4,948 results · Feed
-
LowALAS2-2019-1264 1 CVE
Low: mod_http2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-0196: A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed mem…
first Aug 7, 2019 -
Medium max 5.0ALAS2-2019-1263 2 CVEs
Moderate: libssh2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3861: An out of bounds read flaw was discovered in libssh2 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote…
first Aug 7, 2019 -
Medium max 5.3ALAS2-2019-1262 1 CVE
Moderate: 389-ds-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3883: It was found that encrypted connections did not honor the 'ioblocktimeout' parameter to end blocking requests. As a result, an unauthenticated at…
first Aug 7, 2019 -
High max 9.8ALAS2-2019-1259 1 CVE
Important: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-10160: A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an attacker to …
first Aug 7, 2019 -
High max 9.8ALAS2-2019-1258 1 CVE
Important: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-10160: A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an attacker to …
first Aug 7, 2019 -
Medium max 5.6ALAS2-2019-1253 1 CVE
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-1125: A Spectre gadget was found in the Linux kernel's implementation of system interrupts. An attacker with local access could use this information to reve…
first Aug 5, 2019 -
High max 8.6ALAS2-2019-1223 1 CVE
Important: python-jinja2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-10745: In Pallets Jinja before 2.8.1, str.format allows a sandbox escape. 1698345: CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via…
first Jun 11, 2019 -
High max 8.8ALAS2-2019-1249 4 CVEs
Important: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-8325: An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injectio…
first Jul 18, 2019 -
CriticalALAS2-2019-1251 6 CVEs
Critical: dnsmasq security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-14496: An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets to dnsmasq whic…
first Jul 18, 2019 -
Critical max 10.0
Critical: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11708: 1722673: CVE-2019-11708 Mozilla: Sandbox escape using Prompt:Open CVE-2019-11707: 1721789: CVE-2019-11707 Mozilla: Type confusion in Array.pop CVE-2019-11…
first Jul 18, 2019 -
HighALAS2-2019-1248 4 CVEs
Important: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9824: tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. 167851…
first Jul 18, 2019 -
High max 6.5ALAS2-2019-1247 2 CVEs
Important: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9947: An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls…
first Jul 18, 2019 -
Medium max 5.3ALAS2-2019-1246 9 CVEs
Moderate: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-7317: png_image_free in png.c in libpng 1.6.36 has a use-after-free because png_image_free_function is called under png_safe_execute. 1672409: CVE-2019-7317 libp…
first Jul 18, 2019 -
High max 7.9ALAS2-2019-1214 6 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9500: If the Wake-up on Wireless LAN functionality is configured in the brcmfmac driver, which only works with Broadcom FullMAC chipsets, a malicious event frame…
first May 29, 2019 -
Low max 7.8ALAS2-2019-1233 2 CVEs
Low: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-5436: A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. 1710620: CVE-2019-5…
first Jul 18, 2019 -
High max 7.5ALAS2-2019-1231 1 CVE
Important: bind security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-5743: A flaw was found in the way bind implemented tunable which limited simultaneous TCP client connections. A remote attacker could use this flaw to exhaust th…
first Jun 25, 2019 -
High max 6.5ALAS2-2019-1230 5 CVEs
Important: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9636: Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalizatio…
first Jun 25, 2019 -
Critical max 7.5ALAS2-2019-1222 3 CVEs
Critical: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11479: CVE-2019-11478: CVE-2019-11477:
first Jun 13, 2019 -
Critical max 5.3ALAS2-2019-1229 12 CVEs
Critical: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9820: 1712629: CVE-2019-9820 Mozilla: Use-after-free of ChromeEventHandler by DocShell CVE-2019-9819: 1712628: CVE-2019-9819 Mozilla: Compartment mismatch with f…
first Jun 11, 2019 -
HighALAS2-2019-1228 4 CVEs
Important: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-2698: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult t…
first Jun 11, 2019 -
HighALAS2-2019-1227 1 CVE
Important: wget security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-5953: Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified …
first Jun 11, 2019 -
MediumALAS2-2019-1226 2 CVEs
Moderate: libX11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-14599: An off-by-one error has been discovered in libX11 in functions XGetFontPath(), XListExtensions(), and XListFonts(). An attacker who can either configure a…
first Jun 11, 2019 -
High max 5.3ALAS2-2019-1204 2 CVEs
Important: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9636: Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalizatio…
first May 2, 2019 -
MediumALAS2-2019-1220 12 CVEs
Moderate: libxml2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2015-8710: It was discovered that libxml2 could access out-of-bounds memory when parsing unclosed HTML comments. A remote attacker could provide a specially crafted X…
first May 29, 2019 -
HighALAS2-2019-1219 1 CVE
Important: flatpak security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-10063: Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by …
first May 29, 2019 -
HighALAS2-2019-1218 2 CVEs
Important: freeradius security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11235: FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is…
first May 29, 2019 -
LowALAS2-2019-1217 3 CVEs
Low: poppler security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-13988: Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrate…
first May 29, 2019 -
Medium max 6.8ALAS2-2019-1216 3 CVEs
Moderate: openssh security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-6111: An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to t…
first May 29, 2019 -
Low max 9.8ALAS2-2019-1211 1 CVE
Low: python-urllib3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-20060: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, p…
first May 16, 2019 -
HighALAS2-2019-1209 3 CVEs
Important: java-1.7.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-2698: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult t…
first May 16, 2019 -
High max 8.1ALAS2-2019-1200 2 CVEs
Important: mod_auth_mellon security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3878: A vulnerability was found in mod_auth_mellon. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticate…
first May 16, 2019 -
High max 7.8
Important: httpd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-0220: 1695036: CVE-2019-0220 httpd: URL normalization inconsistency CVE-2019-0217: A race condition was found in mod_auth_digest when the web server was running …
first Apr 4, 2019 -
MediumALAS2-2019-1203 1 CVE
Moderate: gnupg2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2014-4617: The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of servi…
first May 2, 2019 -
HighALAS2-2019-1201 3 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-7308: A bypass was found for the Spectre v1 hardening in the eBPF engine of the Linux kernel. The code in the kernel/bpf/verifier.c performs undesirable out-of-b…
first May 2, 2019 -
High max 7.5ALAS2-2019-1199 4 CVEs
Important: libssh2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3863: A flaw was found in libssh2 before 1.8.1. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigne…
first Apr 25, 2019 -
LowALAS2-2019-1198 1 CVE
Low: libjpeg-turbo security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-11212: A divide by zero vulnerability has been discovered in libjpeg-turbo in alloc_sarray function of jmemmgr.c file. An attacker could use this vulnerability t…
first Apr 25, 2019 -
LowALAS2-2019-1197 1 CVE
Low: mod_http2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-17189: In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecess…
first Apr 25, 2019 -
High max 7.5ALAS2-2019-1196 1 CVE
Important: openwsman security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3816: Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to ro…
first Apr 25, 2019 -
CriticalALAS2-2019-1195 10 CVEs
Critical: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9813: 1692182: CVE-2019-9813 Mozilla: Ionmonkey type confusion with __proto__ mutations CVE-2019-9810: 1692181: CVE-2019-9810 Mozilla: IonMonkey MArraySlice has …
first Apr 25, 2019 -
MediumALAS2-2019-1193 3 CVEs
Moderate: mariadb security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-3282: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Storage Engines). Supported versions that are affected are 5.5.61 and pr…
first Apr 8, 2019