4,948 results · Feed
-
Medium max 5.5ALAS2-2024-2648 1 CVE
Moderate: python-pillow security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-10177: Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.
first Sep 25, 2024 -
Medium max 7.0ALAS2-2024-2647 1 CVE
Moderate: python-dns security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29483: eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid pac…
first Sep 25, 2024 -
Medium max 5.9ALAS2-2024-2646 1 CVE
Moderate: c-ares security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-31147: Insufficient randomness in generation of DNS query IDs When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers …
first Sep 25, 2024 -
Medium max 9.8ALAS2-2024-2645 2 CVEs
Moderate: amazon-ssm-agent security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-24790: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would ret…
first Sep 25, 2024 -
Medium max 6.1ALAS2-2024-2644 2 CVEs
Moderate: clamav security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-20506: A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versi…
first Sep 25, 2024 -
High max 7.5ALAS2-2024-2643 3 CVEs
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-34158: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion. CVE-2024-34156: Calling Decoder.De…
first Sep 25, 2024 -
High max 7.8ALAS2-2024-2642 1 CVE
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-39494: In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name
first Sep 25, 2024 -
High max 8.8ALAS2-2024-2641 1 CVE
Important: python-setuptools security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-6345: A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These fun…
first Sep 25, 2024 -
High max 7.5ALAS2-2024-2640 1 CVE
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-6604: Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presu…
first Sep 25, 2024 -
Medium max 7.5ALAS2-2024-2639 1 CVE
Moderate: libtiff security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-7006: libtiff: NULL pointer dereference in tif_dirinfo.c
first Sep 25, 2024 -
High max 9.8ALAS2-2024-2638 4 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-8384: The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This coul…
first Sep 25, 2024 -
High max 7.8ALAS2023-2024-716 2 CVEs
Important: microcode_ctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-22374: Insufficient control flow management for some Intel(R) Xeon Processors may allow an authenticated user to potentially enable denial of service via loca…
first Sep 12, 2024 -
Medium max 7.5ALAS2-2024-2637 2 CVEs
Moderate: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-27282: ruby: Arbitrary memory address read vulnerability with Regex search CVE-2021-28965: A flaw was found in the way the Ruby REXML library parsed XML document…
first Sep 12, 2024 -
LowALAS2-2024-2636 1 CVE
Low: systemd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-31439: An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checkin…
first Sep 12, 2024 -
Medium max 4.5ALAS2-2024-2634 1 CVE
Moderate: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-27281: ruby: RCE vulnerability with .rdoc_options in RDoc
first Sep 12, 2024 -
High max 8.8ALAS2-2024-2632 1 CVE
Important: python2-setuptools security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-6345: A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These fun…
first Sep 12, 2024 -
MediumALAS2023-2024-715 1 CVE
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-35807: In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize
first Sep 12, 2024 -
Medium max 9.8ALAS2023-2024-603 39 CVEs
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-27431: In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program CVE-2024-274…
first Apr 25, 2024 -
Medium max 6.5ALAS2-2024-2631 1 CVE
Moderate: microcode_ctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-22374: Insufficient control flow management for some Intel(R) Xeon Processors may allow an authenticated user to potentially enable denial of service via local a…
first Aug 28, 2024 -
High max 10.0ALAS2-2024-2630 4 CVEs
Important: amazon-cloudwatch-agent security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-6104: go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic a…
first Aug 28, 2024 -
High max 9.8ALAS2-2024-2629 7 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-7529: The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerabil…
first Aug 28, 2024 -
Medium max 6.5ALAS2023-2024-712 1 CVE
Moderate: microcode_ctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-22374: Insufficient control flow management for some Intel(R) Xeon Processors may allow an authenticated user to potentially enable denial of service via loca…
first Aug 28, 2024 -
Medium max 9.8ALAS2023-2024-711 1 CVE
Moderate: docker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24790: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would …
first Aug 28, 2024 -
Medium max 9.8ALAS2023-2024-710 1 CVE
Moderate: runc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24790: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would …
first Aug 28, 2024 -
High max 10.0ALAS2023-2024-708 4 CVEs
Important: amazon-cloudwatch-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-6104: go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basi…
first Aug 28, 2024 -
Medium max 4.7ALAS2023-2024-707 1 CVE
Moderate: nginx security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-7347: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulti…
first Aug 28, 2024 -
Medium max 9.8ALAS2023-2024-697 2 CVEs
Moderate: containerd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24790: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would …
first Aug 1, 2024 -
High max 10.0ALAS2023-2024-542 7 CVEs
Important: docker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24557: Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if t…
first Feb 29, 2024 -
Medium max 9.8ALAS2-2024-2618 5 CVEs
Moderate: nerdctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-28180: Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing c…
first Aug 1, 2024 -
High max 9.8
Important: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32409: N/A CVE-2023-32373: A use-after free bug in WebKit that could lead to arbitrary code execution when processing maliciously crafted web content. It was add…
first Jun 7, 2023 -
Low max 3.3ALAS2-2024-2628 1 CVE
Low: cups security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-25317: A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStac…
first Aug 14, 2024 -
Medium max 7.5ALAS2-2024-2627 1 CVE
Moderate: apache-commons-compress security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-36090: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even f…
first Aug 14, 2024 -
High max 7.5ALAS2-2024-2626 1 CVE
Important: linux-firmware security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-31315: Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is ena…
first Aug 14, 2024 -
High max 7.5ALAS2-2024-2625 1 CVE
Important: bind security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4408: The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffi…
first Aug 14, 2024 -
High max 7.8ALAS2-2024-2624 2 CVEs
Important: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-4467: A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block dev…
first Aug 14, 2024 -
High max 6.5ALAS2-2024-2623 4 CVEs
Important: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-40789: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, Safari 17.6, iOS 17.6 and …
first Aug 14, 2024 -
High max 7.5ALAS2023-2024-706 1 CVE
Important: linux-firmware security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-31315: Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is …
first Aug 14, 2024 -
Medium max 8.4ALAS2023-2024-705 2 CVEs
Moderate: p7zip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-52169: The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buf…
first Aug 14, 2024 -
Medium max 6.6ALAS2023-2024-704 2 CVEs
Moderate: ruby3.2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-27282: ruby: Arbitrary memory address read vulnerability with Regex search CVE-2024-27281: ruby: RCE vulnerability with .rdoc_options in RDoc
first Aug 14, 2024 -
Medium max 4.3ALAS2023-2024-703 1 CVE
Moderate: tpm2-tss security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-29040: tpm2-tss: arbitrary quote data may go undetected by Fapi_VerifyQuote
first Aug 14, 2024