4,948 results · Feed
-
LowALAS2-2023-2368 1 CVE
Low: uriparser security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-46142: An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.
first Nov 29, 2023 -
Medium max 6.5ALAS2-2023-2367 2 CVEs
Moderate: samba security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4091: SMB client can truncate files to 0 bytes by opening files with OVERWRITE disposition when using the acl_xattr Samba VFS module with the smb.conf setting "a…
first Nov 29, 2023 -
Medium max 6.5ALAS2-2023-2366 6 CVEs
Moderate: net-snmp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-24810: A flaw was found in net-snmp. A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference issue. CVE-2022-24809: A flaw was fou…
first Nov 29, 2023 -
Medium max 8.8ALAS2-2023-2365 1 CVE
Moderate: dovecot security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-30550: An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and a…
first Nov 29, 2023 -
LowALAS2-2023-2364 1 CVE
Low: libarchive security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-36227: In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, whi…
first Nov 29, 2023 -
Medium max 6.5ALAS2-2023-2363 1 CVE
Moderate: jettison security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-40149: Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied i…
first Nov 29, 2023 -
Medium max 7.5ALAS2-2023-2362 1 CVE
Moderate: python-wheel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker contro…
first Nov 29, 2023 -
Low max 3.3ALAS2-2023-2361 1 CVE
Low: advancecomp security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-2961: advancecomp has a segmentation fault on invalid MNG size
first Nov 29, 2023 -
MediumALAS2-2023-2358 1 CVE
Moderate: indent security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-40305: GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
first Nov 29, 2023 -
Low max 4.4ALAS2-2023-2357 1 CVE
Low: gawk security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4156: A heap out-of-bounds read flaw was found in builtin.c in the gawk package which may result in a crash of the software.
first Nov 29, 2023 -
Medium max 5.5ALAS2-2023-2356 1 CVE
Moderate: libX11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-43786: A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available syst…
first Nov 29, 2023 -
High max 8.8ALAS2-2023-2355 2 CVEs
Important: gstreamer1-plugins-bad-free security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-44446: gstreamer: MXF demuxer use-after-free vulnerability CVE-2023-44429: gstreamer: AV1 codec parser heap-based buffer overflow
first Nov 29, 2023 -
High max 8.6ALAS2-2023-2354 2 CVEs
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-46728: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Servi…
first Nov 29, 2023 -
High max 7.0ALAS2-2023-2352 1 CVE
Important: xorg-x11-server security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5574: A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with…
first Nov 29, 2023 -
Medium max 5.3ALAS2-2023-2351 1 CVE
Moderate: openssl11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5678: Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applica…
first Nov 29, 2023 -
Medium max 5.3ALAS2-2023-2350 1 CVE
Moderate: openssl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5678: Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applica…
first Nov 29, 2023 -
Medium max 5.5ALAS2-2023-2349 1 CVE
Moderate: python-pip security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5752: When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inj…
first Nov 29, 2023 -
Medium max 7.8ALAS2-2023-2348 1 CVE
Moderate: wireshark security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-6175: A heap based buffer overflow in Wireshark's NetScreen file parser may lead to a local arbitrary code execution via a crafted capture file.
first Nov 29, 2023 -
High max 6.5ALAS2-2023-2347 1 CVE
Important: libtiff security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-6277: An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a cr…
first Nov 29, 2023 -
High max 6.5ALAS2-2023-2346 1 CVE
Important: compat-libtiff3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-6277: An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a cr…
first Nov 29, 2023 -
Medium max 6.8ALAS2-2023-2236 8 CVEs
Moderate: libtiff security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0804: LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For…
first Aug 31, 2023 -
High max 5.8ALAS2-2020-1405 4 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-8648: A use-after-free flaw was found in the Linux kernel console driver when using the copy-paste buffer. This flaw allows a local user to crash the system. CVE…
first Mar 23, 2020 -
Medium max 4.0ALAS2-2023-2338 1 CVE
Moderate: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-46246: Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/all…
first Nov 9, 2023 -
High max 8.8
Important: qt5-qtimageformats security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4863: Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML…
first Nov 9, 2023 -
Medium max 6.4ALAS2-2023-2336 1 CVE
Moderate: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5088: A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting…
first Nov 9, 2023 -
High max 7.8ALAS2-2023-2335 2 CVEs
Important: xorg-x11-server security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5380: A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with …
first Nov 9, 2023 -
High max 7.5ALAS2-2023-2334 6 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5732: The Mozilla Foundation Security Advisory describes this flaw as: An attacker could have created a malicious link using bidirectional characters to spoof th…
first Nov 9, 2023 -
Medium max 7.5ALAS2-2023-2345 1 CVE
Moderate: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-41817: A flaw was found in ruby, where the date object was found to be vulnerable to a regular expression denial of service (ReDoS) during the parsing of dates. …
first Nov 9, 2023 -
MediumALAS2-2023-2344 1 CVE
Moderate: re2c security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-23901: A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.
first Nov 9, 2023 -
Medium max 7.8ALAS2-2023-2343 1 CVE
Moderate: ctags security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-4515: A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the …
first Nov 9, 2023 -
Medium max 4.2ALAS2-2023-2342 1 CVE
Moderate: amazon-efs-utils security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-46174: efs-utils is a set of Utilities for Amazon Elastic File System (EFS). A potential race condition issue exists within the Amazon EFS mount helper in efs-ut…
first Nov 9, 2023 -
High max 8.8ALAS2-2023-2341 1 CVE
Important: microcode_ctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-23583: An issue was found in redundant REX instruction prefix values affecting third generation Intel Xeon Scalable (?Icelake?) processors. The issue may allow a…
first Nov 9, 2023 -
High max 7.5ALAS2023-2023-435 1 CVE
Important: ecs-init security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39325: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited …
first Nov 9, 2023 -
HighALAS2023-2023-433 3 CVEs
Important: httpd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-45802: Description A flaw was found in mod_http2. When a HTTP/2 stream is reset (RST frame) by a client, there is a time window were the request's memory reso…
first Nov 9, 2023 -
Medium max 5.3ALAS2023-2023-432 1 CVE
Moderate: python-twisted security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46137: Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twis…
first Nov 9, 2023 -
Medium max 4.0ALAS2023-2023-431 1 CVE
Moderate: vim security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46246: Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/…
first Nov 9, 2023 -
Medium max 4.2ALAS2023-2023-437 1 CVE
Moderate: amazon-efs-utils security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-46174: efs-utils is a set of Utilities for Amazon Elastic File System (EFS). A potential race condition issue exists within the Amazon EFS mount helper in efs…
first Nov 9, 2023 -
MediumALAS2023-2023-438 1 CVE
Moderate: re2c security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-23901: A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.
first Nov 9, 2023 -
High max 5.3ALAS2023-2023-427 2 CVEs
Important: java-11-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-22081: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracl…
first Oct 30, 2023 -
High max 5.3ALAS2023-2023-426 3 CVEs
Important: java-1.8.0-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-22081: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracl…
first Oct 30, 2023