Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-094 (ALASKERNEL-5.10-2025-094)

The version of kernel installed on the remote host is prior to 5.10.237-230.949. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-094 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Cleanup partial engine...

Amazon Linux AMI : amazon-ssm-agent (ALAS-2025-1982)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.2299.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS-2025-1982 advisory. SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which...

Medium: golang

Issue Overview: A directory traversal vulnerability was discovered in the Go programming language's os package in versions prior to 1.24.3. The vulnerability allows improper access to the parent directory of an os.Root by opening a filename ending in "../". When exploited, this vulnerability...

Medium: glibc

Issue Overview: In iconvdata/iso-2022-jp-3.c in the GNU C Library aka glibc 2.34, remote attackers can force iconv to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv use cases. NOTE: the...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2025-979)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-979 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which...

Amazon Linux 2023 : nerdctl (ALAS2023-2025-980)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-980 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which...

Amazon Linux 2023 : libtasn1, libtasn1-devel, libtasn1-tools (ALAS2023-2025-989)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-989 advisory. When an input DER data contains a large number of SEQUENCE OF or SET OF elements, decoding the data and searching a specific element in it take quadratic time to complete. This could be utilized for a...

Medium: nsight-systems-2025.1.3

Issue Overview: NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer could allow a user to cause the tool to crash or execute arbitrary code by passing in a malformed ELF file. A successful exploit of this...

Important: oci-add-hooks

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Amazon Linux 2023 : postgresql16, postgresql16-contrib, postgresql16-llvmjit (ALAS2023-2025-973)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-973 advisory. Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination...

Amazon Linux 2023 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2023-2025-988)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-988 advisory. In iconvdata/iso-2022-jp-3.c in the GNU C Library aka glibc 2.34, remote attackers can force iconv to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an...

Amazon Linux 2023 : perl-Mojolicious, perl-Test-Mojo (ALAS2023-2025-985)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-985 advisory. Mojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. These predictable default secrets can be...

Amazon Linux 2023 : mariadb105, mariadb105-backup, mariadb105-common (ALAS2023-2025-990)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-990 advisory. MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., and 11.0 through 11.0. can sometimes crash with an empty backtrace log. This may be related to makeaggrtablesinfo and...

Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2025-972)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-972 advisory. In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used. CVE-2025-43965 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2023 : postgresql17, postgresql17-contrib, postgresql17-llvmjit (ALAS2023-2025-975)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-975 advisory. Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination...

Amazon Linux 2023 : librsvg2, librsvg2-devel, librsvg2-tools (ALAS2023-2025-992)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-992 advisory. RUSTSEC-2024-0429 is a vulnerability discovered in the glib Rust crate affecting versions prior to 0.20.0. The issue involves unsoundness in Iterator and DoubleEndedIterator implementations for...

Medium: docker

Issue Overview: containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container...

Important: soci-snapshotter

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Amazon Linux 2023 : bpftool, kernel6.12, kernel6.12-modules-extra (ALAS2023-2025-984)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-984 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: do proper folio cleanup when cowfilerange failed CVE-2024-57976 In the Linux kernel, the following vulnerability has...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2025-977)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-977 advisory. A directory traversal vulnerability was discovered in the Go programming language's os package in versions prior to 1.24.3. The vulnerability allows improper access to the parent directory of an os.Root...