Amazon Linux 2023 : oci-add-hooks (ALAS2023-2026-3206)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3206 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2 : docker (ALASECS-2026-143)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-143 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the fin...

Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2026-3156)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3156 advisory. A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ...

Amazon Linux 2 : oci-add-hooks (ALASECS-2026-144)

The version of oci-add-hooks installed on the remote host is prior to 0-0.11.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-144 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside o...

Important: rpm

Issue Overview: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASNITRO-ENCLAVES-2026-121)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-121 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations...

Amazon Linux 2 : oci-add-hooks (ALASDOCKER-2026-147)

The version of oci-add-hooks installed on the remote host is prior to 0-0.11.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-147 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outsid...

Amazon Linux 2 : perl-HTTP-Date (ALAS-2026-3996)

The version of perl-HTTP-Date installed on the remote host is prior to 6.02-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3996 advisory. parsedate -- and str2time, which delegates to it -- used regexes withambiguous adjacent greedy runs year/clock/timezone digit...

Medium: oci-add-hooks

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Amazon Linux 2 : oci-add-hooks (ALASNITRO-ENCLAVES-2026-123)

The version of oci-add-hooks installed on the remote host is prior to 0-0.11.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-123 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to location...

Amazon Linux 2023 : soci-snapshotter (ALAS2023-2026-3153)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3153 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-3161)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3161 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...

Amazon Linux 2023 : perl-DBI, perl-DBI-tests (ALAS2023-2026-3191)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3191 advisory. A critical arbitrary code execution vulnerability CWE-94 found in the DBD::DBM database driver, which is a core component shipped within the Perl DBI Database Interface module. The flaw exists because...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-133)

The version of kernel installed on the remote host is prior to 5.10.269-270.1108. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-133 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged acce...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-117)

The version of kernel installed on the remote host is prior to 5.15.221-157.262. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-117 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged acces...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3197)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3197 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access inside a guest virtual machine to send specially crafted network packets that corrupt...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2026-3963)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.5226.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3963 advisory. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2026-131)

The version of kernel installed on the remote host is prior to 5.4.302-229.498. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2026-131 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access...

Amazon Linux 2 : kernel (ALAS-2026-3962)

The version of kernel installed on the remote host is prior to 4.14.355-287.753. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3962 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access inside a...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3146)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3146 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. CVE-2026-80521 Tenable has extracted the preceding description block directly from the tested...