4,948 results · Feed
-
High max 7.5ALAS2023-2025-838 2 CVEs
Important: bind security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-12705: Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This iss…
first Jan 30, 2025 -
High max 9.1ALAS2023-2025-835 1 CVE
Important: containerd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-45337: Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation fo…
first Jan 30, 2025 -
High max 9.1ALAS2023-2025-833 2 CVEs
Important: nerdctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-45338: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow pars…
first Jan 30, 2025 -
High max 8.4ALAS2023-2025-831 1 CVE
Important: python-virtualenv security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-53899: virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted corr…
first Jan 30, 2025 -
Medium max 5.6ALAS2023-2025-830 1 CVE
Moderate: openjpeg2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-56826: openjpeg: heap buffer overflow in bin/common/color.c
first Jan 30, 2025 -
Medium max 4.8ALAS2023-2025-828 1 CVE
Moderate: java-17-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-21502: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supporte…
first Jan 30, 2025 -
Medium max 4.8ALAS2023-2025-827 1 CVE
Moderate: java-21-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-21502: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supporte…
first Jan 30, 2025 -
Medium max 4.8ALAS2023-2025-826 1 CVE
Moderate: java-11-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-21502: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supporte…
first Jan 30, 2025 -
Medium max 4.8ALAS2023-2025-825 1 CVE
Moderate: java-23-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-21502: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supporte…
first Jan 30, 2025 -
High max 9.2ALAS2023-2025-824 2 CVEs
Important: amazon-ssm-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-21614: go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions …
first Jan 30, 2025 -
High max 7.7ALAS2023-2025-822 3 CVEs
Important: nodejs20 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-23085: A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was d…
first Jan 30, 2025 -
High max 7.5ALAS2-2025-2751 2 CVEs
Important: bind security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-12705: Clients using DNS-over-HTTPS (DoH) can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue …
first Jan 30, 2025 -
Medium max 4.6ALAS2-2025-2750 1 CVE
Moderate: edk2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-13176: Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A…
first Jan 30, 2025 -
High max 9.1ALAS2-2025-2749 2 CVEs
Important: nerdctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-45338: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing…
first Jan 30, 2025 -
High max 8.6ALAS2-2025-2746 1 CVE
Important: gstreamer1 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-47606: GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_e…
first Jan 30, 2025 -
High max 8.8ALAS2-2025-2745 7 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-50230: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of checked flag CVE-2024-50067: In the …
first Jan 30, 2025 -
Medium max 6.5ALAS2-2025-2744 1 CVE
Moderate: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-5642: CPython 3.9 and earlier doesn't disallow configuring an empty list for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL …
first Jan 30, 2025 -
Medium max 6.5ALAS2-2025-2743 1 CVE
Moderate: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-5642: CPython 3.9 and earlier doesn't disallow configuring an empty list for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL …
first Jan 30, 2025 -
High max 8.2ALAS2-2025-2742 1 CVE
Important: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-6519: A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.
first Jan 30, 2025 -
Medium max 4.8ALAS2-2025-2741 1 CVE
Moderate: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-21502: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported v…
first Jan 30, 2025 -
Medium max 4.8ALAS2-2025-2740 1 CVE
Moderate: java-17-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-21502: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported v…
first Jan 30, 2025 -
High max 9.2ALAS2-2025-2739 2 CVEs
Important: amazon-ssm-agent security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-21614: go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions pri…
first Jan 30, 2025 -
High max 9.8ALAS2-2023-1951 29 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-23605: The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Fi…
first Feb 17, 2023 -
Medium max 5.5ALAS2023-2025-821 1 CVE
Moderate: openjpeg2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39328: openjpeg: denail of service via crafted image file
first Jan 21, 2025 -
Medium max 6.9ALAS2023-2025-819 1 CVE
Moderate: grpc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-11407: There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_AR…
first Jan 21, 2025 -
High max 7.0ALAS2023-2025-818 1 CVE
Important: redis6 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-46981: Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garba…
first Jan 21, 2025 -
Medium max 5.3ALAS2023-2025-816 2 CVEs
Moderate: runfinch-finch security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-51744: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where user…
first Jan 21, 2025 -
Medium max 2.1ALAS2023-2025-815 2 CVEs
Moderate: git security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-52006: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full acces…
first Jan 21, 2025 -
High max 7.5ALAS2023-2025-812 1 CVE
Important: iperf3 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-53580: iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function.
first Jan 21, 2025 -
High max 5.4ALAS2023-2025-811 2 CVEs
Important: ansible-core security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-56326: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an att…
first Jan 21, 2025 -
High max 5.4ALAS2023-2025-810 1 CVE
Important: python-jinja2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-56326: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an att…
first Jan 21, 2025 -
High max 8.7ALAS2023-2025-808 2 CVEs
Important: python3.12 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-9287: A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted proper…
first Jan 21, 2025 -
Medium max 5.3ALAS2-2025-2738 1 CVE
Moderate: perl-Module-ScanDeps security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-10224: Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbit…
first Jan 21, 2025 -
Medium max 2.1ALAS2-2025-2737 2 CVEs
Moderate: git security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-52006: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access t…
first Jan 21, 2025 -
High max 7.5ALAS2-2025-2736 1 CVE
Important: iperf3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-53580: iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function.
first Jan 21, 2025 -
High max 5.4ALAS2-2025-2735 1 CVE
Important: python3-jinja2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-56326: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attack…
first Jan 21, 2025 -
High max 5.4ALAS2-2025-2734 1 CVE
Important: python-jinja2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-56326: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attack…
first Jan 21, 2025 -
High max 8.8ALAS2-2025-2733 1 CVE
Important: postgresql security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-7348: Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running …
first Jan 21, 2025 -
Medium max 7.5ALAS2023-2024-500 2 CVEs
Moderate: python3.11 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-11168: The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This b…
first Jan 19, 2024 -
High max 7.5ALAS2-2025-2731 5 CVEs
Important: rsync security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-12747: A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encoun…