5,011 results · Feed
-
High max 7.5ALAS2-2018-1036 1 CVE
Important: 389-ds-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1089: It was found that 389-ds-base did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, …
first Jun 8, 2018 -
HighALAS2-2018-1035 2 CVEs
Important: git security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-11235: In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a …
first Jun 7, 2018 -
High max 5.5ALAS2-2018-1034 7 CVEs
Important: qemu-kvm security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-7858: Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (…
first Jun 7, 2018 -
High max 5.5ALAS2-2018-1033 1 CVE
Important: libvirt security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-3639: An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a c…
first Jun 7, 2018 -
CriticalALAS2-2018-1032 12 CVEs
Critical: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-5185: 1580241: CVE-2018-5185 Mozilla: Leaking plaintext through HTML forms CVE-2018-5184: 1580236: CVE-2018-5184 Mozilla: Full plaintext recovery in S/MIME via c…
first Jun 7, 2018 -
High max 7.3ALAS2-2018-1031 2 CVEs
Important: procps-ng security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1126: A flaw was found where procps-ng provides wrappers for standard C allocators that took `unsigned int` instead of `size_t` parameters. On platforms where th…
first Jun 7, 2018 -
LowALAS2-2018-1030 1 CVE
Low: xdg-user-dirs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-15131: It was found that the system umask policy is not being honored when creating XDG user directories (~/Desktop etc) on first login. This could lead to user&…
first Jun 7, 2018 -
High max 9.1ALAS2-2018-1029 2 CVEs
Important: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1000301: curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl ca…
first Jun 7, 2018 -
High max 8.0ALAS2-2018-1023 7 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-8897: A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stac…
first May 24, 2018 -
MediumALAS2-2018-964 1 CVE
Moderate: memcached security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1000115: It was discovered that the memcached connections using UDP transport protocol can be abused for efficient traffic amplification distributed denial of se…
first Mar 8, 2018 -
MediumALAS2-2018-1022 1 CVE
Moderate: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-10194: The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in te…
first May 24, 2018 -
Critical max 7.5ALAS2-2018-1021 1 CVE
Critical: dhcp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1111: A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Amazon Linux 2. A malicious DHCP server…
first May 24, 2018 -
Medium max 7.5ALAS2-2018-1020 1 CVE
Moderate: nghttp2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1000168: nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can resu…
first May 24, 2018 -
LowALAS2-2018-1015 1 CVE
Low: libvpx security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-13194: A vulnerability in the Android media framework (libvpx) related to odd frame width. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A…
first May 10, 2018 -
High max 7.5ALAS2-2018-1014 1 CVE
Important: corosync security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1084: An integer overflow leading to an out-of-bound read was found in authenticate_nss_2_3() in Corosync. An attacker could craft a malicious packet that would …
first May 10, 2018 -
MediumALAS2-2018-1013 3 CVEs
Moderate: zsh security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1100: A buffer overflow flaw was found in the zsh shell check path functionality. A local, unprivileged user can create a specially crafted message file, which, …
-
MediumALAS2-2018-1012 1 CVE
Moderate: libvncserver security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-7225: An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access …
-
MediumALAS2-2018-1011 3 CVEs
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-6574: An arbitrary command execution flaw was found in the way Go's "go get" command handled gcc and clang sensitive options during the build. A r…
-
Medium max 6.5ALAS2-2018-1010 2 CVEs
Moderate: krb5 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-7562: An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates. A remote attacker able to …
-
MediumALAS2-2018-1009 8 CVEs
Moderate: ntp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-6464: A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by …
-
HighALAS2-2018-1008 1 CVE
Important: patch security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1000156: GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) ca…
-
Critical max 5.3ALAS2-2018-1007 10 CVEs
Critical: java-1.7.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-2815: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are…
-
MediumALAS2-2018-1006 1 CVE
Moderate: PackageKit security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1106: An authentication bypass flaw has been found in PackageKit that allows users without administrator privileges to install signed packages. A local attacker …
-
High max 8.7ALAS2-2018-1005 3 CVEs
Important: pcs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1086: It was found that the REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensit…
-
MediumALAS2-2018-1004 4 CVEs
Moderate: openssl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-0737: OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks durin…
-
Critical max 5.3ALAS2-2018-1002 10 CVEs
Critical: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-2815: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are…
-
MediumALAS2-2018-996 0 CVEs
Moderate: stunnel security update (Amazon Linux 2)
first Apr 19, 2018 -
High max 9.8ALAS2-2018-999 1 CVE
Important: slf4j security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-8088: An XML deserialization vulnerability was discovered in slf4j's EventData which accepts anXML serialized string and can lead to arbitrary code executio…
-
CriticalALAS2-2018-998 1 CVE
Critical: librelp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1000140: rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in …
-
Medium max 9.8ALAS2-2018-995 3 CVEs
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1000122: A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service…
-
MediumALAS2-2018-992 2 CVEs
Moderate: glibc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-6551: The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not proper…
-
MediumALAS2-2018-987 1 CVE
Moderate: mod_wsgi security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2014-8583: mod_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, which might allow…
-
LowALAS2-2018-986 4 CVEs
Low: zsh security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-7549: In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p. 1549858: CVE-2018-7549 zsh: crash o…
-
MediumALAS2-2018-985 1 CVE
Moderate: mailman security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-5950: A cross-site scripting (XSS) flaw was found in mailman. An attacker, able to trick the user into visiting a specific URL, can execute arbitrary web scripts…
-
High max 7.5ALAS2-2018-984 2 CVEs
Important: dhcp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-5733: A denial of service flaw was found in the way dhcpd handled reference counting when processing client requests. A malicious DHCP client could use this flaw…
-
HighALAS2-2018-951 2 CVEs
Important: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1000007: libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl…
first Feb 7, 2018 -
CriticalALAS2-2018-981 1 CVE
Critical: libvorbis security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-5146: An out of bounds write flaw was found in the processing of vorbis audio data. A maliciously crafted file or audio stream could cause the application to cra…
first Mar 22, 2018 -
HighALAS2-2018-980 2 CVEs
Important: 389-ds-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1054: An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters. A remote, unauthenticated attacker could potentiall…
first Mar 21, 2018 -
HighALAS2-2018-971 1 CVE
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1068: A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to…
-
Medium max 5.3ALAS2-2018-963 1 CVE
Moderate: dhcp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-3144: It was found that the DHCP daemon did not properly clean up closed OMAPI connections in certain cases. A remote attacker able to connect to the OMAPI port …
first Feb 20, 2018