4,948 results · Feed
-
High max 7.8ALAS2-2026-3268 4 CVEs
Important: xorg-x11-server security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes() CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap() CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerF…
first Apr 27, 2026 -
High max 8.6ALAS2-2026-3267 2 CVEs
Important: OpenEXR security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34588: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.…
first Apr 27, 2026 -
Medium max 5.1ALAS2-2026-3266 1 CVE
Moderate: libpng security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34757: Use-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST in libpng before 1.6.57. Passing a pointer returned by the corresponding getter back into th…
first Apr 27, 2026 -
High max 9.8ALAS2-2026-3265 10 CVEs
Important: nerdctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-39984: Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the V…
first Apr 27, 2026 -
High max 9.1ALAS2-2026-3264 1 CVE
Important: rclone security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the H…
first Apr 27, 2026 -
High max 7.5ALAS2-2026-3262 1 CVE
Important: openssh security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-35385: In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is pe…
first Apr 27, 2026 -
High max 9.3ALAS2-2026-3261 1 CVE
Important: flatpak security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34078: A complete sandbox escape vulnerability exists in Flatpak before 1.16.4. The Flatpak portal accepts paths in the sandbox-expose options which can be app-c…
first Apr 27, 2026 -
Medium max 9.8ALAS2-2026-3260 8 CVEs
Moderate: golist security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content. This could cause ac…
first Apr 27, 2026 -
High max 9.8ALAS2-2026-3259 9 CVEs
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content. This could cause ac…
first Apr 27, 2026 -
High max 8.1ALAS2-2026-3258 2 CVEs
Important: LibRaw security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-24660: A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A specially crafted malicious file can l…
first Apr 27, 2026 -
High max 7.5ALAS2-2026-3257 1 CVE
Important: libarchive security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-5121: A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker…
first Apr 27, 2026 -
Low max 2.0ALAS2-2026-3256 1 CVE
Low: python-pip security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-1703: When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is…
first Apr 27, 2026 -
High max 9.8ALAS2-2026-3255 2 CVEs
Important: LibRaw security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-21413: A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially cra…
first Apr 27, 2026 -
High max 5.3ALAS2-2026-3254 1 CVE
Important: python-jwcrypto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-39373: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by s…
first Apr 27, 2026 -
Medium max 6.8ALAS2-2026-3253 1 CVE
Moderate: python3-pytest security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-71176: pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or p…
first Apr 13, 2026 -
High max 7.4ALAS2-2026-3252 2 CVEs
Important: dovecot security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-27857: Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection.…
first Apr 13, 2026 -
High max 8.2ALAS2-2026-3251 1 CVE
Important: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34982: A modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The complete, guitabtooltip and printheader optio…
first Apr 13, 2026 -
Medium max 5.1ALAS2-2026-3250 1 CVE
Moderate: gstreamer-plugins-good security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-1940: An out-of-bounds read in the WAV parser that can cause crashes for certain input files.
first Apr 13, 2026 -
High max 7.8ALAS2023-2026-1553 4 CVEs
Important: gdk-pixbuf2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-5201: A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of …
first Apr 13, 2026 -
High max 8.1ALAS2-2026-3249 4 CVEs
Important: openssl11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-28390: Possible NULL dereference when processing CMS KeyTransportRecipientInfo CVE-2026-28389: Possible NULL dereference when processing CMS KeyAgreeRecipientInf…
-
High max 9.1ALAS2-2026-3248 4 CVEs
Important: amazon-cloudwatch-agent security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the H…
-
Medium max 6.9ALAS2-2026-3247 2 CVEs
Moderate: libvncserver security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-32854: LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpPr…
-
Medium max 7.1ALAS2-2026-3246 3 CVEs
Moderate: rust security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33056: tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function …
-
High max 7.5ALAS2-2026-3245 5 CVEs
Important: amazon-efs-utils security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4428: A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows…
-
High max 7.5ALAS2-2026-3244 1 CVE
Important: libpng security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33416: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.…
-
High max 7.5ALAS2-2026-3243 1 CVE
Important: libpng12 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33416: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.…
-
High max 9.2ALAS2-2026-3242 2 CVEs
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33526: Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic…
-
High max 10.0ALAS2-2026-3241 41 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4721: Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evid…
-
High max 7.5ALAS2-2026-3240 1 CVE
Important: gdk-pixbuf2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-5201: A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of col…
-
Medium max 6.5ALAS2-2026-3239 7 CVEs
Moderate: freerdp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-31897: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in freerdp_bitmap_decompress_planar when …
-
High max 7.5ALAS2-2026-3238 6 CVEs
Important: freerdp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33986: H.264 YUV Buffer Dimension Desync - Heap OOB Write NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h6qw-wxvm-hf97 CVE-2026-33985: ClearC…
-
High max 9.1ALAS2-2026-3236 2 CVEs
Important: cri-tools security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the H…
-
High max 7.8ALAS2-2026-3235 1 CVE
Important: libtiff security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4775: A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function b…
-
High max 7.8ALAS2-2026-3234 1 CVE
Important: compat-libtiff3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4775: A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function b…
-
High max 8.8ALAS2-2026-3233 1 CVE
Important: plexus-utils security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-67030: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b2…
-
High max 7.5ALAS2-2026-3232 1 CVE
Important: nghttp2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-27135: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming da…
-
Medium max 8.5ALAS2-2026-3231 1 CVE
Moderate: tigervnc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-34352: In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, becaus…
-
High max 9.8ALAS2-2026-3230 2 CVEs
Important: perl-XML-Parser security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2006-10003: XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack w…
first Mar 30, 2026 -
High max 9.1ALAS2-2026-3229 4 CVEs
Important: nerdctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the H…
first Mar 30, 2026 -
High max 7.0ALAS2-2026-3228 3 CVEs
Important: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-4519: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior reje…
first Mar 30, 2026