's util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" envir…
first Dec 1, 2022 -
Medium max 5.5ALAS2-2022-1899 1 CVE
Moderate: systemd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-3821: An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and acc…
first Dec 1, 2022 -
Medium max 9.8ALAS2-2022-1875 5 CVEs
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-35252: A vulnerability found in curl. This security flaw happens when curl is used to retrieve and parse cookies from an HTTP(S) server, where it accepts cookies…
first Oct 31, 2022 -
Medium max 6.5ALAS2-2022-1874 2 CVEs
Moderate: dhcp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-2929: A vulnerability was found in the DHCP server where the "fqdn_universe_decode()" function allocates buffer space for the contents of option 81 (fqdn) data r…
first Oct 31, 2022 -
HighALAS2-2022-1873 1 CVE
Important: rsync security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-29154: A flaw was found in rsync that is triggered by a victim rsync user/client connecting to a malicious rsync server. The server can copy and overwrite arbitr…
first Oct 31, 2022 -
MediumALAS2-2022-1871 1 CVE
Moderate: pcre2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-1586: An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This…
first Oct 31, 2022 -
High max 7.1ALAS2-2022-1870 2 CVEs
Important: dbus security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-12049: An uncontrolled resource consumption vulnerability was discovered in D-Bus. The DBusServer leaks file descriptors when a message exceeds the per-message f…
first Oct 31, 2022 -
MediumALAS2-2022-1869 2 CVEs
Moderate: glibc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2015-8985: The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure an…
first Oct 31, 2022 -
High max 8.1ALAS2-2022-1877 1 CVE
Important: expat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-40674: A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal e…
first Oct 31, 2022 -
Low max 8.0ALAS2-2022-1868 26 CVEs
Low: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-3099: A use-after-free vulnerability was found in vim's do_cmdline() function of the src/ex_docmd.c file. The issue triggers when an invalid line number on :for …
first Oct 17, 2022 -
Medium max 5.3ALAS2-2022-1866 6 CVEs
Moderate: java-17-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-39399: Title: Improve HTTP/1.1 client usage The HTTP/2 connection cache caches connection based on the IP address but not the SNI which can allow spoofing for se…
first Oct 17, 2022