4,948 results · Feed
-
MediumALAS2-2019-1328 2 CVEs
Moderate: mercurial security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-8383: An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered b…
first Oct 21, 2019 -
MediumALAS2-2019-1330 1 CVE
Moderate: perl-Archive-Tar security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-12015: It was found that the Archive::Tar module did not properly sanitize symbolic links when extracting tar archives. An attacker, able to provide a specially …
first Oct 21, 2019 -
MediumALAS2-2019-1329 2 CVEs
Moderate: mod_auth_openidc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-6413: It was found that mod_auth_openidc did not properly sanitize HTTP headers for certain request paths. A remote attacker could potentially use this flaw to b…
first Oct 21, 2019 -
MediumALAS2-2019-1327 10 CVEs
Moderate: libtiff security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-8905: In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps. 999…
first Oct 21, 2019 -
MediumALAS2-2019-1325 5 CVEs
Moderate: libarchive security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-1000020: libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condi…
first Oct 21, 2019 -
Low max 7.8ALAS2-2019-1324 2 CVEs
Low: keycloak-httpd-client-install security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-15112: In keycloak-http-client-install prior to version 0.8, the admin password could be provided through a command-line argument. This might result in the passw…
first Oct 21, 2019 -
MediumALAS2-2019-1323 1 CVE
Moderate: keepalived security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-19044: keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed …
first Oct 21, 2019 -
MediumALAS2-2019-1322 2 CVEs
Moderate: http-parser security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-7159: It was found that the http module from Node.js could accept incorrect Content-Length values, containing spaces within the value, in HTTP headers. A special…
first Oct 21, 2019 -
LowALAS2-2019-1321 5 CVEs
Low: exempi security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-7730: An integer wraparound, leading to a buffer overflow, was found in Exempi in the way it handles Adobe Photoshop Images. An attacker could exploit this to ca…
first Oct 21, 2019 -
LowALAS2-2019-1320 1 CVE
Low: blktrace security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-10689: blktrace (aka Block IO Tracing) 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the dev_map_read function in btt/devmap.c becau…
first Oct 21, 2019 -
LowALAS2-2019-1319 2 CVEs
Low: advancecomp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-8383: An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered b…
first Oct 21, 2019 -
HighALAS2-2019-1318 2 CVEs
Important: SDL2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-13616: A heap-based buffer overflow was discovered in SDL in the SDL_BlitCopy() function, that was called while copying an existing surface into a new optimized …
first Oct 21, 2019 -
MediumALAS2-2019-1281 2 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-9363: A buffer overflow due to a singed-unsigned comparsion was found in hidp_process_report() in the net/bluetooth/hidp/core.c in the Linux kernel. The buffer l…
first Sep 13, 2019 -
High max 7.5ALAS2-2019-1293 2 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-14835: A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descripto…
first Sep 25, 2019 -
HighALAS2-2019-1316 17 CVEs
Important: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-2999: No description is available for this CVE. 99999: CVE-2019-2999 OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) CVE-2…
first Oct 15, 2019 -
HighALAS2-2019-1315 3 CVEs
Important: sudo security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-14287: CVE-2017-1000368: It was found that the original fix for CVE-2017-1000367 was incomplete. A flaw was found in the way sudo parsed tty information from the…
first Oct 11, 2019 -
MediumALAS2-2019-1313 1 CVE
Moderate: optipng security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-2191: The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and cr…
first Oct 8, 2019 -
MediumALAS2-2019-1312 11 CVEs
Moderate: opensc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-16427: Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentiall…
first Oct 8, 2019 -
LowALAS2-2019-1311 1 CVE
Low: libwpd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-19208: In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial…
first Oct 8, 2019 -
MediumALAS2-2019-1310 2 CVEs
Moderate: libmspack security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-18585: chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\\0' as its first or second character (such as the …
first Oct 8, 2019 -
High max 7.5ALAS2-2019-1298 2 CVEs
Important: nghttp2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9513: Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and…
first Oct 8, 2019 -
MediumALAS2-2019-1305 2 CVEs
Moderate: nss security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-12404: A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive…
first Sep 30, 2019 -
HighALAS2-2019-1304 7 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11752: It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially e…
first Sep 30, 2019 -
Medium max 7.3ALAS2-2019-1303 1 CVE
Moderate: libssh2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3862: An out of bounds read flaw was discovered in libssh2 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A re…
first Sep 30, 2019 -
MediumALAS2-2019-1302 4 CVEs
Moderate: ncurses security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-11113: In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service at…
first Sep 30, 2019 -
Medium max 9.8ALAS2-2019-1301 2 CVEs
Moderate: libxml2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-16931: parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case …
first Sep 30, 2019 -
LowALAS2-2019-1278 1 CVE
Low: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-9516: A flaw was found in the Linux kernel in the hid_debug_events_read() function in the drivers/hid/hid-debug.c file. A lack of the certain checks may result i…
first Sep 13, 2019 -
MediumALAS2-2019-1280 2 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-9363: A buffer overflow due to a singed-unsigned comparsion was found in hidp_process_report() in the net/bluetooth/hidp/core.c in the Linux kernel. The buffer l…
first Sep 13, 2019 -
LowALAS2-2019-1279 1 CVE
Low: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-7755: An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel. The floppy driver will copy a kernel pointer to user…
first Sep 13, 2019 -
Medium max 8.7ALAS2-2019-1290 5 CVEs
Moderate: edk2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-0161: Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access. 1694065: CVE-2019-0161 edk2: …
first Sep 13, 2019 -
MediumALAS2-2019-1288 2 CVEs
Moderate: oniguruma security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-13225: A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted re…
first Sep 13, 2019 -
Medium max 9.1ALAS2-2019-1291 1 CVE
Moderate: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9948: urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blackl…
first Sep 13, 2019 -
HighALAS2-2019-1269 9 CVEs
Important: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-2842: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JCE). The supported version that is affected is Java SE: 8u212. Difficult to exploi…
first Aug 23, 2019 -
MediumALAS2-2019-1268 6 CVEs
Moderate: java-1.7.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-2842: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JCE). The supported version that is affected is Java SE: 8u212. Difficult to exploi…
first Aug 23, 2019 -
High max 7.5ALAS2-2019-1272 2 CVEs
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9514: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends a…
first Aug 23, 2019 -
High max 8.8ALAS2-2019-1274 9 CVEs
Important: libvirt security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11091: Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure vi…
first Aug 23, 2019 -
High max 8.8ALAS2-2019-1275 3 CVEs
Important: pacemaker security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3885: A use-after-free flaw was found in pacemaker which could result in certain sensitive information to be leaked via the system logs. 1694554: CVE-2019-3885 p…
first Aug 23, 2019 -
Medium max 9.8ALAS2-2019-1276 14 CVEs
Moderate: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-8780: It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path…
first Aug 23, 2019 -
HighALAS2-2019-1239 1 CVE
Important: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-12735: It was found that the `:source!` command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file…
first Aug 7, 2019 -
CriticalALAS2-2019-1267 7 CVEs
Critical: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9811: As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature t…
first Aug 8, 2019