4,948 results · Feed
-
HighALAS2-2020-1418 1 CVE
Important: icu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-10531: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow…
first May 5, 2020 -
HighALAS2-2020-1417 1 CVE
Important: http-parser security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-15605: HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed 1800364: CVE-2019-15605 nodejs: HTT…
first May 5, 2020 -
High max 7.7ALAS2-2020-1420 1 CVE
Important: ipmitool security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-5208: It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to b…
first May 5, 2020 -
HighALAS2-2020-1422 1 CVE
Important: telnet security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-10188: utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer …
first May 5, 2020 -
High max 9.8ALAS2-2020-1412 2 CVEs
Important: python-pillow security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-5312: libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. 1789533: CVE-2020-5312 python-pillow: improperly restricted operations on m…
first Apr 20, 2020 -
High max 8.8ALAS2-2020-1411 1 CVE
Important: libvncserver security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-15690: No description is available for this CVE. 1811948: CVE-2019-15690 libvncserver: HandleCursorShape() integer overflow resulting in heap-based buffer overfl…
first Apr 20, 2020 -
HighALAS2-2020-1415 1 CVE
Important: xerces-c security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1311: The Apache Xerces-C 3.0.0 to 3.2.2 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addres…
first Apr 20, 2020 -
HighALAS2-2020-1414 7 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-6814: Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we pres…
first Apr 20, 2020 -
Medium max 9.8ALAS2-2020-1413 3 CVEs
Moderate: python-virtualenv security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11236: In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. 1700824: CVE-2019-11236 pytho…
first Apr 20, 2020 -
High max 8.3ALAS2-2020-1410 13 CVEs
Important: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-2830: No description is available for this CVE. 99999: CVE-2020-2830 OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) CVE-2020-2816: A flaw was …
first Apr 14, 2020 -
High max 9.3ALAS2-2020-1409 1 CVE
Important: git security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-5260: With a crafted URL that contains a newline in it, the credential helper machinery can be fooled to give credential information for a wrong host. The attack…
first Apr 13, 2020 -
HighALAS2-2020-1408 6 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-6800: Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memo…
first Mar 23, 2020 -
High max 7.7ALAS2-2020-1407 2 CVEs
Important: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-7039: tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-ba…
first Mar 23, 2020 -
HighALAS2-2020-1406 2 CVEs
Important: openssl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-1563: In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large n…
first Mar 23, 2020 -
HighALAS2-2019-1371 9 CVEs
Important: git security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-19604: Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 b…
first Dec 13, 2019 -
HighALAS2-2020-1404 1 CVE
Important: sudo security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-18634: In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedba…
first Mar 16, 2020 -
High max 8.1ALAS2-2020-1403 7 CVEs
Important: java-1.7.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-2659: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 a…
first Mar 16, 2020 -
HighALAS2-2020-1399 2 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-20096: In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service, aka CID-1d3ff0950e2b…
first Mar 2, 2020 -
High max 9.8ALAS2-2020-1400 1 CVE
Important: ppp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-8597: eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions. 1800727: CVE-2020-8597 ppp: Buffer…
first Mar 2, 2020 -
HighALAS2-2020-1401 1 CVE
Important: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-14378: ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment. 17…
first Mar 2, 2020 -
MediumALAS2-2020-1398 2 CVEs
Moderate: transfig security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-19797: read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write. 1786726: CVE-2019-19797 transfig: out-of-bounds write in read_colordef in read.…
first Feb 24, 2020 -
MediumALAS2-2020-1397 3 CVEs
Moderate: qt5-qtbase security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-19873: An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data. 1658998: CVE-2018-19873 qt5-qtbase: QBmpHandler segmentation …
first Feb 24, 2020 -
HighALAS2-2020-1394 1 CVE
Important: sqlite security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-13734: Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p…
first Feb 17, 2020 -
High max 7.3ALAS2-2020-1395 1 CVE
Important: apache-commons-beanutils security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-10086: In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classload…
first Feb 17, 2020 -
High max 8.1ALAS2-2020-1396 7 CVEs
Important: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-2659: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 a…
first Feb 17, 2020 -
High max 8.8
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-17026: Needed 1789214: CVE-2019-17026 Mozilla: IonMonkey type confusion with StoreElementHole and FallibleStoreElement CVE-2019-17024: Mozilla developers reporte…
first Feb 10, 2020 -
Medium max 7.8ALAS2-2020-1388 1 CVE
Moderate: systemd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-1712: No description is available for this CVE. 1794578: CVE-2020-1712 systemd: use-after-free when asynchronous polkit queries are performed
first Feb 3, 2020 -
Medium max 7.5ALAS2-2020-1389 2 CVEs
Moderate: python-pip security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11324: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certif…
first Feb 5, 2020 -
HighALAS2-2020-1391 1 CVE
Important: libarchive security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-18408: archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situati…
first Feb 5, 2020 -
High max 9.8ALAS2-2020-1390 1 CVE
Important: python-reportlab security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-17626: ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span co…
first Feb 5, 2020 -
High max 6.5ALAS2-2020-1381 1 CVE
Important: 389-ds-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-14824: A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this…
first Jan 14, 2020 -
HighALAS2-2020-1384 2 CVEs
Important: nss security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11745: A heap-based buffer overflow was found in the NSC_EncryptUpdate() function in Mozilla nss. A remote attacker could trigger this flaw via SRTP encrypt or d…
first Jan 14, 2020 -
HighALAS2-2020-1386 5 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-17012: Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we …
first Jan 14, 2020 -
LowALAS2-2020-1385 1 CVE
Low: tcpdump security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-19519: In tcpdump 4.9.2, a stack-based buffer over-read exists in the print_prefix function of print-hncp.c via crafted packet data because of missing initializa…
first Jan 14, 2020 -
High max 8.1ALAS2-2020-1387 12 CVEs
Important: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-2659: 99999: CVE-2020-2655: 99999: CVE-2020-2654: 99999: CVE-2020-2604: 99999: CVE-2020-2601: 99999: CVE-2020-2593: 99999: CVE-2020-2590: 99999: CVE-2020-2585: 9…
first Jan 14, 2020 -
MediumALAS2-2020-1379 2 CVEs
Moderate: nss-softokn security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11745: A heap-based buffer overflow was found in the NSC_EncryptUpdate() function in Mozilla nss. A remote attacker could trigger this flaw via SRTP encrypt or d…
first Jan 6, 2020 -
MediumALAS2-2020-1380 4 CVEs
Moderate: oniguruma security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-19246: Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c. 99999: CVE-2019-…
first Jan 6, 2020 -
LowALAS2-2019-1374 3 CVEs
Low: libsolv security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-20534: 99999: CVE-2018-20534 libsolv: illegal address access in pool_whatprovides in src/pool.h 1665538: CVE-2018-20534 libsolv: illegal address access in pool_w…
first Dec 13, 2019 -
High max 8.1ALAS2-2019-1375 2 CVEs
Important: SDL security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-14906: A flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. A heap-based buffer overflow flaw, in SDL whi…
first Dec 13, 2019 -
High max 6.5ALAS2-2019-1376 9 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-15903: In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_…
first Dec 13, 2019