Amazon Linux 2023 : pam, pam-devel (ALAS2023-2025-1121)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1121 advisory. A flaw was found in linux-pam. The module pamnamespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2025-1088)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1088 advisory. fsockopen doesn't regard hostname as well, hostname is terminated at the null byte. This can cause Server Side Request Forgery in general case. CVE-2025-1220 Missing error checking could resul...

Amazon Linux 2023 : jackson-core (ALAS2023-2025-1127)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1127 advisory. jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deepl...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2025-1118)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1118 advisory. A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdfferror of the file...

Amazon Linux 2023 : python3-requests, python3-requests+security, python3-requests+socks (ALAS2023-2025-1110)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1110 advisory. Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2025-100)

The version of kernel installed on the remote host is prior to 5.10.240-238.955. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.10-2025-100 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2025-1105)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1105 advisory. If a named caching resolver is configured with serve-stale-enable yes, and with stale-answer- client-timeout set to 0 the only allowable value other than disabled, and if the resolver, in the process o...

Important: tomcat

Issue Overview: For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106...

Amazon Linux 2 : jq (ALAS-2025-2943)

The version of jq installed on the remote host is prior to 1.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2943 advisory. jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index...

Amazon Linux 2 : pixman (ALAS-2025-2945)

The version of pixman installed on the remote host is prior to 0.34.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2945 advisory. In libpixman in Pixman before 0.42.2, there is an out-of-bounds write aka heap-based buffer overflow in rasterizeedges8 due to an...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2025-2940)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.28+6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2940 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product...

Amazon Linux 2 : python-pip (ALAS-2025-2935)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2935 advisory. urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable...

Amazon Linux 2 : golang (ALAS-2025-2939)

The version of golang installed on the remote host is prior to 1.23.11-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2939 advisory. cmd/go: unexpected command execution in untrusted VCS repositories CVE-2025-4674 Tenable has extracted the preceding description...

Amazon Linux 2 : mtr (ALAS-2025-2937)

The version of mtr installed on the remote host is prior to 0.92-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2937 advisory. mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTRPACKET environment variable...

Medium: ruby

Issue Overview: Ruby WEBrick readheader HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific...

Important: kernel-livepatch-5.10.236-228.935

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vxlan: Annotate FDB data races CVE-2025-38037 Affected Packages: kernel-livepatch-5.10.236-228.935 Issue Correction: Please ensure you have live patching enabled. Run yum update kernel-livepatch-5.10.236-228.935 o...

Medium: python-pip

Issue Overview: urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An...

Medium: perl-Crypt-OpenSSL-RSA

Issue Overview: A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial...

Medium: jackson

Issue Overview: jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2025-084 (ALASKERNEL-5.15-2025-084)

The version of kernel installed on the remote host is prior to 5.15.187-130.192. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-084 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: don't drop extentmap for free...