Low: curl

Issue Overview: This update enables libpsl support in curl, which adds protection against domain spanning "super cookies" as described in section 5.3 of RFC 6265. Affected Packages: curl Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Important: shim

Issue Overview: A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive...

Medium: libuv

Issue Overview: libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and its windows counterpart src/win/getaddrinfo.c, truncates hostnames to 256 characters before calling getaddrinfo. This behavior can be exploited to...

Important: unbound

Issue Overview: Certain DNSSEC aspects of the DNS protocol in RFC 4035 and related RFCs allow remote attackers to cause a denial of service CPU consumption via one or more DNSSEC responses when there is a zone with many DNSKEY and RRSIG records, aka the "KeyTrap" issue. The protocol specification...

openSUSE: Security Advisory for amazon (SUSE-SU-2023:3522-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for amazon (SUSE-SU-2023:3537-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon CloudWatch Agent < 1.247355 (GHSA-j8x2-2m5w-j939)

The version of Amazon CloudWatch Agent installed on the remote host is prior to 1.247355. It is, therefore, affected by a vulnerability as referenced in the GHSA-j8x2-2m5w-j939 advisory. - A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting...

Amazon Systems Manager (SSM) Agent Installed (Windows)

Binary data amazonssmagentwininstalled.nbin...

Amazon CloudWatch Agent Installed (Windows)

Binary data amazoncloudwatchagentwininstalled.nbin...

CVE-2024-27350

Amazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish local ADB Android Debug Bridge connections. NOTE: some third parties dispute whether this has security relevance, because an ADB connection is only possible after the non-default ADB Debugging option is...

Design/Logic Flaw

Amazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish local ADB Android Debug Bridge connections. NOTE: some third parties dispute whether this has security relevance, because an ADB connection is only possible after the non-default ADB Debugging option is...

AnythingLLM Code Issue Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM has a code issue vulnerability that stems from the presence of a server-side request forgery vulnerability. The vulnerability can be exploited to obtain AWS server data...

CVE-2024-27350

Amazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish local ADB Android Debug Bridge connections. NOTE: some third parties dispute whether this has security relevance, because an ADB connection is only possible after the non-default ADB Debugging option is...

CVE-2024-27350

Amazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish local ADB Android Debug Bridge connections. NOTE: some third parties dispute whether this has security relevance, because an ADB connection is only possible after the non-default ADB Debugging option is...

CVE-2024-27350

Summary: Amazon Fire OS versions 7.x and 8.x suffer a local ADB exposure that allows Fire TV apps to establish local ADB connections. This requires enabling the non-default ADB Debugging option and approving the connection prompt. Affected versions: Fire OS 7.0.0–7.6.6.8 (fixed in 7.6.6.9 or late...

PT-2024-21841 · Amazon · Amazon Fire Os

Name of the Vulnerable Software and Affected Versions: Amazon Fire OS versions 7.0.0 through 7.6.6.8 Amazon Fire OS versions 8.0.0 through 8.1.0.2 Description: The issue allows Fire TV applications to establish local ADB Android Debug Bridge connections. This is only possible after the non-defaul...

Amazon Linux AMI : sudo (ALAS-2024-1922)

The version of sudo installed on the remote host is prior to 1.8.23-10.59. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1922 advisory. 2024-06-07: CVE-2024-31969 was added to this advisory. In sudo-1.8.23-10.amzn2.3.6 Amazon Linux 2 and sudo-1.8.23-10.58.amzn1 Amaz...

Amazon Linux 2 : sudo (ALAS-2024-2473)

The version of sudo installed on the remote host is prior to 1.8.23-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2473 advisory. 2024-06-06: CVE-2024-31969 was added to this advisory. In sudo-1.8.23-10.amzn2.3.6 Amazon Linux 2 and sudo-1.8.23-10.58.amzn1 Amazon...

Important: sudo

Issue Overview: In sudo-1.8.23-10.amzn2.3.6 Amazon Linux 2 and sudo-1.8.23-10.58.amzn1 Amazon Linux 1, a user with an entry in the sudoers file, enabling them to run commands as another unprivileged user, can leverage it to run commands as root. No prior versions are affected. This issue has been...

Important: sudo

Issue Overview: In sudo-1.8.23-10.amzn2.3.6 Amazon Linux 2 and sudo-1.8.23-10.58.amzn1 Amazon Linux 1, a user with an entry in the sudoers file, enabling them to run commands as another unprivileged user, can leverage it to run commands as root. No prior versions are affected. This issue has been...