4,948 results · Feed
-
High max 7.0ALAS2-2025-2841 1 CVE
Important: libsoup security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-2784: A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup…
first Apr 23, 2025 -
High max 8.1ALAS2-2025-2840 3 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-3030: Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corrupti…
first Apr 23, 2025 -
High max 7.4ALAS2-2025-2839 3 CVEs
Important: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-30698: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versio…
first Apr 23, 2025 -
High max 7.4ALAS2-2025-2838 3 CVEs
Important: java-17-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-30698: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versio…
first Apr 23, 2025 -
HighALAS2-2025-2836 5 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-12421: The Mozilla Foundation Security Advisory describes this flaw as: When performing add-on updates, certificate chains terminating in non-built-in-roots were…
first Apr 14, 2025 -
MediumALAS2-2025-2835 1 CVE
Moderate: nss-softokn security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4421: new tlsfuzzer code can still detect timing issues in RSA operations
first Apr 14, 2025 -
High max 7.8ALAS2-2025-2834 6 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-52973: In the Linux kernel, the following vulnerability has been resolved: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF CVE-2023-528…
first Apr 14, 2025 -
Medium max 5.6ALAS2023-2025-957 1 CVE
Moderate: python3.12-pip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-35195: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to dis…
first Apr 23, 2025 -
Medium max 5.0ALAS2023-2025-956 2 CVEs
Moderate: binutils security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-1182: A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file b…
first Apr 23, 2025 -
High max 7.4ALAS2023-2025-955 3 CVEs
Important: java-11-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-30698: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported ver…
first Apr 23, 2025 -
High max 7.4ALAS2023-2025-954 3 CVEs
Important: java-17-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-30698: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported ver…
first Apr 23, 2025 -
High max 7.4ALAS2023-2025-952 3 CVEs
Important: java-21-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-30698: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported ver…
first Apr 23, 2025 -
High max 7.4ALAS2023-2025-951 3 CVEs
Important: java-24-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-30698: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported ver…
first Apr 23, 2025 -
High max 7.5ALAS2023-2025-950 1 CVE
Important: redis6 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-21605: Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause …
first Apr 23, 2025 -
High max 7.5ALAS2023-2025-949 1 CVE
Important: valkey security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-21605: Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause …
first Apr 23, 2025 -
High max 7.0ALAS2023-2025-946 1 CVE
Important: libsoup security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-2784: A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libs…
first Apr 23, 2025 -
High max 7.5ALAS2023-2025-944 1 CVE
Important: runfinch-finch security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-30204: golang-jwt is a Go implementation of JSON Web Tokens. Prior to 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split)…
first Apr 23, 2025 -
High max 8.1ALAS2023-2025-943 3 CVEs
Important: firefox security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-3030: Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corru…
first Apr 23, 2025 -
Medium max 8.3ALAS2023-2025-942 1 CVE
Moderate: nodejs20 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-31498: c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueu…
first Apr 23, 2025 -
High max 7.8ALAS2023-2025-940 1 CVE
Important: kernel6.12 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-21991: In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
first Apr 16, 2025 -
MediumALAS2-2025-2833 1 CVE
Moderate: evolution security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-11879: An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other sourc…
first Apr 9, 2025 -
MediumALAS2-2025-2831 1 CVE
Moderate: libxslt security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-40403: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, …
first Apr 9, 2025 -
Medium max 9.8ALAS2-2025-2830 3 CVEs
Moderate: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-56431: oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. CVE-2024-50602: An issue was discovered in…
first Apr 9, 2025 -
Low max 5.3ALAS2-2025-2829 1 CVE
Low: tomcat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-54677: Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects…
first Apr 9, 2025 -
Medium max 6.2ALAS2-2025-2828 1 CVE
Moderate: glibc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-0395: When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and…
first Apr 9, 2025 -
Medium max 4.4ALAS2-2025-2827 3 CVEs
Moderate: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-29768: Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium be…
first Apr 9, 2025 -
High max 9.1ALAS2-2025-2825 1 CVE
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-22871: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunctio…
first Apr 9, 2025 -
Low max 3.5ALAS2-2025-2824 1 CVE
Low: edk2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-2295: EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerab…
first Apr 9, 2025 -
High max 7.8ALAS2-2025-2823 2 CVEs
Important: libxslt security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-24855: numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. Th…
first Apr 9, 2025 -
Medium max 6.9ALAS2-2025-2822 1 CVE
Moderate: pcs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-27111: Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can…
first Apr 9, 2025 -
Medium max 6.6ALAS2-2025-2821 1 CVE
Moderate: nerdctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-27144: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE)…
first Apr 9, 2025 -
High max 9.8ALAS2-2025-2820 3 CVEs
Important: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-27837: Patch to error check UTF-8 conversions. Fixed in ghostpdl-10.05.0 by adding a check on the value returned by the gp_utf8_to_uint16 function. Info: https:/…
first Apr 9, 2025 -
High max 5.0ALAS2-2025-2819 1 CVE
Important: apache-commons-vfs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-30474: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file…
first Apr 9, 2025 -
HighALAS2-2025-2818 9 CVEs
Important: git security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-19604: A security bypass was discovered in git, which allows arbitrary commands to be executed during the update of git submodules. A remote attacker may trick a…
first Apr 5, 2025 -
Medium max 7.7ALAS2023-2025-939 1 CVE
Moderate: xorg-x11-server security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-49737: In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures…
first Apr 9, 2025 -
MediumALAS2023-2025-938 1 CVE
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-35866: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_dump_full_key()
first Apr 9, 2025 -
Medium max 7.8ALAS2023-2025-937 21 CVEs
Moderate: grub2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-1125: grub2: fs/hfs: Integer overflow may lead to heap based out-of-bounds write CVE-2025-1118: A flaw was found in grub2. Grub's dump command is not blocked …
first Apr 9, 2025 -
Medium max 6.3ALAS2023-2025-936 5 CVEs
Moderate: php8.2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-1861: Stream HTTP wrapper truncate redirect location to 1024 bytes CVE-2025-1736: Stream HTTP wrapper header check might omit basic auth header. CVE-2025-1734…
first Apr 9, 2025 -
High max 7.5ALAS2023-2025-934 2 CVEs
Important: docker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-22869: SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, o…
first Apr 9, 2025 -
High max 9.1ALAS2023-2025-933 1 CVE
Important: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-22871: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunc…
first Apr 9, 2025