4,948 results · Feed
-
MediumALAS2-2023-2260 1 CVE
Moderate: exempi security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-18651: Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of …
first Sep 13, 2023 -
High max 9.4ALAS2023-2023-325 3 CVEs
Important: php8.1 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3824: In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insuffici…
first Aug 31, 2023 -
Medium max 10.0ALAS2023-2023-179 2 CVEs
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-31436: qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. CVE-2023-…
first May 11, 2023 -
Medium max 6.8ALAS2-2023-2235 5 CVEs
Moderate: compat-libtiff3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0804: LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For…
first Aug 31, 2023 -
Medium max 4.8ALAS2-2023-2244 1 CVE
Moderate: gcc10 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4039: An issue was found in a defense in depth feature of the GCC compiler on aarch64 platforms. The stack protector feature (-fstack-protector) did not detect o…
first Sep 8, 2023 -
Medium max 4.8ALAS2-2023-2245 1 CVE
Moderate: gcc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4039: An issue was found in a defense in depth feature of the GCC compiler on aarch64 platforms. The stack protector feature (-fstack-protector) did not detect o…
first Sep 8, 2023 -
Medium max 5.3ALAS2-2023-2246 2 CVEs
Moderate: openssl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3817: Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_e…
first Sep 8, 2023 -
Medium max 4.8ALAS2023-2023-342 1 CVE
Moderate: gcc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-4039: An issue was found in a defense in depth feature of the GCC compiler on aarch64 platforms. The stack protector feature (-fstack-protector) did not detec…
first Sep 8, 2023 -
MediumALAS2023-2023-341 1 CVE
Moderate: gdk-pixbuf2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-46829: GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by…
first Aug 31, 2023 -
MediumALAS2023-2023-340 1 CVE
Moderate: poppler security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-38349: An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict …
first Aug 31, 2023 -
High max 7.5ALAS2023-2023-338 3 CVEs
Important: cni-plugins security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29409: Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA…
first Aug 31, 2023 -
High max 7.5ALAS2023-2023-337 1 CVE
Important: amazon-ecr-credential-helper security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-41723: http2/hpack: avoid quadratic complexity in hpack decoding
first Aug 31, 2023 -
High max 8.2ALAS2023-2023-336 1 CVE
Important: apache-ivy security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-46751: Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy…
first Aug 31, 2023 -
MediumALAS2023-2023-335 1 CVE
Moderate: hwloc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-47022: An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology…
first Aug 31, 2023 -
MediumALAS2023-2023-334 7 CVEs
Moderate: binutils security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-48065: GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c. CVE-2022-48064: GNU…
first Aug 31, 2023 -
LowALAS2023-2023-333 1 CVE
Low: file security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-48554: File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.
first Aug 31, 2023 -
Medium max 5.5ALAS2023-2023-332 1 CVE
Moderate: avahi security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1981: avahi-daemon denial of service can be caused by unprivileged users via DBus
first Aug 31, 2023 -
High max 7.5ALAS2023-2023-331 1 CVE
Important: clamav security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-20197: A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to ca…
first Aug 31, 2023 -
Medium max 5.5ALAS2023-2023-329 1 CVE
Moderate: libtiff security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2731: A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft sp…
first Aug 31, 2023 -
Medium max 7.1ALAS2023-2023-328 1 CVE
Moderate: dmidecode security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-30630: Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is p…
first Aug 31, 2023 -
MediumALAS2023-2023-327 1 CVE
Moderate: cups security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-32360: An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura…
first Aug 31, 2023 -
High max 9.4ALAS2023-2023-324 2 CVEs
Important: php8.2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3824: In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insuffici…
first Aug 31, 2023 -
High max 7.8ALAS2023-2023-323 1 CVE
Important: rust security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38497: Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did…
first Aug 31, 2023 -
High max 7.5ALAS2023-2023-322 1 CVE
Important: postgresql15 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39417: IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting …
first Aug 31, 2023 -
Medium max 8.8ALAS2023-2023-321 2 CVEs
Moderate: krb5 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39975: kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorizat…
first Aug 31, 2023 -
MediumALAS2023-2023-320 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39978: ImageMagick before 6.9.12-91 allows attackers to cause a denial of service (memory consumption) in Magick::Draw.
first Aug 31, 2023 -
HighALAS2023-2023-319 1 CVE
Important: python3.9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-40217: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (su…
first Aug 31, 2023 -
MediumALAS2023-2023-318 1 CVE
Moderate: indent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-40305: GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.
first Aug 31, 2023 -
HighALAS2023-2023-317 2 CVEs
Important: python3.11 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-41105: An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unex…
first Aug 31, 2023 -
Medium max 5.3ALAS2-2023-2227 1 CVE
Moderate: qt5-qtbase security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32762: QT-based clients may mismatch HSTS headers (Strict-Transport-Security), which would prevent the client from switching to a secure HTTPS connection as requ…
first Aug 31, 2023 -
Medium max 5.3ALAS2-2023-2226 2 CVEs
Moderate: openssl11 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3817: Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_e…
first Aug 31, 2023 -
MediumALAS2-2023-2225 1 CVE
Moderate: krb5 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-36054: lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user c…
first Aug 31, 2023 -
High max 7.5ALAS2-2023-2224 1 CVE
Important: ca-certificates security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-37920: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Cer…
first Aug 31, 2023 -
High max 7.8ALAS2-2023-2223 1 CVE
Important: rust security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38497: Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did no…
first Aug 31, 2023 -
HighALAS2-2023-2222 1 CVE
Important: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-40217: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such …
first Aug 31, 2023 -
MediumALAS2-2023-2241 1 CVE
Moderate: OpenEXR security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3479: There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by O…
first Aug 31, 2023 -
MediumALAS2-2023-2239 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-40211: An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of coders/emf.c.
first Aug 31, 2023 -
MediumALAS2-2023-2237 1 CVE
Moderate: hwloc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-47022: An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-li…
first Aug 31, 2023 -
MediumALAS2-2023-2234 2 CVEs
Moderate: LibRaw security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1729: A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to application crash. CVE-2020-35533: In…
first Aug 31, 2023 -
High max 7.5ALAS2-2023-2233 1 CVE
Important: clamav security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-20197: A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause…
first Aug 31, 2023