Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1129)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1129 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2025-086)

The version of kernel installed on the remote host is prior to 5.15.189-131.202. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.15-2025-086 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported...

Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2025-1087)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1087 advisory. fsockopen doesn't regard hostname as well, hostname is terminated at the null byte. This can cause Server Side Request Forgery in general case. CVE-2025-1220 Missing error checking could resul...

Amazon Linux 2023 : libnvidia-cfg, libnvidia-ml, nvidia-driver-cuda (ALAS2023NVIDIA-2025-144)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-144 advisory. NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outside bounds permitted under normal use cases. A...

Amazon Linux 2023 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2023-2025-1107)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1107 advisory. In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify...

Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2025-1131)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1131 advisory. The attack vector is a potential Denial of Service DoS. The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.An attacker can craft a...

Medium: ruby

Issue Overview: The attack vector is a potential Denial of Service DoS. The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-1094)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1094 advisory. Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable...

Amazon Linux 2 : firefox (ALASFIREFOX-2025-041)

The version of firefox installed on the remote host is prior to 128.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2025-041 advisory. On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT,...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2025-1101)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1101 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE:...

Amazon Linux 2023 : cuda-nvdisasm-13 (ALAS2023NVIDIA-2025-145)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-145 advisory. NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successfu...

Amazon Linux 2023 : python3.12-pip, python3.12-pip-wheel (ALAS2023-2025-1096)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1096 advisory. urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disab...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2025-1092)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1092 advisory. The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::codedinputstream::CodedInputStream::skipgroup parsing of unknown fields in untrusted input. CVE-2025-53605 Tenabl...

Amazon Linux 2023 : libnvidia-nscq (ALAS2023NVIDIA-2025-137)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-137 advisory. NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outside bounds permitted under normal use cases. A...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2025-1104)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1104 advisory. cmd/go: unexpected command execution in untrusted VCS repositories CVE-2025-4674 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Ness...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1111)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1111 advisory. In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if setmemoryencrypted fails CVE-2024-36913 In the Linux kernel, the following vulnerability h...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-098 (ALASKERNEL-5.10-2025-098)

The version of kernel installed on the remote host is prior to 5.10.239-236.958. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-098 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix stuck flow...

Medium: pam

Issue Overview: A flaw was found in linux-pam. The module pamnamespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions. CVE-2025-6020 Affected Packages: pam Note: This advisor...

Important: unbound

Issue Overview: A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along wit...

Medium: thunderbird

Issue Overview: There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. CVE-2025-6965 Affected Packages:...