4,948 results · Feed
-
High max 7.8ALAS2-2023-2068 1 CVE
Important: sysstat security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-33204: sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CV…
first Jun 5, 2023 -
High max 9.8ALAS2-2023-2083 6 CVEs
Important: python-pillow security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-34552: Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function t…
first Jun 5, 2023 -
MediumALAS2-2023-2082 2 CVEs
Moderate: pcre security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2015-8394: PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or…
first Jun 5, 2023 -
HighALAS2-2023-2081 1 CVE
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-12526: An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote s…
first Jun 5, 2023 -
High max 9.8ALAS2-2023-2080 1 CVE
Important: xmlrpc security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-17570: An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A …
first Jun 5, 2023 -
High max 7.7ALAS2023-2023-206 5 CVEs
Important: samba security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext CVE-2023-0614: Access controlled AD LDAP attributes can be discovered CVE-2023-0225: Samb…
first Jun 5, 2023 -
Medium max 7.8ALAS2023-2023-205 1 CVE
Moderate: libfastjson security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2020-12762: A flaw was found in json-c. In printbuf_memappend, certain crafted values can overflow the memory allowing an attacker to write past the memory boundar…
first Jun 5, 2023 -
High max 7.8ALAS2023-2023-204 2 CVEs
Important: byacc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-33642: When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function. CVE-2021-33641: When processing files, malloc stores t…
first Jun 5, 2023 -
Medium max 6.6ALAS2023-2023-203 1 CVE
Moderate: wayland security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-3782: An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained …
first Jun 5, 2023 -
LowALAS2023-2023-202 1 CVE
Low: gnuplot security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-44917: A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and application …
first Jun 5, 2023 -
High max 9.1ALAS2023-2023-201 1 CVE
Important: libtasn1 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-46848: GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
first Jun 5, 2023 -
Medium max 6.5ALAS2023-2023-200 1 CVE
Moderate: snakeyaml security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-38750: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an…
first Jun 5, 2023 -
High max 8.6ALAS2023-2023-198 5 CVEs
Important: c-ares security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-32067: Denial of Service. Attack Steps: The target resolver sends a query The attacker forges a malformed UDP packet with a length of 0 and returns them to th…
first Jun 5, 2023 -
Medium max 5.5ALAS2023-2023-196 1 CVE
Moderate: cloud-init security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1786: Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibl…
first Jun 5, 2023 -
LowALAS2023-2023-195 1 CVE
Low: libcap security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2602: libcap is vulnerable to a denial of service caused by the error handling in wrap_pthread_create() function, which will cause memory to be leaked in the …
first Jun 5, 2023 -
High max 7.8ALAS2023-2023-194 2 CVEs
Important: vim security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2610: Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. CVE-2023-2609: NULL Pointer Dereference in GitHub repository vim/vim prio…
first Jun 5, 2023 -
Medium max 9.8ALAS2023-2023-193 6 CVEs
Moderate: curl security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-27538: The curl advisory describes this issue as follows: libcurl would reuse a previously created connection even when an SSH related option had been changed…
first Jun 5, 2023 -
Medium max 7.5ALAS2023-2023-192 1 CVE
Moderate: dnsmasq security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28450: An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2…
first Jun 5, 2023 -
High max 7.8ALAS2023-2023-191 1 CVE
Important: sysstat security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-33204: sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for…
first Jun 5, 2023 -
MediumALAS2023-2023-188 1 CVE
Moderate: freetype security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2004: An integer overflow vulnerability was discovered in Freetype in tt_hvadvance_adjust() function in src/truetype/ttgxvar.c.
first May 25, 2023 -
Medium max 7.7ALAS2023-2023-187 1 CVE
Moderate: libldb security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-0614: Access controlled AD LDAP attributes can be discovered
first May 25, 2023 -
MediumALAS2023-2023-186 2 CVEs
Moderate: libssh security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-2283: A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in thepki_verify_data_signature function in…
first May 25, 2023 -
High max 5.3ALAS2023-2023-185 1 CVE
Important: libwebp security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1999: A double-free in libwebp could have led to memory corruption and a potentially exploitable crash.
first May 25, 2023 -
High max 7.5ALAS2023-2023-183 1 CVE
Important: python-flask security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-30861: Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client…
first May 25, 2023 -
High max 8.1ALAS2023-2023-182 1 CVE
Important: perl-CPAN security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-31484: HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in t…
first May 25, 2023 -
High max 8.8ALAS2-2022-1881 2 CVEs
Important: bluez security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-39177: A vulnerability was found in BlueZ. This flaw allows physically proximate attackers to cause a denial of service due to malformed and invalid capabilities…
first Dec 1, 2022 -
HighALAS2-2023-2066 1 CVE
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2016-10003: Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mist…
first May 25, 2023 -
HighALAS2-2023-2065 2 CVEs
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-18676: An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Deni…
first May 25, 2023 -
Medium max 7.5ALAS2-2023-2064 1 CVE
Moderate: tar security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-9923: pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
first May 25, 2023 -
HighALAS2-2023-2063 1 CVE
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14058: An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate valid…
first May 25, 2023 -
HighALAS2-2023-2062 1 CVE
Important: squid security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-8517: An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write t…
first May 25, 2023 -
Medium max 6.5ALAS2-2023-2061 6 CVEs
Moderate: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-4144: An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure poi…
first May 25, 2023 -
LowALAS2-2023-2060 1 CVE
Low: qemu security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-20257: An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if…
first May 25, 2023 -
Medium max 6.5ALAS2-2023-2059 1 CVE
Moderate: apache-commons-io security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-29425: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the resul…
first May 25, 2023 -
MediumALAS2-2023-2058 1 CVE
Moderate: glib2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3800: A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged o…
first May 25, 2023 -
MediumALAS2-2023-2057 10 CVEs
Moderate: mariadb security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-31624: MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c method log_statement_ex, the held lo…
first May 25, 2023 -
LowALAS2-2023-2055 1 CVE
Low: libtiff security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-2521: It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause…
first May 25, 2023 -
MediumALAS2-2023-2054 1 CVE
Moderate: fribidi security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-25309: A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.…
first May 25, 2023 -
High max 5.9ALAS2-2023-2053 1 CVE
Important: jettison security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1436: An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This …
first May 25, 2023 -
High max 7.3ALAS2-2023-2052 1 CVE
Important: golang security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-24539: html/template: improper sanitization of CSS values Angle brackets (<>) were not considered dangerous characters when inserted into CSS contexts. Templates…
first May 25, 2023