🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2025-2945 Related CVEs: CVE-2022-44638 Upstream summary: In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y. […]
🟡 Medium ⏱ 10–30 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2024-2649 Related CVEs: CVE-2012-0881 CVE-2022-23437 Upstream summary: Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2023-2029 Related CVEs: CVE-2022-44370 CVE-2020-18780 CVE-2020-21528 CVE-2022-46457 Upstream summary: NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856 (CVE-2022-44370) Table of contents Symptom & […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2020-1434 Related CVEs: CVE-2019-18397 CVE-2022-25308 CVE-2022-25310 CVE-2022-25309 Upstream summary: A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial […]
🔴 Critical ⏱ 15–90 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2021-1722 Related CVEs: CVE-2021-43527 CVE-2019-11729 CVE-2019-11745 CVE-2019-11719 CVE-2019-11727 CVE-2019-11756 CVE-2019-17006 CVE-2019-17023 +5 more Upstream summary: NSS (Network Security Services) up to and including 3.73 is vulnerable to a heap overflow […]
🟡 Medium ⏱ 10–30 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2023-2045 Related CVEs: CVE-2021-33813 Upstream summary: An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. (CVE-2021-33813) Table […]
🟡 Medium ⏱ 10–30 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2022-1844 Related CVEs: CVE-2022-31799 Upstream summary: Bottle before 0.12.20 mishandles errors during early request binding. (CVE-2022-31799) Table of contents Symptom & Impact Environment & Reproduction Root Cause Analysis Quick Triage […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2022-1858 Related CVEs: CVE-2022-1705 CVE-2022-1962 CVE-2022-1996 CVE-2022-24675 CVE-2022-27191 CVE-2022-27664 CVE-2022-28131 CVE-2022-28327 +8 more Upstream summary: 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2024-2409 Related CVEs: CVE-2021-25786 CVE-2021-36978 CVE-2022-34503 Upstream summary: An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter […]
🟡 Medium ⏱ 10–30 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2023-2010 Related CVEs: CVE-2021-42771 Upstream summary: Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution. […]
