Important: glib2

Issue Overview: A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the gescapeuristring function. If the string to escape contains a very large number of unacceptable characters which would need escaping, the calculation of the length of the...

Medium: curl

Issue Overview: wcurl path traversal with percent-encoded slashes URLs containing percent-encoded slashes / or \ can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. CVE-2025-11563 Affected Packages: curl Issue Correction: Run dnf...

Amazon Linux 2023 : firefox (ALAS2023-2025-1284)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1284 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2025-1269)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1269 advisory. A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-1281)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1281 advisory. Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the...

Amazon Linux 2023 : git-lfs (ALAS2023-2025-1258)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1258 advisory. Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Gi...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1282)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1282 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption CVE-2025-40019 Tenable has extracted the preceding description blo...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2025-1272)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1272 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...

Amazon Linux 2023 : nerdctl (ALAS2023-2025-1259)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1259 advisory. go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2023 : pam, pam-devel (ALAS2023-2025-1257)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1257 advisory. A flaw was found in linux-pam. The pamnamespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to...

Amazon Linux 2023 : xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel (ALAS2023-2025-1268)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1268 advisory. A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that...

Important: xmlunit

Issue Overview: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension functions are enabled. CVE-2024-31573 Affected Packages: xmlunit Issue Correction: Run dnf update xmlunit...

Low: lz4

Issue Overview: No CVE associated with this advisory Affected Packages: lz4 Issue Correction: Run dnf update lz4 --releasever 2023.9.20251110 or dnf update --advisory ALAS2023-2025-1266 --releasever 2023.9.20251110 to update your system. More information on how to update your system can be found ...

Important: kernel-livepatch-6.1.153-175.280

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcpsksk-fastopenrsk in tcpdisconnect. CVE-2025-39955 Affected Packages: kernel-livepatch-6.1.153-175.280 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.12.48-67.114

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcpsksk-fastopenrsk in tcpdisconnect. CVE-2025-39955 Affected Packages: kernel-livepatch-6.12.48-67.114 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Amazon Linux 2023 : libnvidia-cfg, libnvidia-fbc, libnvidia-gpucomp (ALAS2023NVIDIA-2025-251)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-251 advisory. NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, escalatio...

Amazon Linux 2023 : cuda-compat-13-0 (ALAS2023NVIDIA-2025-259)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-259 advisory. NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, escalatio...

Amazon Linux 2023 : nvidia, nvidia-fabric-manager (ALAS2023NVIDIA-2025-248)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-248 advisory. NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, escalatio...

Amazon Linux 2023 : nvidia-modprobe (ALAS2023NVIDIA-2025-244)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-244 advisory. NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, escalatio...

Amazon Linux 2023 : nvidia-kmod-common (ALAS2023NVIDIA-2025-246)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-246 advisory. NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, escalatio...