Amazon Linux 2023 : xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel (ALAS2023-2026-1944)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1944 advisory. glamor Font Atlas Heap Buffer Overflow CVE-2026-55999 GLX contextTags Use-After-Free in CommonMakeCurrent CVE-2026-56000 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2023 : golang-github-burntsushi-toml, golang-github-burntsushi-toml-devel (ALAS2023-2026-1978)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1978 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2023 : php8.5, php8.5-bcmath, php8.5-cli (ALAS2023-2026-1957)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1957 advisory. PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description block directly from the tested product securi...

Amazon Linux 2023 : libblkid, libblkid-devel, libfdisk (ALAS2023-2026-1916)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1916 advisory. Integer Overflow or Wraparound in libblkid/src/partitions/dos.c CVE-2026-53615 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus...

Amazon Linux 2023 : opensc (ALAS2023-2026-1898)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1898 advisory. A flaw has been found in OpenSC up to 0.26.1. This affects the function testkpgencertwrite of the file src/tools/pkcs11-tool.c of the component pkcs11-tool Key Generation Module. This manipulation caus...

Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-1917)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1917 advisory. A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gstav1parserparsetilelistobu function passes a byte count to a bit-reader API that expects a...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1929)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1929 advisory. tarfile.extractall with the 'data' or 'tar'filter could be bypassed by a crafted archive where a hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-1922)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1922 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules. This vulnerability exists when the proxyhttpversion to 2 or grpcpass directives...

Amazon Linux 2023 : lemon, sqlite, sqlite-analyzer (ALAS2023-2026-1903)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1903 advisory. SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1925)

"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1925 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: skip ipv6 extension headers for csum checks CVE-2026-45850 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2026-1899)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1899 advisory. If the certificate auto-enrollment GPO is enabled on domain membersboth in Samba's smb.conf and using Windows GPME tool, a CAcertificate may be fetched using a plain HTTP connection and installedin the...

Amazon Linux 2023 : nerdctl (ALAS2023-2026-1908)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1908 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, . to execute repeatedly on the same...

Amazon Linux 2023 : rclone (ALAS2023-2026-1923)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1923 advisory. The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size. CVE-2026-46601 The TIFF decoder does not set a limit on the size of tiles in tiled...

Amazon Linux 2023 : aws-nitro-tpm-tools (ALAS2023-2026-1905)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1905 advisory. A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate...

Amazon Linux 2023 : cifs-utils, cifs-utils-devel, cifs-utils-info (ALAS2023-2026-1927)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1927 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-1909)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1909 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, . to execute repeatedly on the same...

Amazon Linux 2023 : ansible (ALAS2023-2026-1932)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1932 advisory. A local privilege escalation vulnerability was found in the ansible.posix authorizedkey module. The module's keyfile function uses os.chown instead of os.lchown and opens files without ONOFOLLOW when...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1935)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1935 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: clsfw: fix NULL dereference of old filters before change CVE-2026-53080 Tenable has extracted the preceding description...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1933)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1933 advisory. The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result ...

Amazon Linux 2023 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2023-2026-1912)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1912 advisory. CMS Cryptographic Message Syntax parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is...