Skip to content
OpenAdvisories

Source

Amazon Linux Security Center (ALAS)

Source: https://alas.aws.amazon.com/

All Critical High Medium Low With exploited CVEs

4,948 results · Feed

  • Low
    ALAS2-2024-2447 0 CVEs

    Low: sudo security update (Amazon Linux 2)

    first Feb 1, 2024
  • High max 7.5
    ALAS2-2024-2424 4 CVEs

    Important: amazon-cloudwatch-agent security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-47108: OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Prior to version 0.46.0, the grpc Unary Server Interceptor out of t…

    first Jan 19, 2024
  • Medium max 5.3
    ALAS2-2024-2382 1 CVE

    Moderate: squid security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-25617: Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vul…

    first Jan 3, 2024
  • Medium max 5.9
    ALAS2-2021-1684 8 CVEs

    Moderate: grub2 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-20233: A flaw was found in grub2. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single qu…

    first Jul 14, 2021
  • Low
    ALAS2023-2024-514 1 CVE

    Low: sudo security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-42465: Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on n…

    first Feb 1, 2024
  • Medium max 7.5
    ALAS2023-2024-525 1 CVE

    Moderate: libtiff security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-52356: A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw all…

    first Feb 15, 2024
  • Medium max 5.5
    ALAS2023-2024-524 1 CVE

    Moderate: expat security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-52426: libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

    first Feb 15, 2024
  • Medium
    ALAS2023-2024-523 1 CVE

    Moderate: nss security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-6135: Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the pr…

    first Feb 15, 2024
  • High max 9.8
    ALAS2023-2024-522 8 CVEs

    Important: xorg-x11-server security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-21886: Heap buffer overflow in DisableDevice NOTE: https://lists.x.org/archives/xorg/2024-January/061525.html NOTE: https://gitlab.freedesktop.org/xorg/xserve…

    first Feb 15, 2024
  • Medium max 7.5
    ALAS2023-2024-521 1 CVE

    Moderate: gnutls security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-0567: A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when vali…

    first Feb 15, 2024
  • Medium max 5.9
    ALAS2023-2024-520 2 CVEs

    Moderate: openssl security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-0727: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack The package openssl098e is prov…

    first Feb 15, 2024
  • Medium
    ALAS2023-2024-535 1 CVE

    Moderate: lynx security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-38165: Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appe…

    first Feb 15, 2024
  • Low
    ALAS2023-2024-534 1 CVE

    Low: opensc security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-42779: A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid.

    first Feb 15, 2024
  • High max 7.8
    ALAS2023-2024-532 2 CVEs

    Important: GraphicsMagick security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-1270: In GraphicsMagick, a heap buffer overflow was found when parsing MIFF. CVE-2020-21679: Buffer Overflow vulnerability in WritePCXImage function in pcx.c …

    first Feb 15, 2024
  • Low max 5.9
    ALAS2023-2024-531 1 CVE

    Low: runc security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-29162: runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 wher…

    first Feb 15, 2024
  • High
    ALAS2023-2024-530 2 CVEs

    Important: cifs-utils security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-29869: A flaw was found in cifs-utils. When verbose logging is enabled, invalid credentials file lines may be dumped to stderr. This may lead to information d…

    first Feb 15, 2024
  • Medium
    ALAS2023-2024-529 1 CVE

    Moderate: nerdctl security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39326: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network t…

    first Feb 15, 2024
  • Medium max 7.8
    ALAS2023-2024-527 1 CVE

    Moderate: graphviz security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46045: buffer overflow via a crafted config6a file NOTE: Crosses no security boundary, config files are under local control NOTE: https://gitlab.com/graphviz/…

    first Feb 15, 2024
  • Medium max 6.5
    ALAS2-2024-2457 1 CVE

    Moderate: ipa security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5455: A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the…

    first Feb 15, 2024
  • Medium
    ALAS2-2024-2456 1 CVE

    Moderate: nss-softokn security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-6135: Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the priva…

