4,948 results · Feed
-
High max 7.5ALAS2023-2023-240 2 CVEs
Important: bind security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2911: If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a…
first Jul 5, 2023 -
Medium max 6.1ALAS2023-2023-239 1 CVE
Moderate: python-tornado security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28370: Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site …
first Jul 5, 2023 -
High max 7.5ALAS2023-2023-238 1 CVE
Important: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28709: The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-def…
first Jul 5, 2023 -
High max 7.5ALAS2023-2023-237 4 CVEs
Important: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-30590: The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a priv…
first Jul 5, 2023 -
Medium max 6.1ALAS2023-2023-236 1 CVE
Moderate: python-requests security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-32681: A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy-Authorization headers to destination servers, spec…
first Jul 5, 2023 -
Medium max 5.3ALAS2023-2023-235 1 CVE
Moderate: cups security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-34241: A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection has been closed, wh…
first Jul 5, 2023 -
Medium max 5.9ALAS2023-2023-263 1 CVE
Moderate: yajl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-24795: yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which…
first Jul 17, 2023 -
Low max 3.5ALAS2023-2023-262 1 CVE
Low: bluez security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-3563: A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgm…
first Jul 17, 2023 -
Medium max 7.5ALAS2023-2023-261 1 CVE
Moderate: python-wheel security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker con…
first Jul 17, 2023 -
High max 7.5ALAS2023-2023-260 1 CVE
Important: docker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-41723: http2/hpack: avoid quadratic complexity in hpack decoding
first Jul 17, 2023 -
Low max 3.9
Low: open-vm-tools security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-20867: A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of t…
first Jul 17, 2023 -
Medium max 7.5ALAS2023-2023-258 8 CVEs
Moderate: java-17-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-25193: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back f…
first Jul 17, 2023 -
Medium max 7.5ALAS2023-2023-257 7 CVEs
Moderate: java-11-amazon-corretto security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-25193: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back f…
first Jul 17, 2023 -
Low max 3.7ALAS2023-2023-254 1 CVE
Low: python-configobj security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-26112: All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **…
first Jul 17, 2023 -
MediumALAS2023-2023-253 1 CVE
Moderate: libtiff security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-26966: libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big…
first Jul 17, 2023 -
MediumALAS2023-2023-250 1 CVE
Moderate: libX11 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3138: A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for…
first Jul 17, 2023 -
Medium max 6.2ALAS2023-2023-249 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3428: The upstream bug report describes this issue as follows: "A vulnerability was found in ImageMagick <=7.1.1, where heap-based buffer overflow was found i…
first Jul 17, 2023 -
HighALAS2023-2023-248 1 CVE
Important: jackson-core security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-35116: An issue was discovered jackson-databind thru 2.15.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that…
first Jul 17, 2023 -
Low max 7.3ALAS2023-2023-247 1 CVE
Low: perl-HTTP-Daemon security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-31081: HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited …
first Jul 5, 2023 -
Medium max 7.5ALAS2-2023-2137 7 CVEs
Moderate: java-11-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-25193: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for …
first Jul 17, 2023 -
Medium max 7.5ALAS2-2023-2138 8 CVEs
Moderate: java-17-amazon-corretto security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-25193: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for …
first Jul 17, 2023 -
High max 7.5ALAS2-2023-2118 1 CVE
Important: python-pillow security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-23437: The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
first Jul 5, 2023 -
Medium max 7.5ALAS2-2023-2117 1 CVE
Moderate: python3-pygments security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have…
first Jul 5, 2023 -
MediumALAS2-2023-2116 2 CVEs
Moderate: fribidi security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-25310: A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This fla…
first Jul 5, 2023 -
MediumALAS2-2023-2115 1 CVE
Moderate: pidgin security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-26491: An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The…
first Jul 5, 2023 -
HighALAS2-2023-2114 1 CVE
Important: open-vm-tools security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-31676: VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to th…
first Jul 5, 2023 -
Low max 6.5ALAS2-2023-2113 1 CVE
Low: wireshark security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0667: Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is su…
first Jul 5, 2023 -
High max 7.5ALAS2-2023-2112 1 CVE
Important: bind security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-2828: A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for …
first Jul 5, 2023 -
Medium max 6.1ALAS2-2023-2111 1 CVE
Moderate: python3-requests security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32681: A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifi…
first Jul 5, 2023 -
Medium max 6.1ALAS2-2023-2110 1 CVE
Moderate: python-requests security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32681: A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifi…
first Jul 5, 2023 -
Medium max 5.3ALAS2-2023-2109 1 CVE
Moderate: cups security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-34241: A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection has been closed, when …
first Jul 5, 2023 -
High max 7.5ALAS2-2023-2127 1 CVE
Important: c-ares security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-32067: Denial of Service. Attack Steps: The target resolver sends a query The attacker forges a malformed UDP packet with a length of 0 and returns them to the t…
first Jul 17, 2023 -
Medium max 5.9ALAS2-2023-2126 1 CVE
Moderate: libtiff security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3316: A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/nu…
first Jul 17, 2023 -
Medium max 5.9ALAS2-2023-2125 1 CVE
Moderate: compat-libtiff3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3316: A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/nu…
first Jul 17, 2023 -
Medium max 5.5ALAS2-2023-2124 1 CVE
Moderate: iniparser security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-33461: iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_getstring's retur…
first Jul 17, 2023 -
Medium max 6.2ALAS2-2023-2123 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-3428: The upstream bug report describes this issue as follows: "A vulnerability was found in ImageMagick <=7.1.1, where heap-based buffer overflow was found in c…
first Jul 17, 2023 -
High max 7.6ALAS2-2023-2122 1 CVE
Important: gstreamer-plugins-good security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-37327: Integer overflow leading to heap overwrite in FLAC image tag handling
first Jul 17, 2023 -
High max 7.6ALAS2-2023-2121 1 CVE
Important: gstreamer-plugins-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-37327: Integer overflow leading to heap overwrite in FLAC image tag handling
first Jul 17, 2023 -
High max 8.8ALAS2-2023-2120 1 CVE
Important: gstreamer1-plugins-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-37328: Heap overwrite in subtitle parsing
first Jul 17, 2023 -
Medium max 9.1ALAS2-2023-2119 1 CVE
Moderate: tcpdump security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-15167: The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 3, a different vulnerability than CVE-2018-14…
first Jul 5, 2023