4,948 results · Feed
-
MediumALAS2-2024-2380 1 CVE
Moderate: ncurses security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-50495: NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().
first Jan 3, 2024 -
HighALAS2-2024-2379 7 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-6212: Memory safety bugs present in Firefox 119, Firefox 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption and we presume tha…
first Jan 3, 2024 -
High max 7.8ALAS2-2024-2378 2 CVEs
Important: xorg-x11-server security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-6478: A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which ma…
first Jan 3, 2024 -
HighALAS2-2024-2386 1 CVE
Important: bluez security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-45866: bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution
first Jan 3, 2024 -
Low max 5.3ALAS2-2024-2385 1 CVE
Low: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-46219: When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the…
first Jan 3, 2024 -
Low max 3.6ALAS2-2024-2384 1 CVE
Low: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-48706: Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and u…
first Jan 3, 2024 -
High max 8.8ALAS2-2024-2383 4 CVEs
Important: virtuoso-opensource security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-48952: An issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running…
first Jan 3, 2024 -
Low max 6.2ALAS2-2024-2390 1 CVE
Low: tar security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-39804: It was discovered that tar incorrectly handled extended attributes in PAX archives. An attacker could supply a specially crafted file and cause tar to cra…
first Jan 3, 2024 -
Medium max 5.5ALAS2-2024-2389 1 CVE
Moderate: libXpm security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-43786: A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available syst…
first Jan 3, 2024 -
Medium max 5.3ALAS2-2024-2388 3 CVEs
Moderate: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-45284: path/filepath: recognize device names with trailing spaces and superscripts The IsLocal function did not correctly detect reserved names in some cases: - …
first Jan 3, 2024 -
Medium max 4.2ALAS2-2024-2387 1 CVE
Moderate: python-urllib3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-45803: urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using s…
first Jan 3, 2024 -
Medium max 5.5ALAS2-2024-2398 2 CVEs
Moderate: resteasy-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0482: In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with i…
first Jan 3, 2024 -
Medium max 5.3ALAS2-2024-2397 2 CVEs
Moderate: java-1.8.0-openjdk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-22081: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle J…
first Jan 3, 2024 -
Medium max 7.1ALAS2-2024-2395 1 CVE
Moderate: dmidecode security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-30630: Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plau…
first Jan 3, 2024 -
Medium max 3.5ALAS2-2024-2394 1 CVE
Moderate: jetty security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-36479: Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may h…
first Jan 3, 2024 -
Medium max 6.2ALAS2-2024-2393 1 CVE
Moderate: avahi security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38472: A reachable assertion was found in avahi_rdata_parse.
first Jan 3, 2024 -
Medium max 5.3ALAS2-2024-2408 1 CVE
Moderate: jetty security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-28169: For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protecte…
first Jan 3, 2024 -
Medium max 5.5ALAS2-2024-2407 1 CVE
Moderate: gstreamer-plugins-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3522: A flaw was found in gstreamer-plugins-base where an out-of-bounds read when handling certain ID3v2 tags is possible. The highest threat from this vulnerabi…
first Jan 3, 2024 -
Medium max 6.5ALAS2-2024-2406 1 CVE
Moderate: python-ldap security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-46823: python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression d…
first Jan 3, 2024 -
Low max 7.3ALAS2-2024-2405 1 CVE
Low: perl-HTTP-Daemon security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-31081: HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to …
first Jan 3, 2024 -
MediumALAS2-2024-2404 1 CVE
Moderate: libsndfile security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-33065: Multiple signed integers overflow in function au_read_header in src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c in Libsndfile, allo…
first Jan 3, 2024 -
Medium max 6.5ALAS2-2024-2403 2 CVEs
Moderate: snakeyaml security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-38751: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an at…
first Jan 3, 2024 -
Medium max 6.5ALAS2-2024-2402 1 CVE
Moderate: net-snmp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-44793: handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remot…
first Jan 3, 2024 -
Medium max 6.5ALAS2-2024-2401 8 CVEs
Moderate: binutils security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1972: Potential heap based buffer overflow found in _bfd_elf_slurp_version_tables() in bfd/elf.c. CVE-2022-48064: GNU Binutils before 2.40 was discovered to cont…
first Jan 3, 2024 -
MediumALAS2-2024-2400 1 CVE
Moderate: python security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-48566: An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator v…
first Jan 3, 2024 -
Medium max 8.6ALAS2-2024-2399 3 CVEs
Moderate: c-ares security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-31130: ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares onl…
first Jan 3, 2024 -
Medium max 5.5ALAS2-2024-2413 1 CVE
Moderate: python-pillow security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-9189: Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer O…
first Jan 3, 2024 -
Medium max 8.2ALAS2-2024-2411 1 CVE
Moderate: xmlgraphics-commons security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-11988: Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a …
first Jan 3, 2024 -
LowALAS2-2024-2410 1 CVE
Low: libuv security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-22918: Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p …
first Jan 3, 2024 -
Medium max 7.5ALAS2023-2024-471 1 CVE
Moderate: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46589: Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 throug…
first Jan 3, 2024 -
HighALAS2023-2024-470 1 CVE
Important: ghostscript security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46751: An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the ap…
first Jan 3, 2024 -
Low max 3.6ALAS2023-2024-469 1 CVE
Low: vim security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-48706: Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time an…
first Jan 3, 2024 -
Medium max 5.9ALAS2023-2024-468 1 CVE
Moderate: libssh security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-48795: AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has …
first Jan 3, 2024 -
High max 8.6ALAS2023-2024-467 1 CVE
Important: squid security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-50269: Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions …
first Jan 3, 2024 -
MediumALAS2023-2024-466 1 CVE
Moderate: ncurses security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-50495: NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().
first Jan 3, 2024 -
Medium max 7.1ALAS2023-2024-465 1 CVE
Moderate: ansible-core security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5764: The upstream bug report describes this issue as follows: A flaw was found in Ansible, where a user's controller is vulnerable to template injection when…
first Jan 3, 2024 -
High max 8.8ALAS2023-2024-464 3 CVEs
Important: postgresql15 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5870: The documentation says the pg_cancel_backend role cannot signal "a backend owned by a superuser". On the contrary, it can signal background workers, inc…
first Jan 3, 2024 -
Medium max 5.9ALAS2023-2024-463 1 CVE
Moderate: gnutls security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5981: A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with c…
first Jan 3, 2024 -
MediumALAS2023-2024-481 1 CVE
Moderate: p7zip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-47069: p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at CPP/7zip/Archiv…
first Jan 3, 2024 -
Medium max 5.5ALAS2023-2024-479 1 CVE
Moderate: bouncycastle security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-33202: Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class…
first Jan 3, 2024