4,948 results · Feed
-
High max 7.5ALAS2023-2024-595 1 CVE
Important: mod_http2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-27316: HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does…
-
High max 8.2ALAS2023-2024-593 2 CVEs
Important: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-28182: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded…
-
High max 5.3ALAS2023-2024-592 1 CVE
Important: nghttp2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-28182: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded…
-
Medium max 5.3ALAS2023-2024-591 2 CVEs
Moderate: gnutls security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-28835: A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "cer…
-
Medium max 7.8ALAS2023-2024-590 1 CVE
Moderate: wireshark security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-2955: T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file
-
High max 7.3ALAS2023-2024-589 1 CVE
Important: glibc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-2961: The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings t…
-
MediumALAS2-2024-2534 1 CVE
Moderate: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-31810: An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::…
-
HighALAS2-2024-2533 1 CVE
Important: qt5-qtbase security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-37369: Potential buffer overflow issue in QXmlStreamReader. When given specifically crafted data then QXmlStreamReader can end up causing a buffer overflow and s…
-
Medium max 7.3ALAS2-2024-2532 2 CVEs
Moderate: httpd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-24795: HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications …
-
Medium max 6.5ALAS2-2024-2531 1 CVE
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-46218: This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possib…
-
High max 7.5ALAS2-2024-2530 2 CVEs
Important: bind security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-50868: The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service…
-
Medium max 7.5ALAS2-2024-2529 1 CVE
Moderate: jose security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-50967: latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
-
Low max 3.7ALAS2-2024-2528 4 CVEs
Low: java-17-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-21094: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported v…
-
Low max 3.7ALAS2-2024-2527 5 CVEs
Low: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-21094: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported v…
-
Medium max 8.6ALAS2-2024-2526 2 CVEs
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-2398: When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit…
-
Medium max 5.7ALAS2-2024-2525 2 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-26602: In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_…
-
High max 7.5ALAS2-2024-2524 1 CVE
Important: mod_http2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-27316: HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does no…
-
High max 5.3ALAS2-2024-2523 1 CVE
Important: nghttp2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-28182: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded nu…
-
Medium max 7.8ALAS2-2024-2522 1 CVE
Moderate: wireshark security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-2955: T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file
-
High max 7.3ALAS2-2024-2521 1 CVE
Important: glibc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-2961: The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to t…
-
High max 9.8ALAS2-2024-2458 4 CVEs
Important: amazon-ssm-agent security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-49569: A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across th…
first Feb 15, 2024 -
HighALAS2-2024-2520 1 CVE
Important: php security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-9227: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read oc…
first Apr 11, 2024 -
HighALAS2-2024-2519 1 CVE
Important: glib2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-35457: GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is…
first Apr 11, 2024 -
Medium max 8.2ALAS2-2024-2518 1 CVE
Moderate: flatpak security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-43860: Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the perm…
first Apr 11, 2024 -
High max 7.5ALAS2-2024-2517 2 CVEs
Important: tomcat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28709: The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-defaul…
first Apr 11, 2024 -
Medium max 6.2ALAS2-2024-2515 1 CVE
Moderate: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerab…
first Apr 11, 2024 -
High max 6.3ALAS2-2024-2514 1 CVE
Important: tomcat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-23672: Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading …
first Apr 11, 2024 -
Medium max 6.2ALAS2-2024-2513 3 CVEs
Moderate: libvirt security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-2496: NULL pointer dereference in udevConnectListAllInterfaces() CVE-2024-2494: A flaw was found in the RPC library APIs of libvirt. The RPC server deserializati…
first Apr 11, 2024 -
Medium max 7.5ALAS2-2024-2512 2 CVEs
Moderate: krb5 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-26461: Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. CVE-2024-26458: Kerberos 5 (aka krb5) 1.21.2 co…
first Apr 11, 2024 -
High max 7.8ALAS2-2024-2511 3 CVEs
Important: xorg-x11-server security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-31083: The ProcRenderAddGlyphs() function calls the AllocateGlyph() function to store new glyphs sent by the client to the X server. AllocateGlyph() would return…
first Apr 11, 2024 -
High max 7.8ALAS2-2024-2510 3 CVEs
Important: tigervnc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-31083: The ProcRenderAddGlyphs() function calls the AllocateGlyph() function to store new glyphs sent by the client to the X server. AllocateGlyph() would return…
first Apr 11, 2024 -
Medium max 6.2ALAS2023-2024-588 1 CVE
Moderate: python3.11 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulne…
first Apr 10, 2024 -
Medium max 6.5ALAS2023-2024-587 1 CVE
Moderate: libreswan security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-2357: The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use…
first Apr 10, 2024 -
Medium max 7.5ALAS2023-2024-586 3 CVEs
Moderate: krb5 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-26462: Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c. CVE-2024-26461: Kerberos 5 (aka krb5) 1.21.2 contains a memor…
first Apr 10, 2024 -
High max 7.8ALAS2023-2024-584 1 CVE
Important: emacs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-30202: In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.
first Apr 10, 2024 -
High max 7.8ALAS2023-2024-583 3 CVEs
Important: xorg-x11-server security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-31083: The ProcRenderAddGlyphs() function calls the AllocateGlyph() function to store new glyphs sent by the client to the X server. AllocateGlyph() would ret…
first Apr 10, 2024 -
Medium max 8.1ALAS2-2024-2516 3 CVEs
Moderate: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-23284: A logic issue was addressed with improved state management. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, w…
first Apr 11, 2024 -
High max 9.8ALAS2-2024-2459 5 CVEs
Important: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-23252: The issue was addressed with improved memory handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Processing web con…
first Feb 15, 2024 -
High max 9.1
Important: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-0562: A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associate…
first Feb 17, 2023 -
MediumALAS2023-2024-582 0 CVEs
Moderate: python-pillow security update (Amazon Linux 2023)