    first Feb 15, 2024
  • High max 9.8
    ALAS2-2024-2455 6 CVEs

    Important: xorg-x11-server security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-21886: Heap buffer overflow in DisableDevice NOTE: https://lists.x.org/archives/xorg/2024-January/061525.html NOTE: https://gitlab.freedesktop.org/xorg/xserver/-…

    first Feb 15, 2024
  • High max 7.5
    ALAS2-2024-2454 1 CVE

    Important: gstreamer1-plugins-bad-free security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-0444: GStreamer-SA-2024-0001: AV1 codec parser potential buffer overflow during tile list parsing NOTE: https://gstreamer.freedesktop.org/security/sa-2024-0001.h…

    first Feb 15, 2024
  • High max 7.8
    ALAS2-2024-2453 1 CVE 1 exploited

    Important: kernel security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-1086: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict…

    first Feb 15, 2024
  • Medium max 5.5
    ALAS2-2024-2451 1 CVE

    Moderate: rear security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-23301: Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system se…

    first Feb 15, 2024
  • Medium max 6.5
    ALAS2-2024-2472 1 CVE

    Moderate: python-pillow security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-0775: Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (cra…

    first Feb 15, 2024
  • Medium
    ALAS2-2024-2471 4 CVEs

    Moderate: liblouis security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-12085: Liblouis 3.6.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440. C…

    first Feb 15, 2024
  • High
    ALAS2-2024-2470 2 CVEs

    Important: nss-util security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-11745: A heap-based buffer overflow was found in the NSC_EncryptUpdate() function in Mozilla nss. A remote attacker could trigger this flaw via SRTP encrypt or d…

    first Feb 15, 2024
  • High max 9.8
    ALAS2-2024-2469 1 CVE

    Important: ghostscript security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-36773: Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character cod…

    first Feb 15, 2024
  • Medium
    ALAS2-2024-2468 2 CVEs

    Moderate: unbound security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-30699: NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targe…

    first Feb 15, 2024
  • Medium max 7.5
    ALAS2-2024-2467 1 CVE

    Moderate: unbound security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-3204: A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Atta…

    first Feb 15, 2024
  • Medium max 6.1
    ALAS2-2024-2466 1 CVE

    Moderate: jsoup security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-36033: jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML includ…

    first Feb 15, 2024
  • Medium max 7.0
    ALAS2-2024-2465 2 CVEs

    Moderate: edk2 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-36764: EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Succes…

    first Feb 15, 2024
  • Medium max 6.5
    ALAS2-2024-2464 1 CVE

    Moderate: xstream security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-40151: Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacke…

    first Feb 15, 2024
  • Medium max 6.5
    ALAS2-2024-2463 1 CVE

    Moderate: woodstox-core security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-40152: Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user su…

    first Feb 15, 2024
  • Medium max 7.5
    ALAS2-2024-2461 1 CVE

    Moderate: jtidy security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-34623: An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dep…

    first Feb 15, 2024
  • Medium max 5.3
    ALAS2-2024-2460 1 CVE

    Moderate: jetty security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-40167: Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding th…

    first Feb 15, 2024
  • Medium max 6.4
    ALAS2-2024-2396 5 CVEs

    Moderate: ntp security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-26555: praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS rec…

    first Jan 3, 2024
  • High max 8.8
    ALAS2-2023-1983 14 CVEs

    Important: thunderbird security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-25746: Mozilla Foundation Security Advisory: Mozilla developers Philipp and Gabriele Svelto reported memory safety bugs present in Firefox ESR 102.7. Some of the…

    first Mar 2, 2023
  • Medium max 5.5
    ALAS2-2022-1842 2 CVEs

    Moderate: microcode_ctl security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-21233: A flaw was found in hw. The APIC can operate in xAPIC mode (also known as a legacy mode), in which APIC configuration registers are exposed through a memo…

    first Sep 1, 2022
  • Medium max 5.5
    ALAS2023-2023-296 2 CVEs

    Moderate: ghostscript security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38559: A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denia…

    first Aug 17, 2023