4,948 results · Feed
-
Medium max 4.3ALAS2023-2026-1475 2 CVEs
Moderate: gvfs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-28296: A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths…
first Mar 16, 2026 -
Medium max 7.5ALAS2023-2026-1474 1 CVE
Moderate: lcms2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-29070: A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial o…
first Mar 2, 2026 -
Medium max 9.1ALAS2023-2026-1473 4 CVEs
Moderate: amazon-cloudwatch-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate…
first Mar 2, 2026 -
Medium max 5.0ALAS2023-2026-1472 2 CVEs
Moderate: libssh security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-0967: libssh: Specially crafted patterns could cause DoS CVE-2026-0964: libssh: SCP Protocol Path Traversal in ssh_scp_pull_request()
first Mar 2, 2026 -
High max 10.0ALAS2023-2026-1470 37 CVEs
Important: firefox security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-2793: Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed e…
first Mar 2, 2026 -
High max 8.8ALAS2023-2026-1468 52 CVEs
Important: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-23216: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() CVE-2026-2…
first Mar 2, 2026 -
High max 8.8
Important: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-66287: A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling. CVE-2025-43541: A f…
first Jan 5, 2026 -
High max 10.0
Important: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-43480: The issue was addressed with improved checks. This issue is fixed in Safari 26.1, visionOS 26.1, watchOS 26.1, iOS 26.1 and iPadOS 26.1, tvOS 26.1. A mali…
first May 21, 2025 -
Medium max 7.8ALAS2-2026-3208 4 CVEs
Moderate: wireshark security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-5601: Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 allows denial of service via packet injection or crafted capture file CVE-2025-1394…
first Mar 16, 2026 -
High max 7.8ALAS2-2026-3207 2 CVEs
Important: amazon-ssm-agent security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-68119: cmd/go: unexpected code execution when invoking toolchain CVE-2025-61731: cmd/go: bypass of flag sanitization can lead to arbitrary code execution
first Mar 16, 2026 -
Medium max 4.5ALAS2-2026-3206 1 CVE
Moderate: libsodium security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-69277: libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles …
first Mar 16, 2026 -
High max 7.2ALAS2-2026-3205 1 CVE
Important: 389-ds-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-14905: A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` function within the `schema.c` …
first Mar 16, 2026 -
Medium max 6.5ALAS2-2026-3204 1 CVE
Moderate: tomcat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-24733: A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security cons…
first Mar 16, 2026 -
Medium max 7.5ALAS2-2026-3203 3 CVEs
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-27142: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribut…
first Mar 16, 2026 -
Medium max 7.5ALAS2-2026-3202 3 CVEs
Moderate: golist security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-27142: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribut…
first Mar 16, 2026 -
High max 2.7ALAS2-2026-3201 3 CVEs
Important: exiv2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-27631: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an un…
first Mar 16, 2026 -
High max 8.8ALAS2-2026-3199 2 CVEs
Important: freerdp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-26965: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` w…
first Mar 16, 2026 -
High max 10.0ALAS2-2026-3198 37 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-2793: Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evid…
first Mar 16, 2026 -
Medium max 4.3ALAS2-2026-3197 2 CVEs
Moderate: gvfs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-28296: A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths co…
first Mar 16, 2026 -
High max 9.8ALAS2-2026-3196 2 CVEs
Important: libtiff security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-61144: libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function. CVE-2025-61143: libtiff up to v4.7.1 was di…
first Mar 16, 2026 -
High max 9.8ALAS2-2026-3195 2 CVEs
Important: compat-libtiff3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-61144: libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function. CVE-2025-61143: libtiff up to v4.7.1 was di…
first Mar 16, 2026 -
Medium max 5.5ALAS2-2026-3194 2 CVEs
Moderate: compat-libtiff3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-8961: A vulnerability was identified in LibTIFF 4.7.0. This issue affects the function May of the file tiffcrop.c of the component tiffcrop. The manipulation lea…
first Mar 16, 2026 -
High max 8.8ALAS2-2026-3193 1 CVE
Important: postgresql security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-2005: Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versi…
first Mar 16, 2026 -
Medium max 7.5ALAS2-2026-3192 1 CVE
Moderate: lcms2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-29070: A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of s…
first Mar 2, 2026 -
Medium max 9.1ALAS2-2026-3191 4 CVEs
Moderate: amazon-cloudwatch-agent security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate ch…
first Mar 2, 2026 -
Medium max 5.3ALAS2-2026-3155 2 CVEs
Moderate: nerdctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-58181: SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unboun…
first Feb 5, 2026 -
Medium max 5.3ALAS2023-2026-1400 2 CVEs
Moderate: nerdctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-58181: SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unb…
first Feb 5, 2026 -
Medium max 7.5ALAS2023-2025-1340 3 CVEs
Moderate: docker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-61729: Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the er…
first Jan 7, 2026 -
High max 8.8ALAS2-2026-3190 3 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-2447: Heap buffer overflow in libvpx. This vulnerability affects Firefox < 147.0.4, Firefox ESR < 140.7.1, Firefox ESR < 115.32.1, Thunderbird < 140.7.2, and Thu…
first Mar 2, 2026 -
Medium max 8.3ALAS2-2026-3189 1 CVE
Moderate: libpng security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-25646: libpng: An out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of…
first Mar 2, 2026 -
MediumALAS2-2026-3188 0 CVEs
Moderate: rust security update (Amazon Linux 2)
first Mar 2, 2026 -
Medium max 6.3ALAS2-2026-3187 2 CVEs
Moderate: qt5-qt3d security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-3549: A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD3Importer::Valid…
first Mar 2, 2026 -
Low max 6.2ALAS2-2026-3186 1 CVE
Low: aide security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-54409: AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker …
first Mar 2, 2026 -
Medium max 6.0ALAS2-2026-3185 5 CVEs
Moderate: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-0865: User-controlled header names and values containing newlines can allow injecting HTTP headers. CVE-2026-0672: When using http.cookies.Morsel, user-controlle…
first Mar 2, 2026 -
Medium max 6.0ALAS2-2026-3184 5 CVEs
Moderate: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-1299: The email module, specifically the "BytesGenerator" class, didn't properly quote newlines for email headers when serializing an email message allowing for …
first Mar 2, 2026 -
High max 7.8ALAS2-2026-3183 2 CVEs
Important: gegl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-2050: When parsing an HDR image file, the function [rgbe_read_new_rle gegl/libs/rgbe/rgbe.c] contains HEAP Based Buffer Overflow vulnerability that can lead to r…
first Mar 2, 2026 -
Medium max 5.1ALAS2-2026-3182 1 CVE
Moderate: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-2243: A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially leading to a 12-byte leak of sensit…
first Mar 2, 2026 -
High max 8.6ALAS2-2026-3180 1 CVE
Important: python-pillow security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-25990: Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, n out-of-bounds write may be triggered when loading a specially crafted PSD image. This …
first Mar 2, 2026 -
Medium max 5.6ALAS2-2026-3179 1 CVE
Moderate: evolution-data-server security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-2604: The Evolution backend server exposes the D-Bus service org.gnome.evolution.dataserver.AddressBook, that can be used in order to manage contacts. A Flatpak …
first Mar 2, 2026 -
Low max 6.2ALAS2-2026-3178 1 CVE
Low: libxml2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-1757: A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly r…
first Mar 2, 2026