5,011 results · Feed
-
MediumALAS2-2019-1312 11 CVEs
Moderate: opensc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-16427: Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentiall…
first Oct 8, 2019 -
LowALAS2-2019-1311 1 CVE
Low: libwpd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-19208: In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial…
first Oct 8, 2019 -
MediumALAS2-2019-1310 2 CVEs
Moderate: libmspack security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-18585: chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\\0' as its first or second character (such as the …
first Oct 8, 2019 -
High max 7.5ALAS2-2019-1298 2 CVEs
Important: nghttp2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9513: Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and…
first Oct 8, 2019 -
MediumALAS2-2019-1305 2 CVEs
Moderate: nss security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-12404: A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive…
first Sep 30, 2019 -
HighALAS2-2019-1304 7 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11752: It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially e…
first Sep 30, 2019 -
Medium max 7.3ALAS2-2019-1303 1 CVE
Moderate: libssh2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3862: An out of bounds read flaw was discovered in libssh2 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A re…
first Sep 30, 2019 -
MediumALAS2-2019-1302 4 CVEs
Moderate: ncurses security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-11113: In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service at…
first Sep 30, 2019 -
Medium max 9.8ALAS2-2019-1301 2 CVEs
Moderate: libxml2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-16931: parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case …
first Sep 30, 2019 -
LowALAS2-2019-1278 1 CVE
Low: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-9516: A flaw was found in the Linux kernel in the hid_debug_events_read() function in the drivers/hid/hid-debug.c file. A lack of the certain checks may result i…
first Sep 13, 2019 -
MediumALAS2-2019-1280 2 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-9363: A buffer overflow due to a singed-unsigned comparsion was found in hidp_process_report() in the net/bluetooth/hidp/core.c in the Linux kernel. The buffer l…
first Sep 13, 2019 -
LowALAS2-2019-1279 1 CVE
Low: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-7755: An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel. The floppy driver will copy a kernel pointer to user…
first Sep 13, 2019 -
Medium max 8.7ALAS2-2019-1290 5 CVEs
Moderate: edk2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-0161: Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access. 1694065: CVE-2019-0161 edk2: …
first Sep 13, 2019 -
MediumALAS2-2019-1288 2 CVEs
Moderate: oniguruma security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-13225: A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted re…
first Sep 13, 2019 -
Medium max 9.1ALAS2-2019-1291 1 CVE
Moderate: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9948: urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blackl…
first Sep 13, 2019 -
HighALAS2-2019-1269 9 CVEs
Important: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-2842: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JCE). The supported version that is affected is Java SE: 8u212. Difficult to exploi…
first Aug 23, 2019 -
MediumALAS2-2019-1268 6 CVEs
Moderate: java-1.7.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-2842: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JCE). The supported version that is affected is Java SE: 8u212. Difficult to exploi…
first Aug 23, 2019 -
High max 7.5ALAS2-2019-1272 2 CVEs
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9514: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends a…
first Aug 23, 2019 -
High max 8.8ALAS2-2019-1274 9 CVEs
Important: libvirt security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11091: Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure vi…
first Aug 23, 2019 -
High max 8.8ALAS2-2019-1275 3 CVEs
Important: pacemaker security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3885: A use-after-free flaw was found in pacemaker which could result in certain sensitive information to be leaked via the system logs. 1694554: CVE-2019-3885 p…
first Aug 23, 2019 -
Medium max 9.8ALAS2-2019-1276 14 CVEs
Moderate: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-8780: It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path…
first Aug 23, 2019 -
HighALAS2-2019-1239 1 CVE
Important: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-12735: It was found that the `:source!` command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file…
first Aug 7, 2019 -
CriticalALAS2-2019-1267 7 CVEs
Critical: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9811: As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature t…
first Aug 8, 2019 -
LowALAS2-2019-1264 1 CVE
Low: mod_http2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-0196: A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed mem…
first Aug 7, 2019 -
Medium max 5.0ALAS2-2019-1263 2 CVEs
Moderate: libssh2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3861: An out of bounds read flaw was discovered in libssh2 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote…
first Aug 7, 2019 -
Medium max 5.3ALAS2-2019-1262 1 CVE
Moderate: 389-ds-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3883: It was found that encrypted connections did not honor the 'ioblocktimeout' parameter to end blocking requests. As a result, an unauthenticated at…
first Aug 7, 2019 -
High max 9.8ALAS2-2019-1259 1 CVE
Important: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-10160: A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an attacker to …
first Aug 7, 2019 -
High max 9.8ALAS2-2019-1258 1 CVE
Important: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-10160: A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an attacker to …
first Aug 7, 2019 -
Medium max 5.6ALAS2-2019-1253 1 CVE
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-1125: A Spectre gadget was found in the Linux kernel's implementation of system interrupts. An attacker with local access could use this information to reve…
first Aug 5, 2019 -
High max 8.6ALAS2-2019-1223 1 CVE
Important: python-jinja2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-10745: In Pallets Jinja before 2.8.1, str.format allows a sandbox escape. 1698345: CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via…
first Jun 11, 2019 -
High max 8.8ALAS2-2019-1249 4 CVEs
Important: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-8325: An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injectio…
first Jul 18, 2019 -
CriticalALAS2-2019-1251 6 CVEs
Critical: dnsmasq security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-14496: An integer underflow flaw leading to a buffer over-read was found in dnsmasq in the EDNS0 code. An attacker could send crafted DNS packets to dnsmasq whic…
first Jul 18, 2019 -
Critical max 10.0
Critical: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11708: 1722673: CVE-2019-11708 Mozilla: Sandbox escape using Prompt:Open CVE-2019-11707: 1721789: CVE-2019-11707 Mozilla: Type confusion in Array.pop CVE-2019-11…
first Jul 18, 2019 -
HighALAS2-2019-1248 4 CVEs
Important: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9824: tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. 167851…
first Jul 18, 2019 -
High max 6.5ALAS2-2019-1247 2 CVEs
Important: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9947: An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls…
first Jul 18, 2019 -
Medium max 5.3ALAS2-2019-1246 9 CVEs
Moderate: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-7317: png_image_free in png.c in libpng 1.6.36 has a use-after-free because png_image_free_function is called under png_safe_execute. 1672409: CVE-2019-7317 libp…
first Jul 18, 2019 -
High max 7.9ALAS2-2019-1214 6 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9500: If the Wake-up on Wireless LAN functionality is configured in the brcmfmac driver, which only works with Broadcom FullMAC chipsets, a malicious event frame…
first May 29, 2019 -
Low max 7.8ALAS2-2019-1233 2 CVEs
Low: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-5436: A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1. 1710620: CVE-2019-5…
first Jul 18, 2019 -
High max 7.5ALAS2-2019-1231 1 CVE
Important: bind security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-5743: A flaw was found in the way bind implemented tunable which limited simultaneous TCP client connections. A remote attacker could use this flaw to exhaust th…
first Jun 25, 2019 -
High max 6.5ALAS2-2019-1230 5 CVEs
Important: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9636: Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalizatio…
first Jun 25, 2019