4,948 results · Feed
-
High max 7.5ALAS2023-2023-290 2 CVEs
Important: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-35945: Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receivin…
first Aug 3, 2023 -
MediumALAS2023-2023-289 1 CVE
Moderate: poppler security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-38784: Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processin…
first Aug 3, 2023 -
Medium max 7.5ALAS2023-2023-288 1 CVE
Moderate: python-mako security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-40023: Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin a…
first Aug 3, 2023 -
Medium max 6.5ALAS2023-2023-287 1 CVE
Moderate: microcode_ctl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-40982: A Gather Data Sampling (GDS) transient execution side-channel vulnerability was found affecting certain Intel processors. This issue may allow a local …
first Aug 3, 2023 -
LowALAS2023-2023-286 1 CVE
Low: pcre2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-41409: Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.
first Aug 3, 2023 -
MediumALAS2023-2023-284 1 CVE
Moderate: linux-firmware security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-20593: An issue in "Zen 2" CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.
first Aug 3, 2023 -
HighALAS2023-2023-283 1 CVE
Important: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire re…
first Aug 3, 2023 -
High max 7.5ALAS2023-2023-281 1 CVE
Important: ca-certificates security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-32803: An initial fix in Amazon Linux ca-certificates package relating to CVE-2022-23491 did not properly remove root certificates from TrustCor from the root…
first Aug 3, 2023 -
Medium max 5.3ALAS2023-2023-280 1 CVE
Moderate: bouncycastle security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-33201: A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any…
first Aug 3, 2023 -
Medium max 6.5ALAS2023-2023-279 1 CVE
Moderate: yajl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-33460: There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash.
first Aug 3, 2023 -
High max 7.5ALAS2023-2023-278 1 CVE
Important: nghttp2 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-35945: Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receivin…
first Aug 3, 2023 -
Medium max 5.3ALAS2023-2023-277 2 CVEs
Moderate: wireshark security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3649: iSCSI dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file CVE-2023-3648: Kafka dissector c…
first Aug 3, 2023 -
HighALAS2023-2023-276 1 CVE
Important: ghostscript security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-36664: Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
first Aug 3, 2023 -
MediumALAS2023-2023-275 1 CVE
Moderate: yasm security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-37732: Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which allows the attacker to cause a denial of service …
first Aug 3, 2023 -
HighALAS2023-2023-274 1 CVE
Important: iperf3 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38403: iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.
first Aug 3, 2023 -
High max 9.8ALAS2023-2023-273 1 CVE
Important: openssh security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38408: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if the target …
first Aug 3, 2023 -
Medium max 6.2ALAS2023-2023-272 3 CVEs
Moderate: avahi security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-38471: A reachable assertion was found in dbus_set_host_name. CVE-2023-38470: A reachable assertion was found in avahi_escape_label. CVE-2023-38469: A reachab…
first Aug 3, 2023 -
High max 7.5ALAS2-2023-2203 1 CVE
Important: ca-certificates security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32803: An initial fix in Amazon Linux ca-certificates package relating to CVE-2022-23491 did not properly remove root certificates from TrustCor from the root st…
first Aug 3, 2023 -
Low max 3.7ALAS2-2023-2188 1 CVE
Low: python-configobj security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-26112: All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Not…
first Aug 3, 2023 -
Medium max 5.3ALAS2-2023-2187 2 CVEs
Moderate: wireshark security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-2952: XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file CVE-2023-…
first Aug 3, 2023 -
HighALAS2-2023-2186 1 CVE
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire reque…
first Aug 3, 2023 -
HighALAS2-2023-2185 1 CVE
Important: golist security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire reque…
first Aug 3, 2023 -
Medium max 7.5ALAS2-2023-2184 1 CVE
Moderate: cups security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32324: OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to la…
first Aug 3, 2023 -
Medium max 6.5ALAS2-2023-2182 1 CVE
Moderate: yajl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-33460: There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash.
first Aug 3, 2023 -
High max 7.5ALAS2-2023-2180 1 CVE
Important: nghttp2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-35945: Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `…
first Aug 3, 2023 -
Medium max 5.5ALAS2-2023-2178 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3745: A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick…
first Aug 3, 2023 -
High max 8.8
Important: webkitgtk4 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-37450: A vulnerability was found in webkitgtk. This issue occurs when processing web content, which may lead to arbitrary code execution.
first Aug 3, 2023 -
High max 9.8ALAS2-2023-2176 1 CVE
Important: openssh security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38408: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if the target use…
first Aug 3, 2023 -
Medium max 6.2ALAS2-2023-2175 3 CVEs
Moderate: avahi security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-38471: A reachable assertion was found in dbus_set_host_name. CVE-2023-38470: A reachable assertion was found in avahi_escape_label. CVE-2023-38469: A reachable …
first Aug 3, 2023 -
Medium max 5.3ALAS2-2023-2202 1 CVE
Moderate: openssh security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-35812: An issue was discovered in OpenSSH 7.4 on Amazon Linux 2 and Amazon Linux 1. The fix for CVE-2019-6111 only covered cases where an absolute path is passed…
first Aug 3, 2023 -
MediumALAS2-2023-2201 1 CVE
Moderate: ruby security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-9224: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read oc…
first Aug 3, 2023 -
Medium max 6.1ALAS2-2023-2200 1 CVE
Moderate: tomcat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-0221: The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, ther…
first Aug 3, 2023 -
MediumALAS2-2023-2199 1 CVE
Moderate: aspell security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-25051: objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::loo…
first Aug 3, 2023 -
Medium max 7.5ALAS2-2023-2198 1 CVE
Moderate: python-pygments security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have…
first Aug 3, 2023 -
LowALAS2-2023-2197 1 CVE
Low: elfutils security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-33294: In elfutils 0.183, an infinite loop was found in the function handle_symtab in readelf.c .Which allows attackers to cause a denial of service (infinite lo…
first Aug 3, 2023 -
Medium max 5.9ALAS2-2023-2196 1 CVE
Moderate: python-setuptools security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom Pa…
first Aug 3, 2023 -
High max 7.5ALAS2-2023-2194 2 CVEs
Important: cri-tools security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire reque…
first Aug 3, 2023 -
High max 7.5ALAS2-2023-2193 2 CVEs
Important: nerdctl security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire reque…
first Aug 3, 2023 -
High max 7.5ALAS2-2023-2192 1 CVE
Important: cni-plugins security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-41723: http2/hpack: avoid quadratic complexity in hpack decoding
first Aug 3, 2023 -
Medium max 5.3ALAS2-2023-2191 1 CVE
Moderate: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0330: There is a vulnerability in the lsi53c895a device which affects the latest version of qemu. The carefully designed PoC can repeatedly trigger DMA writes bu…
first Aug 3, 2023