4,948 results · Feed
-
High max 7.5ALAS2023-2025-801 5 CVEs
Important: rsync security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-12747: A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when enc…
-
Medium max 7.5ALAS2-2025-2729 1 CVE
Moderate: bind security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-3094: Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of fre…
first Jan 4, 2025 -
Medium max 5.5ALAS2-2025-2728 2 CVEs
Moderate: exiv2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-25112: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found i…
first Jan 4, 2025 -
Medium max 7.0ALAS2-2025-2727 1 CVE
Moderate: orc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-40897: Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted f…
first Jan 4, 2025 -
Medium max 6.1ALAS2-2025-2726 1 CVE
Moderate: python-webob security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-42353: WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by pars…
first Jan 4, 2025 -
Medium max 7.5ALAS2-2025-2725 1 CVE
Moderate: python3-tornado security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-52804: Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 some…
first Jan 4, 2025 -
Medium max 5.9ALAS2-2025-2724 1 CVE
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-9681: When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise…
first Jan 4, 2025 -
High max 7.5ALAS2023-2025-798 1 CVE
Important: jackson-databind security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-42004: In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to pr…
first Jan 6, 2025 -
Medium max 5.3ALAS2023-2025-797 1 CVE
Moderate: perl-Module-ScanDeps security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-10224: Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute ar…
first Jan 6, 2025 -
Medium max 7.5ALAS2023-2025-796 1 CVE
Moderate: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-21538: Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An …
first Jan 6, 2025 -
Medium max 7.5ALAS2023-2025-795 1 CVE
Moderate: nodejs20 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-21538: Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An …
first Jan 6, 2025 -
Medium max 5.9ALAS2023-2025-793 1 CVE
Moderate: expat security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-50602: An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unst…
first Jan 6, 2025 -
Medium max 7.5ALAS2023-2025-792 1 CVE
Moderate: python-tornado security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-52804: Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 s…
first Jan 6, 2025 -
Medium max 5.3ALAS2023-2025-791 1 CVE
Moderate: haproxy security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-53008: Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote …
first Jan 6, 2025 -
High max 8.8
Important: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-44308: The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPa…
first Feb 1, 2024 -
High max 10.0ALAS2023-2024-674 5 CVEs
Important: docker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-41110: AWS is aware of CVE-2024-41110, an issue affecting the Moby open source project, packaged in Amazon Linux as "docker". Docker is a component of several…
first Jul 29, 2024 -
High max 8.8ALAS2-2024-2722 8 CVEs
Important: edk2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-9143: Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory re…
first Dec 5, 2024 -
Medium max 5.5ALAS2-2024-2721 1 CVE
Moderate: apr security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-49582: Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentia…
first Dec 5, 2024 -
High max 7.4ALAS2-2024-2720 10 CVEs
Important: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-21235: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported v…
first Dec 5, 2024 -
Medium max 7.5ALAS2-2024-2719 1 CVE
Moderate: dovecot security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-23185: Dovecot reports: A DoS is possible with a large number of address headers or abnormally large email headers.
first Dec 5, 2024 -
Medium max 5.9ALAS2-2024-2718 1 CVE
Moderate: glibc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-33600: glibc: null pointer dereferences after failed netgroup cache insertion
first Dec 5, 2024 -
Medium max 7.5ALAS2-2024-2717 1 CVE
Moderate: libxml2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-34459: An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a…
first Dec 5, 2024 -
Medium max 5.6ALAS2-2024-2715 1 CVE
Moderate: python-pip security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-35195: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disabl…
first Dec 5, 2024 -
Medium max 6.5ALAS2-2024-2714 1 CVE
Moderate: gnome-shell security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-36472: In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary…
first Dec 5, 2024 -
Medium max 7.5ALAS2-2024-2713 1 CVE
Moderate: zziplib security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-39134: A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() function at /z…
first Dec 5, 2024 -
High max 10.0ALAS2-2024-2712 1 CVE
Important: flatpak security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-42472: A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user o…
first Dec 5, 2024 -
Medium max 4.5ALAS2-2024-2711 1 CVE
Moderate: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-43802: Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does…
first Dec 5, 2024 -
High max 9.8ALAS2-2024-2710 1 CVE
Important: expat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-45490: An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.
first Dec 5, 2024 -
Low max 4.3ALAS2-2024-2709 6 CVEs
Low: opensc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-45620: It is caused by the libopensc library in opensc porject. This vulnerability affects how the buffer data is handled and partially filled buffers can be acc…
first Dec 5, 2024 -
High max 7.8ALAS2-2024-2708 3 CVEs
Important: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-46956: PostScript interpreter - fix buffer length check NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707895 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit…
first Dec 5, 2024 -
High max 7.5ALAS2-2024-2707 1 CVE
Important: xstream security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-47072: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream. XStream provides a BinaryStreamDriver wi…
first Dec 5, 2024 -
High max 7.5ALAS2-2024-2706 1 CVE
Important: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-47220: An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Tr…
first Dec 5, 2024 -
High max 7.5ALAS2-2024-2705 3 CVEs
Important: libsoup security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-52532: GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. CVE-2024-5…
first Dec 5, 2024 -
Medium max 5.3ALAS2-2024-2704 2 CVEs
Moderate: avahi security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-52616: avahi: Avahi Wide-Area DNS Predictable Transaction IDs CVE-2024-52615: avahi: Avahi Wide-Area DNS Uses Constant Source Port
first Dec 5, 2024 -
Medium max 7.8ALAS2-2024-2703 1 CVE
Moderate: NetworkManager-libreswan security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-9050: A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration f…
first Dec 5, 2024 -
Medium max 5.3ALAS2-2024-2702 1 CVE
Moderate: jetty security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-9823: There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on t…
first Dec 5, 2024 -
High max 7.5ALAS2-2021-1695 4 CVEs
Important: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-2388: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Ja…
first Aug 4, 2021 -
Medium max 5.5ALAS2023-2024-789 1 CVE
Moderate: apr security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-49582: Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, poten…
first Dec 5, 2024 -
Medium max 8.7ALAS2023-2024-788 3 CVEs
Moderate: python3.11 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-8088: There is a severity vulnerability affecting the CPython "zipfile" module. When iterating over names of entries in a zip archive (for example, methods of…
first Dec 5, 2024 -
High max 8.8ALAS2023-2024-787 4 CVEs
Important: postgresql15 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-10979: Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables…
first Dec 5, 2024