Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-947)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-947 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: handle errors from btrfsdecref properly CVE-2024-46753 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2023 : firefox (ALAS2023-2025-943)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-943 advisory. JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after- free. This vulnerability affects Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9,...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2025-944)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-944 advisory. golang-jwt is a Go implementation of JSON Web Tokens. Prior to5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a...

Low: libcublas-12-8

Issue Overview: NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service. CVE-2024-53870...

Medium: ruby3.2

Issue Overview: In the URI gem before 1.0.3 for Ruby, the URI handling methods URI.join, URImerge, URI+ have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. CVE-2025-27221 Affected Packages: ruby3.2 Issue Correction: Run dnf update...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2025-936)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-936 advisory. Header parser of http stream wrapper does not handle folded headers. CVE-2025-1217 When requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used t...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-938)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-938 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifsdumpfullkey CVE-2024-35866 Tenable has extracted the preceding description block directly from t...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2025-932)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-932 advisory. A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory...

Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2025-928)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-928 advisory. In the URI gem before 1.0.3 for Ruby, the URI handling methods URI.join, URImerge, URI+ have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the hos...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2025-927)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-927 advisory. PDF interpreter - Guard against unsigned int overflow. A large Type 4 function definition can overflow the uint counter, causing the allocated buffer to be smaller than required. Info:...

Important: golang

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2025-933)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-933 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly...

Amazon Linux 2023 : nerdctl (ALAS2023-2025-931)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-931 advisory. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2025-930)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-930 advisory. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT...

Important: docker

Issue Overview: An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. CVE-2025-22868 SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or no...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2025-939)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-939 advisory. In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock,...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2025-914)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-914 advisory. SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to b...

Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2025-912)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-912 advisory. Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network. CVE-2025-24070 Tenable has extracted the preceding description block directly fr...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2025-917)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-917 advisory. During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2025-908)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-908 advisory. Potential integer and buffer overflow with DollarBlend during serializing a multiple master font for passing to Freetype. Fixed by changing a variable type from short to unsigned short and...