4,948 results · Feed
-
High max 8.6ALAS2023-2026-1712 3 CVEs
Important: python-pillow security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42311: Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, pote…
first May 25, 2026 -
Medium max 4.8ALAS2023-2026-1772 1 CVE
Moderate: capstone security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68114: Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vs…
-
High max 7.5ALAS2023-2026-1771 7 CVEs
Important: ecs-init security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42499: Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. CVE-2026-39826: If a trusted template au…
-
High max 9.8ALAS2023-2026-1770 7 CVEs
Important: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-43515: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects…
-
Medium max 7.3ALAS2023-2026-1769 1 CVE
Moderate: perl-YAML-Syck security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-5089: YAML::Syck versions before 1.38 for Perl has an out-of-bounds read. The base60 (sexagesimal) parsing code in perl_syck.h has a buffer underflow bug in b…
-
High max 8.8ALAS2023-2026-1768 8 CVEs
Important: postgresql15 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6637: Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running …
-
High max 8.8ALAS2023-2026-1767 9 CVEs
Important: postgresql16 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6638: SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL wi…
-
High max 8.8ALAS2023-2026-1766 10 CVEs
Important: postgresql17 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6638: SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL wi…
-
Medium max 6.5ALAS2023-2026-1765 1 CVE
Moderate: perl-HTTP-Tiny security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-7010: HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the meth…
-
Medium max 6.5ALAS2023-2026-1764 1 CVE
Moderate: perl-libwww-perl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-8368: LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redire…
-
Medium max 5.3ALAS2023-2026-1759 1 CVE
Moderate: libssh security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-3731: A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the fil…
-
High max 8.8ALAS2023-2026-1711 2 CVEs
Important: libpq security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6478: Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to aut…
-
Low max 3.3ALAS2023-2026-1707 1 CVE
Low: glslang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-3010: A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TI…
-
Low max 2.9ALAS2023-2026-1706 1 CVE
Low: firefox security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-41080: libexpat before 2.7.6 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
-
Medium max 6.7ALAS2023-2026-1705 1 CVE
Moderate: libgcrypt security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-41989: Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.
-
Medium max 5.5ALAS2023-2026-1704 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-42050: Stack buffer overflow in XTileImage
-
Medium max 7.5ALAS2023-2026-1703 3 CVEs
Moderate: nss security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6772: Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10…
-
High max 9.8ALAS2023-2026-1695 106 CVEs
Important: kernel6.12 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-43341: In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill CVE-2026-43339: In …
first May 8, 2026 -
High max 9.8ALAS2023-2026-1693 78 CVEs
Important: kernel6.18 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-43350: In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before reading mode bits CVE-2026-43284: I…
first May 8, 2026 -
LowALAS2023-2026-1662 0 CVEs
Low: aws-cfn-bootstrap security update (Amazon Linux 2023)
first May 11, 2026 -
Low max 9.8ALAS2023-2026-1701 1 CVE
Low: socat security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-54661: readline.sh in socat through 1.8.0.1 relies on the /tmp/$USER/stderr2 file.
first May 11, 2026 -
Medium max 9.8ALAS2023-2026-1700 8 CVEs
Moderate: soci-snapshotter security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content. This could cause…
first May 11, 2026 -
Medium max 7.5ALAS2023-2026-1699 1 CVE
Moderate: curl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-3805: When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.
first May 11, 2026 -
Medium max 8.4ALAS2023-2026-1697 1 CVE
Moderate: perl-Text-CSV_XS security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-7111: CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or …
first May 11, 2026 -
High max 8.1ALAS2023-2026-1690 1 CVE
Important: ruby3.4 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-41316: ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB…
first May 11, 2026 -
High max 5.3ALAS2023-2026-1689 1 CVE
Important: python-pip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6357: pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules name…
first May 11, 2026 -
High max 9.8ALAS2023-2026-1694 16 CVEs
Important: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-43336: In the Linux kernel, the following vulnerability has been resolved: lib/crypto: chacha: Zeroize permuted_state before it leaves scope CVE-2026-43284: I…
first May 8, 2026 -
High max 8.8ALAS2-2026-3302 2 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-43500: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present CVE-2026-43284:…
first May 8, 2026 -
High max 7.5ALAS2-2026-3301 2 CVEs
Important: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-22016: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported vers…
first May 11, 2026 -
Medium max 2.9ALAS2-2026-3298 1 CVE
Moderate: xdg-desktop-portal security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-40354: Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_f…
first May 11, 2026 -
High max 7.5ALAS2-2026-3297 1 CVE
Important: python-lxml security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-41066: lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with r…
first May 11, 2026 -
High max 5.1ALAS2-2026-3296 1 CVE
Important: rust security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-6654: Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips sett…
first May 11, 2026 -
High max 9.6ALAS2-2026-3295 3 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-7323: Memory safety bugs present in Firefox ESR 140.10.0, Thunderbird ESR 140.10.0, Firefox 150.0.0 and Thunderbird 150.0.0. Some of these bugs showed evidence o…
first May 11, 2026 -
Low max 3.9ALAS2-2026-3294 1 CVE
Low: microcode_ctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-31648: Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege. Startup code and smm adversary …
first May 11, 2026 -
MediumALAS2-2026-3293 0 CVEs
Moderate: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-5763: virtio-scsi request size mismatch NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/79971302935472232a68073faddb085177e3ca54 (v11.0.0-rc3) CVE-…
first May 11, 2026 -
High max 6.6ALAS2-2026-3292 1 CVE
Important: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-41411: Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving …
first May 11, 2026 -
Medium max 5.5ALAS2-2026-3291 1 CVE
Moderate: libXpm security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4367: As per upstream advisory: libXpm Out-of-bounds read in xpmNextWord()
first May 11, 2026 -
High max 9.8ALAS2-2026-3290 25 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-6786: Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corru…
first May 11, 2026 -
Medium max 7.5ALAS2-2026-3288 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33901: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffe…
first May 11, 2026 -
Medium max 7.2ALAS2-2026-3287 1 CVE
Moderate: python3-tornado security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-35536: In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not ch…
first May 11, 2026