4,948 results · Feed
-
Medium max 7.5ALAS2-2024-2587 1 CVE
Moderate: harfbuzz security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-25193: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for …
first Jul 3, 2024 -
High max 7.5ALAS2-2024-2586 1 CVE
Important: pki-core security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4727: A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter s…
first Jul 3, 2024 -
High max 8.1ALAS2-2024-2585 1 CVE
Important: ipa security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-3183: A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client's session key. This key is different for each new sessi…
first Jul 3, 2024 -
Medium max 7.8ALAS2-2024-2584 4 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-35809: In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal CVE-2024-26642: In the Linu…
first Jul 3, 2024 -
High max 7.0ALAS2-2024-2583 1 CVE
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-5700: Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presu…
first Jul 3, 2024 -
High max 8.8ALAS2023-2024-650 1 CVE
Important: composer security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-35241: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with pa…
first Jul 3, 2024 -
High max 8.8ALAS2023-2023-422 9 CVEs
Important: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-0641: A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel's TIPC subsystem. This flaw allows guests…
first Oct 30, 2023 -
Medium max 7.8ALAS2023-2024-639 3 CVEs
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-35995: In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Use access_width over bit_width for system memory accesses CVE-2024-269…
first Jun 6, 2024 -
Medium max 9.8ALAS2023-2024-585 13 CVEs
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-36031: In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation CVE-2024-35809: In the Linux…
first Apr 10, 2024 -
High max 7.0ALAS2-2024-2475 4 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-23851: copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing pa…
first Feb 29, 2024 -
High max 9.8ALAS2-2022-1828 11 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-31747: A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla developers and community members reporting memory saf…
first Jul 19, 2022 -
High max 8.1ALAS2023-2024-649 1 CVE
Important: openssh security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-6387: A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default…
first Jun 26, 2024 -
High max 8.6ALAS2-2024-2582 1 CVE
Important: python3-jinja2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-10906: In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
first Jun 19, 2024 -
Medium max 7.5ALAS2-2024-2580 1 CVE
Moderate: dnsmasq security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-49441: dnsmasq 2.9 is vulnerable to Integer Overflow via forward_query.
first Jun 19, 2024 -
Medium max 5.3ALAS2-2024-2579 1 CVE
Moderate: iperf3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-7250: It is possible for a malicious or malfunctioning client to send less than the expected amount of data to the server. If this happens, the server will hang …
first Jun 19, 2024 -
Medium max 6.0ALAS2-2024-2578 1 CVE
Moderate: edk2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-1298: EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access. A succes…
first Jun 19, 2024 -
Medium max 7.5
Moderate: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-27834: The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, macOS Sonoma 14.5. An…
first Jun 19, 2024 -
Medium max 9.8ALAS2-2024-2576 2 CVEs
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-24790: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would ret…
first Jun 19, 2024 -
High max 5.9ALAS2-2024-2575 1 CVE
Important: booth security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-3049: A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be a…
first Jun 19, 2024 -
Medium max 5.4ALAS2-2024-2574 1 CVE
Moderate: python-jinja2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-34064: Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML at…
first Jun 19, 2024 -
Medium max 5.4ALAS2-2024-2573 1 CVE
Moderate: python3-jinja2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-34064: Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML at…
first Jun 19, 2024 -
High max 8.2ALAS2-2024-2572 1 CVE
Important: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-3446: A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficie…
first Jun 19, 2024 -
High max 8.1ALAS2-2024-2571 1 CVE
Important: libndp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-5564: A vulnerability was found in libndp. A buffer overflow in NetworkManager that can be triggered by sending a malformed IPv6 router advertisement packet via …
first Jun 19, 2024 -
Medium max 7.1ALAS2023-2024-648 1 CVE
Moderate: sssd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3758: A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorizatio…
first Jun 19, 2024 -
Medium max 9.8ALAS2023-2024-646 2 CVEs
Moderate: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24790: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would …
first Jun 19, 2024 -
Medium max 5.4ALAS2023-2024-645 1 CVE
Moderate: python-jinja2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-34064: Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML…
first Jun 19, 2024 -
Medium max 5.4ALAS2023-2024-644 1 CVE
Moderate: ansible-core security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-34064: Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML…
first Jun 19, 2024 -
High max 8.2ALAS2023-2024-594 4 CVEs
Important: nodejs20 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-30261: Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to…
first Apr 25, 2024 -
High max 6.2ALAS2-2020-1480 14 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-15393: In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in drivers/usb/misc/usbtest.c has a memory leak, aka CID-28ebeb8db770. CVE-2020-14356: A flaw nu…
first Aug 18, 2020 -
MediumALAS2-2024-2570 1 CVE
Moderate: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-32066: An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with …
first Jun 6, 2024 -
Medium max 7.5ALAS2-2024-2568 2 CVEs
Moderate: cri-tools security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-24786: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling in…
first Jun 6, 2024 -
High max 8.8ALAS2-2024-2567 1 CVE
Important: postgresql security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5869: While modifying certain SQL array values, missing overflow checks let authenticated database users write arbitrary bytes to a memory area that facilitates …
first Jun 6, 2024 -
Medium max 5.6ALAS2-2024-2566 1 CVE
Moderate: opensc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5992: A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the pote…
first Jun 6, 2024 -
Medium max 7.8ALAS2-2024-2565 1 CVE
Moderate: unixODBC security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-1013: An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go u…
first Jun 6, 2024 -
Medium max 5.9ALAS2-2024-2564 1 CVE
Moderate: openssl11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-2511: Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker ma…
first Jun 6, 2024 -
Medium max 7.5ALAS2-2024-2563 1 CVE
Moderate: freerdp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-32661: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `NULL` access a…
first Jun 6, 2024 -
High max 8.8ALAS2-2024-2562 1 CVE
Important: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-33871: NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=7145885041bb52…
first Jun 6, 2024 -
High max 8.8ALAS2-2024-2561 6 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-4777: Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption and we presu…
first Jun 6, 2024 -
MediumALAS2023-2024-642 1 CVE
Moderate: nasm security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38665: Null pointer dereference in ieee_write_file in nasm 2.16rc0 allows attackers to cause a denial of service (crash).
first Jun 6, 2024 -
Medium max 7.8ALAS2023-2024-641 1 CVE
Moderate: unixODBC security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-1013: An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may g…
first Jun 6, 2024