Amazon Linux 2 : webkitgtk4 (ALAS-2026-3917)

The version of webkitgtk4 installed on the remote host is prior to 2.52.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3917 advisory. A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.1...

Amazon Linux 2 : gegl (ALAS-2026-3911)

The version of gegl installed on the remote host is prior to 0.2.0-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3911 advisory. GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute...

Amazon Linux 2023 : bluez, bluez-cups, bluez-deprecated (ALAS2023-2026-2146)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2146 advisory. A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response EIR...

Amazon Linux 2 : libevent (ALAS-2026-3902)

The version of libevent installed on the remote host is prior to 2.0.21-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3902 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuff...

Amazon Linux 2023 : ruby3.4, ruby3.4-bundled-gems, ruby3.4-default-gems (ALAS2023-2026-2145)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2145 advisory. An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new...

Amazon Linux 2023 : perl-YAML, perl-YAML-tests (ALAS2023-2026-2151)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2151 advisory. Backtracking leads to exponential load time in libyaml library. CVE-2026-63676 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus...

Amazon Linux 2023 : ruby4.0, ruby4.0-bundled-gems, ruby4.0-default-gems (ALAS2023-2026-2144)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2144 advisory. An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new...

Amazon Linux 2023 : gstreamer1-plugins-base, gstreamer1-plugins-base-devel, gstreamer1-plugins-base-tools (ALAS2023-2026-2158)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2158 advisory. GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer...

Amazon Linux 2023 : mount-s3 (ALAS2023-2026-2137)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2137 advisory. libgit2 Submodule path traversal CVE-2026-53584 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for this issue...

Amazon Linux 2023 : libvirt, libvirt-client, libvirt-client-qemu (ALAS2023-2026-2139)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2139 advisory. A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check,...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2026-2135)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2135 advisory. A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as ...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2026-2156)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2156 advisory. An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the processcommandopts function in tools/tiffcrop.c CVE-2026-52490 Tenable has extracted th...

Amazon Linux 2023 : python3-mistune (ALAS2023-2026-2148)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2148 advisory. Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens fro...

Amazon Linux 2023 : gstreamer1-plugins-good, gstreamer1-plugins-good-gtk (ALAS2023-2026-2140)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2140 advisory. GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer...

Amazon Linux 2023 : runc (ALAS2023-2026-2138)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2138 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, . to execute repeatedly on the same...

Low: perl-Socket

Issue Overview: Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, packipmreqsource checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses...

Important: libtiff

Issue Overview: An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the processcommandopts function in tools/tiffcrop.c CVE-2026-52490 Affected Packages: libtiff Issue Correction: Run dnf update libtiff --releasever 2023.12.20260914 or dnf...

Important: perl-YAML

Issue Overview: Backtracking leads to exponential load time in libyaml library. CVE-2026-63676 Affected Packages: perl-YAML Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue...

Amazon Linux 2 : nerdctl (ALAS-2026-3903)

The version of nerdctl installed on the remote host is prior to 2.3.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3903 advisory. A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go o...

Important: kernel-livepatch-6.1.172-216.339

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel-livepatch-6.1.172-216.339 Issue Correction: Please ensure you have live patching enabled. Run dnf update...