Amazon Linux 2023 : p7zip, p7zip-plugins (ALAS2023-2025-1250)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1250 advisory. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack...

Amazon Linux 2 : glibc, --advisory ALAS2-2025-3040 (ALAS-2025-3040)

The version of glibc installed on the remote host is prior to 2.26-64. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3040 advisory. The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It...

Amazon Linux 2 : pcs, --advisory ALAS2-2025-3046 (ALAS-2025-3046)

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3046 advisory. Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser buffers...

Amazon Linux 2 : qemu, --advisory ALAS2-2025-3044 (ALAS-2025-3044)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3044 advisory. A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked...

Amazon Linux 2 : docker, --advisory ALAS2ECS-2025-076 (ALASECS-2025-076)

The version of docker installed on the remote host is prior to 25.0.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-076 advisory. Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container...

Amazon Linux 2023 : (ALAS2023-2025-1247)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1247 advisory. gi-docgen does not encode search terms before inserting them into HTML, allowing XSS via a crafted URL. Description obtained from: https://gitlab.gnome.org/GNOME/gi-docgen/-/issues/228 CVE-2025-11687...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1253)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1253 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: target: targetcoreconfigfs: Add length check to avoid buffer overflow CVE-2025-39998 In the Linux kernel, the followin...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2025-113 (ALASKERNEL-5.4-2025-113)

The version of kernel installed on the remote host is prior to 5.4.300-220.446. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-113 advisory. In the Linux kernel, the following vulnerability has been resolved: sched, cpuset: Fix dlcpubusy panic due...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2025-1252)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1252 advisory. Vulnerability in the Java SE product of Oracle Java SE component: Hotspot. Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated...

Amazon Linux 2 : squid, --advisory ALAS2-2025-3045 (ALAS-2025-3045)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3045 advisory. Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2025-093 (ALASKERNEL-5.15-2025-093)

The version of kernel installed on the remote host is prior to 5.15.194-135.217. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-093 advisory. In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix memory leak in...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1227)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1227 advisory. In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration CVE-2025-38248 In the Linux kernel, the following...

Amazon Linux 2 : java-17-amazon-corretto, --advisory ALAS2-2025-3047 (ALAS-2025-3047)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.17+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3047 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produc...

Amazon Linux 2023 : 7zip, 7zip-reduced, 7zip-standalone (ALAS2023-2025-1251)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1251 advisory. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack...

Amazon Linux 2023 : libxslt, libxslt-devel, python3-libxslt (ALAS2023-2025-1228)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1228 advisory. A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. CVE-2025-10911 Tenable has extracted the precedin...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2025-1242)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1242 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Amazon Linux 2 : sssd, --advisory ALAS2-2025-3050 (ALAS-2025-3050)

The version of sssd installed on the remote host is prior to 1.16.5-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3050 advisory. A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default...

Amazon Linux 2 : kernel, --advisory ALAS2-2025-3053 (ALAS-2025-3053)

The version of kernel installed on the remote host is prior to 4.14.355-280.706. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3053 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix use-after-free bug in...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2025-1237)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1237 advisory. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory EOCD Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-109 (ALASKERNEL-5.10-2025-109)

The version of kernel installed on the remote host is prior to 5.10.245-241.976. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-109 advisory. In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix memory leak in...