Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2025-042 (ALASFIREFOX-2025-042)

The version of firefox installed on the remote host is prior to 140.2.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2025-042 advisory. Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo:...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2025-089 (ALASKERNEL-5.15-2025-089)

The version of kernel installed on the remote host is prior to 5.15.191-132.213. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-089 advisory. In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: idle: Check...

Amazon Linux 2023 : libudisks2, libudisks2-devel, udisks2 (ALAS2023-2025-1178)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1178 advisory. A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent throug...

Important: microcode_ctl

Issue Overview: A potential security vulnerability in some Intelr Processors may allow information disclosure. Intel is releasing microcode updates and prescriptive guidance to mitigate this potential vulnerability. Info:...

Important: kernel-livepatch-6.12.31-35.92

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing CVE-2025-38386 Affected Packages: kernel-livepatch-6.12.31-35.92 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Amazon Linux 2023 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2023-2025-1179)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1179 advisory. The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an...

Important: kernel-livepatch-6.1.141-167.250

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing CVE-2025-38386 Affected Packages: kernel-livepatch-6.1.141-167.250 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.12.35-55.103

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing CVE-2025-38386 Affected Packages: kernel-livepatch-6.12.35-55.103 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2025-1183)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1183 advisory. A bug in Apache HTTP Server 2.4.64 results in all RewriteCond expr ... tests evaluating as true. Users are recommended to upgrade to version 2.4.65, which fixes the issue. CVE-2025-54090 Tenable has...

Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2025-1187)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1187 advisory. A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service DoS. CVE-2025-32049 Tenable has...

Amazon Linux 2023 : mod_auth_openidc (ALAS2023-2025-1188)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1188 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2025-1190)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1190 advisory. Improper buffer restrictions for some IntelR XeonR Processor firmware with SGX enabled may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2025-2005...

Important: kernel-livepatch-6.1.140-154.222

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing CVE-2025-38386 Affected Packages: kernel-livepatch-6.1.140-154.222 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.1.141-165.249

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing CVE-2025-38386 Affected Packages: kernel-livepatch-6.1.141-165.249 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Medium: rust-cargo-c

Issue Overview: tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2025-1175)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1175 advisory. SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service CVE-2025-9817 Tenable has extracted the preceding description block directly from the tested product security advisory. Note tha...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2025-883)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-883 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Important: kernel-livepatch-6.1.144-170.251

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration CVE-2025-38248 Affected Packages: kernel-livepatch-6.1.144-170.251 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1169)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1169 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: Avoid race in opencacheddir with lease breaks CVE-2025-37954 In the Linux kernel, the following vulnerability h...

Amazon Linux 2023 : mod_security, mod_security-mlogc (ALAS2023-2025-1157)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1157 advisory. ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response's Content-Type, whi...