4,948 results · Feed
-
MediumALAS2-2023-2232 1 CVE
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-20588: A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.
first Aug 31, 2023 -
Medium max 7.5ALAS2-2023-2230 4 CVEs
Moderate: curl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28322: When doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFI…
first Aug 31, 2023 -
MediumALAS2-2023-2228 1 CVE
Moderate: cups security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32360: An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13…
first Aug 31, 2023 -
Medium max 6.5ALAS2-2023-2243 2 CVEs
Moderate: poppler security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-37050: In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF fil…
first Aug 31, 2023 -
High max 7.8ALAS2-2023-2179 4 CVEs
Important: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3776: A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_inde…
first Aug 3, 2023 -
Medium max 5.5ALAS2-2023-2212 6 CVEs
Moderate: libtiff security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-3627: LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing att…
first Aug 17, 2023 -
HighALAS2-2023-2208 2 CVEs
Important: cni-plugins security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29409: Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA ke…
first Aug 17, 2023 -
MediumALAS2023-2023-285 3 CVEs
Moderate: kernel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-20593: An issue in "Zen 2" CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. CVE-2023-…
first Aug 3, 2023 -
High max 7.5ALAS2023-2023-316 5 CVEs
Important: samba security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-34968: Spotlight server-side Share Path Disclosure NOTE: https://www.samba.org/samba/security/CVE-2023-34968.html CVE-2023-34967: Samba Spotlight mdssvc RPC R…
first Aug 17, 2023 -
Medium max 6.1ALAS2023-2023-315 1 CVE
Moderate: jsoup security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-36033: jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML inc…
first Aug 17, 2023 -
High max 7.5ALAS2023-2023-313 2 CVEs
Important: nerdctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire re…
first Aug 17, 2023 -
High max 7.8ALAS2023-2023-312 2 CVEs
Important: containerd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire re…
first Aug 17, 2023 -
HighALAS2023-2023-311 1 CVE
Important: runc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire re…
first Aug 17, 2023 -
Medium max 5.3ALAS2023-2023-306 3 CVEs
Moderate: openssl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3817: Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_chec…
first Aug 17, 2023 -
High max 9.8ALAS2023-2023-304 3 CVEs
Important: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-32559: The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.…
first Aug 17, 2023 -
Medium max 2.6ALAS2023-2023-303 1 CVE
Moderate: php8.1 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3247: GHSA-76gg-c692-v2mw: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP NOTE: Fixed in 8.2.7, 8.1.20, 8.0.29 NOTE:…
first Aug 17, 2023 -
High max 8.1ALAS2023-2023-302 1 CVE
Important: dotnet6.0 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-33170: ASP.NET and Visual Studio Security Feature Bypass Vulnerability
first Aug 17, 2023 -
MediumALAS2023-2023-301 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-34151: A vulnerability was found in ImageMagick. This issue occurs as an undefined behavior, casting double to size_t in svg, mvg and other coders.
first Aug 17, 2023 -
High max 8.6ALAS2023-2023-300 5 CVEs
Important: ecs-service-connect-agent security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-35945: Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receivin…
first Aug 17, 2023 -
High max 6.5ALAS2023-2023-298 1 CVE
Important: libtiff security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3618: A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libti…
first Aug 17, 2023 -
High max 7.5ALAS2023-2023-297 1 CVE
Important: ca-certificates security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-37920: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. …
first Aug 17, 2023 -
HighALAS2023-2023-295 1 CVE
Important: librsvg2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38633: A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local fi…
first Aug 17, 2023 -
HighALAS2023-2023-294 1 CVE
Important: libqb security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-39976: log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.
first Aug 17, 2023 -
MediumALAS2023-2023-293 1 CVE
Moderate: haproxy security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-40225: HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x b…
first Aug 17, 2023 -
Low max 4.4ALAS2023-2023-292 1 CVE
Low: gawk security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-4156: A heap out-of-bounds read flaw was found in builtin.c in the gawk package which may result in a crash of the software.
first Aug 17, 2023 -
Medium max 7.0ALAS2-2023-2221 3 CVEs
Moderate: glibc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-1752: A use-after-free vulnerability was found in glibc in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a…
first Aug 21, 2023 -
Medium max 7.6ALAS2-2023-2220 1 CVE
Moderate: libgovirt security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-10893: Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause th…
first Aug 21, 2023 -
Medium max 7.6ALAS2-2023-2219 1 CVE
Moderate: spice-protocol security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-10893: Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause th…
first Aug 21, 2023 -
Medium max 5.3ALAS2-2023-2205 1 CVE
Moderate: edk2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3817: Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_e…
first Aug 17, 2023 -
Medium max 7.8ALAS2-2023-2218 3 CVEs
Moderate: amanda security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-30577: AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different vulnerability…
first Aug 17, 2023 -
MediumALAS2-2023-2217 1 CVE
Moderate: oniguruma security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-9224: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read oc…
first Aug 17, 2023 -
Medium max 4.8ALAS2-2023-2216 1 CVE
Moderate: tomcat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-1935: A flaw was found in Apache Tomcat. The HTTP header parsing code used an approach to end-of-line (EOL) parsing that allowed some invalid HTTP headers to be …
first Aug 17, 2023 -
Medium max 3.3ALAS2-2023-2215 2 CVEs
Moderate: exiv2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-29464: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was foun…
first Aug 17, 2023 -
MediumALAS2-2023-2214 1 CVE
Moderate: libjpeg-turbo security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-46822: The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16…
first Aug 17, 2023 -
LowALAS2-2023-2213 1 CVE
Low: wavpack security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-2476: A null pointer dereference bug was found in wavpack-5.4.0 The results from the ASAN log: AddressSanitizer:DEADLYSIGNAL ====================================…
first Aug 17, 2023 -
Medium max 6.0ALAS2-2023-2207 1 CVE
Moderate: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3180: A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check fo…
first Aug 17, 2023 -
Medium max 7.8ALAS2-2023-2206 2 CVEs
Moderate: kernel security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-4128: A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel. This flaw allows a local attacke…
first Aug 17, 2023 -
Medium max 5.5ALAS2-2023-2204 1 CVE
Moderate: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38559: A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial o…
first Aug 17, 2023 -
Medium max 9.8ALAS2-2022-1739 3 CVEs
Moderate: log4j security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-4104: A flaw was found in the Java logging library Apache Log4j in version 1.x . This allows a remote attacker to execute code on the server if the deployed appl…
first Jan 18, 2022 -
High max 7.0ALAS2023-2023-291 1 CVE
Important: redis6 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-24834: A heap-based buffer overflow flaw was found in Redis. This flaw allows an attacker to trick an authenticated user into executing a specially crafted Lu…
first Aug 3, 2023