4,948 results · Feed
-
Medium max 7.5ALAS2023-2024-478 1 CVE
Moderate: jtidy security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-34623: An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic …
first Jan 3, 2024 -
Medium max 5.3ALAS2023-2024-477 3 CVEs
Moderate: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45284: path/filepath: recognize device names with trailing spaces and superscripts The IsLocal function did not correctly detect reserved names in some cases:…
first Jan 3, 2024 -
Medium max 6.1ALAS2023-2024-476 1 CVE
Moderate: ecs-init security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3978: Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attac…
first Jan 3, 2024 -
Low max 6.2ALAS2023-2024-475 1 CVE
Low: tar security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39804: It was discovered that tar incorrectly handled extended attributes in PAX archives. An attacker could supply a specially crafted file and cause tar to …
first Jan 3, 2024 -
High max 7.5
Important: grpc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited …
first Jan 3, 2024 -
HighALAS2023-2024-473 1 CVE
Important: bluez security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45866: bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution
first Jan 3, 2024 -
Low max 5.3ALAS2023-2024-472 1 CVE
Low: curl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46219: When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of …
first Jan 3, 2024 -
High max 8.1
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in …
first Oct 16, 2023 -
High max 8.8ALAS2-2023-2028 11 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29550: The Mozilla Foundation describes this issue as follows: Mozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team…
first Apr 27, 2023 -
High max 7.5ALAS2-2021-1645 10 CVEs
Important: xstream security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-21351: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attack…
first May 20, 2021 -
Medium max 5.9ALAS2-2023-2376 1 CVE
Moderate: openssh security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-48795: AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has bee…
first Dec 18, 2023 -
Medium max 5.9ALAS2023-2023-462 1 CVE
Moderate: openssh security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-48795: AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has …
first Dec 18, 2023 -
Medium max 7.5ALAS2-2023-2371 2 CVEs
Moderate: glibc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-38604: In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL poin…
first Nov 29, 2023 -
High max 8.8
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4863: Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML…
first Oct 12, 2023 -
MediumALAS2023-2023-449 2 CVEs
Moderate: memcached security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46853: In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n. CVE-2023-46852: In …
first Dec 6, 2023 -
Low max 3.9ALAS2023-2023-447 7 CVEs
Low: vim security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-48237: Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may …
first Dec 6, 2023 -
Medium max 5.9ALAS2023-2023-446 1 CVE
Moderate: python-cryptography security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-49083: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_…
first Dec 6, 2023 -
High max 7.0ALAS2023-2023-444 1 CVE
Important: xorg-x11-server security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5574: A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup w…
first Dec 6, 2023 -
Medium max 5.3ALAS2023-2023-443 1 CVE
Moderate: openssl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5678: Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Appl…
first Dec 6, 2023 -
Medium max 5.5ALAS2023-2023-442 1 CVE
Moderate: python-pip security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5752: When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to …
first Dec 6, 2023 -
Medium max 7.8ALAS2023-2023-440 2 CVEs
Moderate: wireshark security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-6175: A heap based buffer overflow in Wireshark's NetScreen file parser may lead to a local arbitrary code execution via a crafted capture file. CVE-2023-6174…
first Dec 6, 2023 -
High max 6.5ALAS2023-2023-439 1 CVE
Important: libtiff security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-6277: An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a…
first Dec 6, 2023 -
Medium max 4.8ALAS2023-2023-459 1 CVE
Moderate: python-cryptography security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-23931: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would…
first Dec 6, 2023 -
Medium max 5.5ALAS2023-2023-458 1 CVE
Moderate: guava security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2976: Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android…
first Dec 6, 2023 -
Medium max 7.6ALAS2023-2023-457 2 CVEs
Moderate: dotnet6.0 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-36558: ASP.NET Core - Security Feature Bypass Vulnerability CVE-2023-36049: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
first Dec 6, 2023 -
Medium max 6.2ALAS2023-2023-456 1 CVE
Moderate: avahi security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38472: A reachable assertion was found in avahi_rdata_parse.
first Dec 6, 2023 -
Medium max 6.2ALAS2023-2023-455 1 CVE
Moderate: avahi security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38473: A reachable assertion was found in avahi_alternative_host_name.
first Dec 6, 2023 -
Medium max 5.9ALAS2023-2023-454 1 CVE
Moderate: python-urllib3 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-43804: urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing c…
first Dec 6, 2023 -
Medium max 7.5ALAS2023-2023-453 1 CVE
Moderate: python-pillow security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-44271: An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially ca…
first Dec 6, 2023 -
Low max 5.5ALAS2023-2023-452 1 CVE
Low: traceroute security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46316: In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines.
first Dec 6, 2023 -
MediumALAS2023-2023-451 1 CVE
Moderate: jbig2dec security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46361: Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.
first Dec 6, 2023 -
Low max 4.7ALAS2023-2023-450 1 CVE
Low: shadow-utils security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-4641: A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, sha…
first Dec 6, 2023 -
High max 9.3ALAS2023-2023-429 4 CVEs
Important: squid security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46848: This problem allows a remote client to perform Denial of Service when sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP…
first Nov 9, 2023 -
Low max 3.9ALAS2-2023-2353 7 CVEs
Low: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-48237: Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be …
first Nov 29, 2023 -
High max 8.1ALAS2-2023-2375 4 CVEs
Important: php security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0662: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption a…
first Nov 29, 2023 -
MediumALAS2-2023-2374 1 CVE
Moderate: libarchive security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-31566: An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside…
first Nov 29, 2023 -
LowALAS2-2023-2373 1 CVE
Low: binutils security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-32256: An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c.
first Nov 29, 2023 -
MediumALAS2-2023-2372 1 CVE
Moderate: avahi security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3468: A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not corr…
first Nov 29, 2023 -
MediumALAS2-2023-2370 2 CVEs
Moderate: mailman security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-43332: In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could pote…
first Nov 29, 2023 -
LowALAS2-2023-2369 1 CVE
Low: gmp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-43618: A flaw was found in gmp. An integer overflow vulnerability could allow an attacker to input an integer value leading to a crash. The highest threat from t…
first Nov 29, 2023