Amazon Linux 2 : python-pillow (ALAS-2025-2768)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2768 advisory. PIL/IcnsImagePlugin.py in Python Imaging Library PIL and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote...

Amazon Linux 2023 : harfbuzz, harfbuzz-devel, harfbuzz-icu (ALAS2023-2025-848)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-848 advisory. HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hbcairoglyphsfrombuffer function. CVE-2024-56732 Tenable has extracted the preceding...

Amazon Linux 2 : grub2 (ALAS-2025-2756)

The version of grub2 installed on the remote host is prior to 2.06-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2756 advisory. GNU GRUB aka GRUB2 through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2025-856)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-856 advisory. PS interpreter - check Indexed colour space index NOTE: https://bugs.ghostscript.com/showbug.cgi?id=707990NOTE: https://cgit.ghostscript.com/cgi-...

Amazon Linux 2023 : zziplib, zziplib-devel, zziplib-utils (ALAS2023-2025-859)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-859 advisory. Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the zzipparserootdirectory function at /zzip/zip.c. CVE-2024-39133 A Stack Buffer Overfl...

Amazon Linux 2023 : git-lfs (ALAS2023-2025-851)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-851 advisory. Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the git-credential1 command without checking...

Amazon Linux 2 : vim (ALAS-2025-2753)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2753 advisory. Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode -s -e, Vim typically doesn't show a screen and just operates silently in batch mod...

Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2025-860)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-860 advisory. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote...

Amazon Linux 2 : docker (ALASDOCKER-2025-051)

The version of docker installed on the remote host is prior to 25.0.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2025-051 advisory. golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead ...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-855)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-855 advisory. In the Linux kernel, the following vulnerability has been resolved: block: fix integer overflow in BLKSECDISCARD CVE-2024-49994 In the Linux kernel, the following vulnerability has been resolve...

Amazon Linux 2 : python-ipaddress (ALAS-2025-2761)

The version of python-ipaddress installed on the remote host is prior to 1.0.16-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2761 advisory. The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as...

Amazon Linux 2023 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2023-2025-847)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-847 advisory. GNU GRUB aka GRUB2 through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem. CVE-2024-56737 Tenable has extracted the preceding description block directly...

Amazon Linux 2 : emacs (ALAS-2025-2757)

The version of emacs installed on the remote host is prior to 27.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2757 advisory. In elisp-mode.el in GNU Emacs through 30.0.92, a user who chooses to invoke elisp-completion-at-point for code completion on untrusted...

Amazon Linux 2 : glib2 (ALAS-2025-2767)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2767 advisory. GLib's GVariant deserialization prior to GLib 2.74.4 failed to validate the input conforms to the expected format, leading ...

Amazon Linux 2 : kernel (ALAS-2025-2759)

The version of kernel installed on the remote host is prior to 4.14.355-275.591. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2759 advisory. In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of STR metho...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2025-094)

The version of kernel installed on the remote host is prior to 5.4.290-205.397. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-094 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2025-843)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-843 advisory. A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2025-063)

The version of kernel installed on the remote host is prior to 5.15.178-120.178. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-063 advisory. Integer Overflow or Wraparound vulnerability in Linux kernel on x86 and ARM md, raid, raid5 modules allo...

Amazon Linux 2023 : docker (ALAS2023-2025-852)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-852 advisory. golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they...

Amazon Linux 2023 : libglvnd, libglvnd-core-devel, libglvnd-devel (ALAS2023-2025-861)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-861 advisory. libglxproto.c in OpenGL libglvnd bb06db5a was discovered to contain a segmentation violation via the function glXGetDrawableScreen. NOTE: this is disputed because there are no common situations in which...