Amazon Linux 2 : python-ldap, --advisory ALAS2-2025-3058 (ALAS-2025-3058)

The version of python-ldap installed on the remote host is prior to 2.4.15-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3058 advisory. python-ldap is a lightweight directory access protocol LDAP client API for Python. In versions prior to 3.4.5,...

Amazon Linux 2 : xorg-x11-server, --advisory ALAS2-2025-3066 (ALAS-2025-3066)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3066 advisory. A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead...

Amazon Linux 2 : runfinch-finch, --advisory ALAS2DOCKER-2025-081 (ALASDOCKER-2025-081)

The version of runfinch-finch installed on the remote host is prior to 1.10.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-081 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than...

Amazon Linux 2 : curl, --advisory ALAS2-2025-3056 (ALAS-2025-3056)

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3056 advisory. Out of bounds read for cookie path NOTE: https://curl.se/docs/CVE-2025-9086.htmlNOTE: Introduced with:...

Amazon Linux 2023 : fontforge, fontforge-devel (ALAS2023-2025-1262)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1262 advisory. FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8. CVE-2025-50949 Tenable has extracted the preceding description block directly from the tested product security...

Amazon Linux 2 : docker, --advisory ALAS2DOCKER-2025-084 (ALASDOCKER-2025-084)

The version of docker installed on the remote host is prior to 25.0.13-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-084 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6...

Amazon Linux 2 : tigervnc, --advisory ALAS2-2025-3065 (ALAS-2025-3065)

The version of tigervnc installed on the remote host is prior to 1.8.0-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3065 advisory. A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error...

Amazon Linux 2 : pam, --advisory ALAS2-2025-3057 (ALAS-2025-3057)

The version of pam installed on the remote host is prior to 1.1.8-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3057 advisory. A flaw was found in linux-pam. The pamnamespace module may improperly handle user-controlled paths, allowing local users to exploit...

Amazon Linux 2 : containerd, --advisory ALAS2NITRO-ENCLAVES-2025-074 (ALASNITRO-ENCLAVES-2025-074)

The version of containerd installed on the remote host is prior to 2.1.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-074 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other tha...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2025-1264)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1264 advisory. NULL Pointer Dereference vulnerability in the session ID calculation logic of the libssh library. The flaw arises from improper handling of allocation errors during cryptographic operations in...

Amazon Linux 2 : oci-add-hooks, --advisory ALAS2NITRO-ENCLAVES-2025-075 (ALASNITRO-ENCLAVES-2025-075)

The version of oci-add-hooks installed on the remote host is prior to 0-0.5.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-075 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2025-1272)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1272 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...

Amazon Linux 2 : lasso, --advisory ALAS2-2025-3077 (ALAS-2025-3077)

The version of lasso installed on the remote host is prior to 2.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3077 advisory. A denial of service vulnerability exists in the lassoproviderverifysamlsignature functionality of Entr'ouvert Lasso 2.5.1. A...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2025-1261)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1261 advisory. Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 allows denial of service via packet injection or crafted capture file CVE-2025-5601 Tenable has extracted the preceding descripti...

Amazon Linux 2 : webkitgtk4, --advisory ALAS2-2025-3073 (ALAS-2025-3073)

The version of webkitgtk4 installed on the remote host is prior to 2.48.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3073 advisory. The issue was addressed with improved memory handling. This issue is fixed in Safari 26, visionOS 26, watchOS 26, macO...

Amazon Linux 2 : kernel, --advisory ALAS2-2025-3075 (ALAS-2025-3075)

The version of kernel installed on the remote host is prior to 4.14.355-280.708. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3075 advisory. In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix invalid derefence of sblvbptr...

Amazon Linux 2 : runc, --advisory ALAS2NITRO-ENCLAVES-2025-077 (ALASNITRO-ENCLAVES-2025-077)

The version of runc installed on the remote host is prior to 1.3.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-077 advisory. Placeholder CVE. Details forthcoming CVE-2025-31133 net/url: insufficient validation of bracketed IPv6 hostnames...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2025-1271)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1271 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-1281)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1281 advisory. Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the...

Amazon Linux 2023 : nerdctl (ALAS2023-2025-1259)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1259 advisory. go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065 Tenable has extracted the preceding description block directly from the tested product...