Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-1959)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1959 advisory. PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description block directly from the tested product securi...

Amazon Linux 2023 : golang-github-burntsushi-toml, golang-github-burntsushi-toml-devel (ALAS2023-2026-1978)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1978 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2023 : acl, libacl, libacl-devel (ALAS2023-2026-1986)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1986 advisory. A flaw was found in the acl component, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname...

Amazon Linux 2023 : golist (ALAS2023-2026-1976)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1976 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-1961)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1961 advisory. PHP: Failure to setup TLS with a remote server can result in a remote DoS CVE-2026-12184 PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1968)

"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1968 advisory. In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: clear page-private in freepagesprepare CVE-2026-43303 In the Linux kernel, the following vulnerability has be...

Important: kernel-livepatch-6.12.92-122.166

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.12.92-122.166 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.1.176-220.358

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.1.176-220.358 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.18.20-41.237

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.18.20-41.237 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.1.175-219.357

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.1.175-219.357 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2026-1943)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1943 advisory. glamor Font Atlas Heap Buffer Overflow CVE-2026-55999 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for this...

Amazon Linux 2023 : glib2, glib2-devel, glib2-static (ALAS2023-2026-1942)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1942 advisory. A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1987)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1987 advisory. In the Linux kernel, the following vulnerability has been resolved: locking/rtmutex: Skip removewaiter when waiter is not enqueued CVE-2026-53163 Tenable has extracted the preceding description block...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1962)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1962 advisory. When using the tarfile module with a file opened in streaming mode mode=r| the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. CVE-2026-11972 Tenable has...

Amazon Linux 2023 : python3-pygments (ALAS2023-2026-1973)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1973 advisory. A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular...

Amazon Linux 2023 : composer (ALAS2023-2026-1941)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1941 advisory. Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory an...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1969)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1969 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udptunnelxmitskb CVE-2026-53070 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-1980)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1980 advisory. A use-after-free / double-free in c-ares' query-completion handling. Thesame flaw -- a query's callback being invoked while the query is stilllinked in the channel's internal lookup structures -- is...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1925)

"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1925 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: skip ipv6 extension headers for csum checks CVE-2026-45850 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2023 : aws-nitro-tpm-tools (ALAS2023-2026-1905)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1905 advisory. A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate...