4,948 results · Feed
-
Low max 5.3ALAS2023-2024-581 1 CVE
Low: curl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-0853: A flaw was found in Curl, where it inadvertently kept the SSL session ID for connections in its cache even when the verify status, OCSP stapling test, f…
-
Medium max 5.6ALAS2023-2024-580 2 CVEs
Moderate: opensc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-1454: The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a u…
-
High max 7.5ALAS2023-2024-577 2 CVEs
Important: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24549: Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the reques…
-
High max 7.5ALAS2023-2024-576 1 CVE
Important: expat security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-28757: libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate…
-
High max 8.8ALAS2023-2023-436 2 CVEs
Important: microcode_ctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-23908: Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to potentially enable information discl…
first Nov 9, 2023 -
High max 9.3ALAS2-2024-2509 2 CVEs
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-46846: Due to chunked decoder lenience Squid is vulnerable to Request/Response smuggling attacks when parsing HTTP/1.1 and ICAP messages. CVE-2019-12521: A flaw …
-
Medium max 7.5ALAS2-2024-2508 1 CVE
Moderate: python-pillow security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-44271: An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causi…
-
Medium max 6.5ALAS2-2024-2507 1 CVE
Moderate: openssh security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-51385: In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an exp…
-
Medium max 5.3ALAS2-2024-2506 1 CVE
Moderate: python-jwcrypto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-6681: A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and diction…
-
High max 8.8ALAS2-2024-2505 6 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-2616: To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue. This vulnerability affec…
-
HighALAS2023-2024-575 0 CVEs
Important: aws-nitro-enclaves-cli security update (Amazon Linux 2023)
first Mar 13, 2024 -
HighALAS2023-2024-574 0 CVEs
Important: rust security update (Amazon Linux 2023)
first Mar 13, 2024 -
MediumALAS2023-2024-573 3 CVEs
Moderate: rpm security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-35939: It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be…
first Mar 13, 2024 -
MediumALAS2023-2024-572 1 CVE
Moderate: libsndfile security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-33064: An off-by-one error in function wav_read_header in src/wav.c in Libsndfile 1.1.0, results in a write out of bound, which allows an attacker to execute …
first Mar 13, 2024 -
Medium max 6.5ALAS2023-2024-570 1 CVE
Moderate: openssh security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-51385: In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an …
first Mar 13, 2024 -
High max 7.5ALAS2023-2024-569 2 CVEs
Important: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-22019: A flaw was found in Node.js due to a lack of safeguards on chunk extension bytes. The server may read an unbounded number of bytes from a single connec…
first Mar 13, 2024 -
Medium max 6.5ALAS2023-2024-568 3 CVEs
Moderate: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-25629: c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/n…
first Mar 13, 2024 -
Medium max 7.5ALAS2023-2024-567 1 CVE
Moderate: wireshark security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24478: An issue in Wireshark team Wireshark before v.4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff…
first Mar 13, 2024 -
High max 8.6ALAS2023-2024-566 2 CVEs
Important: rust security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24577: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality int…
first Mar 13, 2024 -
Medium max 6.5ALAS2023-2024-565 2 CVEs
Moderate: fontforge security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-25082: Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. CVE-2024-25081: Splinefont in FontForge thr…
first Mar 13, 2024 -
Medium max 4.4ALAS2023-2024-563 1 CVE
Moderate: c-ares security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-25629: c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/n…
first Mar 13, 2024 -
Medium max 4.4ALAS2023-2024-562 1 CVE
Moderate: nodejs20 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-25629: c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/n…
first Mar 13, 2024 -
High max 8.1ALAS2023-2024-561 1 CVE
Important: javapackages-bootstrap security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-25710: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 th…
first Mar 13, 2024 -
High max 8.1ALAS2023-2024-560 1 CVE
Important: apache-commons-compress security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-25710: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 th…
first Mar 13, 2024 -
Low max 3.3ALAS2-2024-2499 1 CVE
Low: grub2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-1048: A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new …
first Mar 13, 2024 -
Medium max 5.3ALAS2-2024-2498 1 CVE
Moderate: ipa security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-1481: A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to…
first Mar 13, 2024 -
Low max 7.5ALAS2-2024-2497 1 CVE
Low: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-1936: The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. C…
first Mar 13, 2024 -
High max 8.6ALAS2-2024-2496 2 CVEs
Important: rust security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-24577: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into y…
first Mar 13, 2024 -
Medium max 6.5ALAS2-2024-2495 2 CVEs
Moderate: fontforge security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-25082: Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. CVE-2024-25081: Splinefont in FontForge throug…
first Mar 13, 2024 -
Medium max 4.4ALAS2-2024-2494 1 CVE
Moderate: c-ares security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-25629: c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nssw…
first Mar 13, 2024 -
High max 8.1ALAS2-2024-2493 1 CVE
Important: apache-commons-compress security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-25710: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 throu…
first Mar 13, 2024 -
Medium max 5.8ALAS2-2024-2492 3 CVEs
Moderate: pcs security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-26146: A Denial of Service (DoS) vulnerability was found in rubygem-rack in how it parses Rack Header. Carefully crafted headers can cause header parsing in Rack…
first Mar 13, 2024 -
HighALAS2-2024-2504 0 CVEs
Important: rust security update (Amazon Linux 2)
first Mar 13, 2024 -
High max 8.8ALAS2-2024-2503 1 CVE
Important: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-33621: The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use …
first Mar 13, 2024 -
High max 5.3ALAS2-2024-2501 1 CVE
Important: tomcat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-45648: Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through …
first Mar 13, 2024 -
High max 8.6ALAS2-2024-2500 1 CVE
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-49285: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack…
first Mar 13, 2024 -
High max 7.9ALAS2023-2024-544 8 CVEs
Important: nodejs20 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-24758: Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not cle…
first Feb 29, 2024 -
Medium max 7.5ALAS2-2023-2360 19 CVEs
Moderate: virtuoso-opensource security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-31631: An issue in the sqlo_preds_contradiction component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted …
first Nov 29, 2023 -
Medium max 6.5ALAS2023-2024-559 2 CVEs
Moderate: microcode_ctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel? Processors may allow an unauthenticated user to potentially enable denial of service…
-
Medium max 6.5ALAS2-2024-2491 2 CVEs
Moderate: microcode_ctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel? Processors may allow an unauthenticated user to potentially enable denial of service vi…