Medium: mod_security

Issue Overview: ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xm...

Medium: nodejs22

Issue Overview: There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. CVE-2025-6965 Affected Packages: nodejs2...

Amazon Linux 2023 : openexr, openexr-devel, openexr-libs (ALAS2023-2025-1142)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1142 advisory. An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service DoS via the convert function of exrmultipart.cpp. CVE-2024-31047 Tenable has...

Amazon Linux 2023 : lemon, sqlite, sqlite-analyzer (ALAS2023-2025-1151)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1151 advisory. There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommen...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-1135)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1135 advisory. There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error,...

Amazon Linux 2023 : cni-plugins (ALAS2023-2025-1143)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1143 advisory. Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which a...

Medium: cni-plugins

Issue Overview: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 Proxy-Authorization and Proxy-Authenticate headers...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2025-097)

The version of kernel installed on the remote host is prior to 5.10.238-234.956. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-097 advisory. In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: fix -anonvma race...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2025-1138)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1138 advisory. Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially craft...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2025-106 (ALASKERNEL-5.4-2025-106)

The version of kernel installed on the remote host is prior to 5.4.296-217.427. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-106 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tap: NULL pointer derefence in...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1144)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1144 advisory. In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race condition in AFXDP generic RX path CVE-2025-37920 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1145)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1145 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block group refcount race in btrfscreatependingblockgroups CVE-2025-22115 In the Linux kernel, the following...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-101 (ALASKERNEL-5.10-2025-101)

The version of kernel installed on the remote host is prior to 5.10.240-238.959. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-101 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tap: NULL pointer derefence in...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2025-087 (ALASKERNEL-5.15-2025-087)

The version of kernel installed on the remote host is prior to 5.15.189-131.206. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-087 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tap: NULL pointer derefence in...

Important: unbound

Issue Overview: A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along wit...

Low: kernel

Issue Overview: No CVE associated with this advisory Affected Packages: kernel Issue Correction: Run dnf update kernel --releasever 2023.8.20250808 or dnf update --advisory ALAS2023-2025-1128 --releasever 2023.8.20250808 to update your system. More information on how to update your system can be...

Important: jakarta-mail

Issue Overview: In Jakarta Mail 2.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. CVE-2025-7962 Affected Packages: jakarta-mail Issue Correction: Run dnf update jakarta-mail --releasever 2023.8.20250808 or dnf update...

Low: gnupg2

Issue Overview: In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."...

Important: golang

Issue Overview: cmd/go: unexpected command execution in untrusted VCS repositories CVE-2025-4674 Affected Packages: golang Issue Correction: Run dnf update golang --releasever 2023.8.20250808 or dnf update --advisory ALAS2023-2025-1104 --releasever 2023.8.20250808 to update your system. More...

Low: kernel6.12

Issue Overview: No CVE associated with this advisory Affected Packages: kernel6.12 Issue Correction: Run dnf update kernel6.12 --releasever 2023.8.20250808 or dnf update --advisory ALAS2023-2025-1129 --releasever 2023.8.20250808 to update your system. More information on how to update your system...