4,948 results · Feed
-
Medium max 4.8ALAS2023-2024-753 4 CVEs
Moderate: java-11-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-21235: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supporte…
first Oct 24, 2024 -
Medium max 4.8ALAS2023-2024-752 4 CVEs
Moderate: java-17-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-21235: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supporte…
first Oct 24, 2024 -
Medium max 4.8ALAS2023-2024-751 4 CVEs
Moderate: java-21-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-21235: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supporte…
first Oct 24, 2024 -
Medium max 4.4ALAS2023-2024-747 1 CVE
Moderate: python-urllib3 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-37891: urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is …
first Oct 24, 2024 -
Medium max 6.1ALAS2023-2024-746 1 CVE
Moderate: python-twisted security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-41810: Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML inje…
first Oct 24, 2024 -
High max 10.0ALAS2023-2024-745 1 CVE
Important: flatpak security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-42472: A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local use…
first Oct 24, 2024 -
High max 7.5ALAS2023-2024-743 1 CVE
Important: ruby3.2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-47220: An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a…
first Oct 24, 2024 -
High max 7.8ALAS2023-2024-742 2 CVEs
Important: libarchive security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-48958: execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src…
first Oct 24, 2024 -
Medium max 7.5ALAS2023-2024-741 1 CVE
Moderate: poppler security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-6239: A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input …
first Oct 24, 2024 -
High max 8.8ALAS2023-2024-740 1 CVE
Important: python3.11-setuptools security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-6345: A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These …
first Oct 24, 2024 -
Medium max 7.5ALAS2023-2024-579 2 CVEs
Moderate: libdwarf security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-31745: Libdwarf v0.9.1 was discovered to contain a heap use-after-free via the dw_empty_errlist_item function at /libdwarf/dwarf_alloc.c. CVE-2024-2002: In a …
first Mar 27, 2024 -
Medium max 6.5ALAS2-2024-2655 1 CVE
Moderate: libtiff security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-41175: Multiple potential integer overflow in raw2tiff.c in libtiff <= 4.5.1 can allow remote attackers to cause a denial of service (application crash) or possi…
first Oct 10, 2024 -
Medium max 5.6ALAS2-2024-2654 1 CVE
Moderate: aws-cfn-bootstrap security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-35195: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disabl…
first Oct 10, 2024 -
Medium max 4.4ALAS2-2024-2653 1 CVE
Moderate: python-urllib3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-37891: urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is onl…
first Oct 10, 2024 -
Medium max 4.4ALAS2-2024-2652 1 CVE
Moderate: python-pip security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-37891: urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is onl…
first Oct 10, 2024 -
Medium max 5.0ALAS2-2024-2651 1 CVE
Moderate: OpenIPMI security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-42934: openipmi: missing check on the authorization type on incoming LAN messages in IPMI simulator
first Oct 10, 2024 -
Medium max 5.3ALAS2-2024-2650 1 CVE
Moderate: unbound security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-8508: NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name c…
first Oct 10, 2024 -
Medium max 7.0ALAS2023-2024-739 1 CVE
Moderate: python-dns security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29483: eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid …
first Oct 10, 2024 -
LowALAS2023-2024-738 3 CVEs
Low: gdb security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39130: GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c. CVE-2023-39129: …
first Oct 10, 2024 -
Medium max 6.1ALAS2023-2024-737 2 CVEs
Moderate: clamav security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-20506: A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior ve…
first Oct 10, 2024 -
Medium max 5.9ALAS2023-2024-736 1 CVE
Moderate: libgcrypt security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-2236: A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style …
first Oct 10, 2024 -
Medium max 9.8ALAS2023-2024-735 2 CVEs
Moderate: amazon-ssm-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24790: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would …
first Oct 10, 2024 -
Medium max 9.8ALAS2023-2024-734 1 CVE
Moderate: amazon-ecr-credential-helper security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24790: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would …
first Oct 10, 2024 -
High max 7.5ALAS2023-2024-733 3 CVEs
Important: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-34158: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion. CVE-2024-34156: Calling Decoder…
first Oct 10, 2024 -
Medium max 5.6ALAS2023-2024-732 1 CVE
Moderate: aws-cfn-bootstrap security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-35195: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to dis…
first Oct 10, 2024 -
Medium max 4.4ALAS2023-2024-730 1 CVE
Moderate: python-pip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-37891: urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is …
first Oct 10, 2024 -
Medium max 4.4ALAS2023-2024-729 1 CVE
Moderate: python3.11-pip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-37891: urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is …
first Oct 10, 2024 -
Medium max 7.0ALAS2023-2024-728 1 CVE
Moderate: orc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-40897: Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafte…
first Oct 10, 2024 -
Medium max 7.5ALAS2023-2024-727 1 CVE
Moderate: openssl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-41996: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (fro…
first Oct 10, 2024 -
High max 10.0ALAS2023-2024-726 1 CVE
Important: bubblewrap security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-42472: A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local use…
first Oct 10, 2024 -
Low max 3.6ALAS2023-2024-725 1 CVE
Low: runc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-45310: runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, c…
first Oct 10, 2024 -
Medium max 7.8ALAS2023-2024-724 13 CVEs
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-46800: In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netem_dequeue CVE-2024-46783: In the Linux kernel,…
first Oct 10, 2024 -
High max 7.1ALAS2023-2024-722 1 CVE
Important: oath-toolkit security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-47191: oath-toolkit: Local root exploit in a PAM module
first Oct 10, 2024 -
Medium max 7.5ALAS2023-2024-721 1 CVE
Moderate: openssl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-6119: Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory ad…
first Oct 10, 2024 -
Medium max 7.5ALAS2023-2024-720 1 CVE
Moderate: libtiff security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-7006: libtiff: NULL pointer dereference in tif_dirinfo.c
first Oct 10, 2024 -
Medium max 5.3ALAS2023-2024-719 1 CVE
Moderate: unbound security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-8508: NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform nam…
first Oct 10, 2024 -
High max 7.8ALAS2-2024-2635 2 CVEs
Important: microcode_ctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-22374: Insufficient control flow management for some Intel(R) Xeon Processors may allow an authenticated user to potentially enable denial of service via local a…
first Sep 12, 2024 -
Medium max 7.8ALAS2023-2024-713 8 CVEs
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-46763: In the Linux kernel, the following vulnerability has been resolved: fou: Fix null-ptr-deref in GRO. CVE-2024-46711: In the Linux kernel, the following …
first Sep 12, 2024 -
High max 8.6ALAS2023-2024-718 1 CVE
Important: cups-filters security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-47175: A flaw in cups-filters allows a remote unauthenticated client to create a PPD configuration file with code injection. If a job is sent to the compromis…
first Sep 27, 2024 -
High max 7.0ALAS2023-2024-717 2 CVEs
Important: redis6 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-31449: Lua library commands may be exploited by an authenticated user to achieve remote-code-execution CVE-2024-31228: Denial-of-service due to unbounded patt…
first Sep 26, 2024