🟡 Medium ⏱ 10–30 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2024-2700 Related CVEs: CVE-2024-28168 Upstream summary: Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read • Source: Amazon Linux advisory ALAS2023LIVEPATCH-2023-022 Related CVEs: CVE-2023-5090 CVE-2023-5717 CVE-2023-6111 Upstream summary: x86: KVM: SVM: always update the x2avic msr interception (CVE-2023-5090) A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read • Source: Amazon Linux advisory ALAS2023-2024-773 Related CVEs: CVE-2024-49768 CVE-2024-49769 Upstream summary: Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2022-1870 Related CVEs: CVE-2019-12749 CVE-2020-12049 CVE-2023-34969 CVE-2022-42010 CVE-2022-42011 CVE-2022-42012 Upstream summary: A flaw was found in dbus. The implementation of DBUS_COOKIE_SHA1 is susceptible to a symbolic link attack. A malicious […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read • Source: Amazon Linux advisory ALAS2023-2023-011 Related CVEs: CVE-2021-28544 CVE-2022-24070 Upstream summary: A flaw was found in Subversion. When using path-based authorization (authz), the helper function detect_changed() does not omit potentially sensitive information from log […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2023 📖 ~4 min read • Source: Amazon Linux advisory ALAS2023LIVEPATCH-2023-009 Related CVEs: CVE-2022-48425 CVE-2023-2124 CVE-2023-32233 CVE-2023-1077 CVE-2023-1611 CVE-2023-28466 Upstream summary: In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2LIVEPATCH-2023-138 Related CVEs: CVE-2023-2156 CVE-2023-3090 CVE-2023-35788 Upstream summary: A flaw was found in the Linux kernel's networking subsystem within the RPL protocol's handling. This issue results from the improper handling […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2023-2224 Related CVEs: CVE-2023-37920 CVE-2022-23491 CVE-2023-32803 CVE-2024-39689 Upstream summary: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS […]
🟠 High ⏱ 15–60 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2LIVEPATCH-2023-152 Related CVEs: CVE-2023-4207 CVE-2023-4622 CVE-2023-4623 CVE-2023-4921 Upstream summary: A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is […]
🟡 Medium ⏱ 10–30 min Last verified: 25 May 2026 Affected versions: Amazon Linux 2 📖 ~4 min read • Source: Amazon Linux advisory ALAS2-2025-2726 Related CVEs: CVE-2024-42353 Upstream summary: WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by […]
