4,948 results · Feed
-
LowALAS2-2020-1518 1 CVE
Low: hunspell security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-16707: Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx. 1771026: CVE-2019-16707 hunspell: out-of-bounds read in…
-
MediumALAS2-2020-1517 1 CVE
Moderate: glibc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-10739: In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed…
-
Medium max 7.1ALAS2-2020-1542 1 CVE
Moderate: python-pillow security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-5313: An out-of-bounds read was discovered in python-pillow in the way it decodes FLI images. An application that uses python-pillow to load untrusted images may…
-
LowALAS2-2020-1541 1 CVE
Low: poppler security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-14494: A divide-by-zero error was found in the way Poppler handled certain PDF files. A remote attacker could exploit this flaw by providing a malicious PDF file…
-
Medium max 7.5ALAS2-2020-1540 1 CVE
Moderate: openwsman security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3833: Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remo…
-
MediumALAS2-2020-1539 1 CVE
Moderate: openldap security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-12243: In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash). 183353…
-
Low max 5.8ALAS2-2020-1538 2 CVEs
Low: mod_auth_openidc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-20479: An open redirect flaw was discovered in mod_auth_openidc where it handles logout redirection. The module does not correctly validate the URL, allowing a U…
-
LowALAS2-2020-1552 5 CVEs
Low: tigervnc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-15695: TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occur…
-
MediumALAS2-2020-1551 1 CVE
Moderate: zziplib security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-17828: It was discovered that zziplib is vulnerable to a directory traversal flaw in most of its unzip binaries, including unzip-mem, unzzipcat-mem, unzzipcat-bi…
-
LowALAS2-2020-1550 1 CVE
Low: unzip security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-13232: Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb…
-
MediumALAS2-2020-1549 1 CVE
Moderate: subversion security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-11782: In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only reque…
-
High max 8.6ALAS2-2020-1548 3 CVEs
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-24606: Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a craft…
-
HighALAS2-2020-1547 1 CVE
Important: spice security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14355: Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system. Both the SPICE client (spice-gt…
-
HighALAS2-2020-1546 1 CVE
Important: spice-gtk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14355: Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system. Both the SPICE client (spice-gt…
-
MediumALAS2-2020-1545 1 CVE
Moderate: spamassassin security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-12420: In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recomm…
-
Medium max 6.5ALAS2-2020-1544 1 CVE
Moderate: samba security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-14907: All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) th…
-
HighALAS2-2020-1496 2 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-15669: No description is available for this CVE. 1872532: CVE-2020-15669 Mozilla: Use-After-Free when aborting an operation CVE-2020-15664: No description is ava…
first Sep 28, 2020 -
Medium max 7.5ALAS2-2020-1494 2 CVEs
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-16845: Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs. 1867099: CVE-…
first Sep 28, 2020 -
HighALAS2-2020-1493 2 CVEs
Important: mod_http2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-9490: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the …
first Sep 15, 2020 -
LowALAS2-2020-1492 1 CVE
Low: lua53 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-24370: ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31). 1870290: CVE-2020-2…
first Sep 15, 2020 -
HighALAS2-2020-1490 3 CVEs
Important: httpd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-9490: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the …
first Sep 15, 2020 -
HighALAS2-2020-1489 3 CVEs
Important: dovecot security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-12674: In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. 1866317: CVE-202…
first Sep 15, 2020 -
High max 6.7ALAS2-2020-1488 1 CVE
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14386: 99999:
first Sep 3, 2020 -
HighALAS2-2020-1487 4 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-6514: Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit h…
first Sep 1, 2020 -
MediumALAS2-2020-1486 4 CVEs
Moderate: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-8450: An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as…
first Sep 1, 2020 -
Medium max 7.5ALAS2-2020-1485 1 CVE
Moderate: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-1983: A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service. 182982…
first Sep 1, 2020 -
Medium max 5.5ALAS2-2020-1484 2 CVEs
Moderate: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14422: Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attack…
first Sep 1, 2020 -
Medium max 5.5ALAS2-2020-1483 1 CVE
Moderate: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-20907: In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _pr…
first Sep 1, 2020 -
High max 7.7ALAS2-2020-1482 1 CVE
Important: postgresql-jdbc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-13692: PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. 1852985: CVE-2020-13692 postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML
first Sep 1, 2020 -
Medium max 8.8ALAS2-2020-1473 2 CVEs
Moderate: dovecot security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-7524: In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to eleva…
first Aug 18, 2020 -
MediumALAS2-2020-1476 1 CVE
Moderate: evolution security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-15587: GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid s…
first Aug 18, 2020 -
Medium max 8.1ALAS2-2020-1475 1 CVE
Moderate: evolution-data-server security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3890: It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential inform…
first Aug 18, 2020 -
LowALAS2-2020-1474 1 CVE
Low: evince security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11459: The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors f…
first Aug 18, 2020 -
MediumALAS2-2020-1479 1 CVE
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-15586: Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it read…
first Aug 18, 2020 -
Medium max 4.8ALAS2-2020-1478 1 CVE
Moderate: gnome-shell security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3820: It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access…
first Aug 18, 2020 -
LowALAS2-2020-1477 1 CVE
Low: gettext security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-18751: An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related to an invalid free in po_gram_pars…
first Aug 18, 2020 -
MediumALAS2-2020-1481 4 CVEs
Moderate: poppler security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9959: The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby maki…
first Aug 18, 2020 -
MediumALAS2-2020-1469 1 CVE
Moderate: dnsmasq security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14312: A flaw was found in the default configuration of dnsmasq, as shipped with Fedora and Red Hat Enterprise Linux, where it listens on any interface and accep…
first Jul 31, 2020 -
Medium max 7.5ALAS2-2020-1470 1 CVE
Moderate: python-rsa security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-13757: Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping…
first Jul 31, 2020 -
High max 8.8ALAS2-2020-1466 6 CVEs
Important: libxml2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-14567: libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEML…