Malicious code in new-cod-mobile-h-ack-working-2023-march (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eef6e06bec3c2593911ecfae523f2324500500664b97da7bf34487325352a09c The package new-cod-mobile-h-ack-working-2023-march was found to contain malicious code...

MAL-2025-48940 Malicious code in new-cod-mobile-h-ack-working-2023-march (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eef6e06bec3c2593911ecfae523f2324500500664b97da7bf34487325352a09c The package new-cod-mobile-h-ack-working-2023-march was found to contain malicious code...

Malicious code in new-pubg-mobile-h-ack-working-2023-march (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4912df0c391b76679bbc455c05663219019fffc89baf9a7d45f14c5e9e8b0cde The package new-pubg-mobile-h-ack-working-2023-march was found to contain malicious code...

MAL-2025-48944 Malicious code in new-wwe-immortals-h-ack-working-2023-march (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61a1f01bcf57c61890970d89a1b64684f4470980a293dcb6aedbce8bf51e198d The package new-wwe-immortals-h-ack-working-2023-march was found to contain malicious code...

MAL-2025-48941 Malicious code in new-fifa-mobile-h-ack-working-2023-march (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30030a18d067ae234effc394f8cc8ca10823fbd78beed5b2fee67caf3549ff7a The package new-fifa-mobile-h-ack-working-2023-march was found to contain malicious code...

USN-7829-4: Linux kernel (AWS) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - GPU drivers; - Network drivers; - Netlink; CVE-2024-26700, CVE-2025-38727, CVE-2023-52593, CVE-2024-26896...

Important: kernel-livepatch-6.1.148-173.267

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bamdma: Fix DT error handling for num-channels/ees CVE-2025-39923 Affected Packages: kernel-livepatch-6.1.148-173.267 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Low: compat-libtiff3

Issue Overview: A vulnerability was identified in LibTIFF 4.7.0. This issue affects the function May of the file tiffcrop.c of the component tiffcrop. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: iavf: Fix reset error handling CVE-2022-50053 In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: clamp maximum map bucket size to INTMAX CVE-2025-38201 Affected Packages:...

Important: kernel-livepatch-4.14.355-280.698

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use rawsmpprocessorid instead of smpprocessorid CVE-2023-53530 Affected Packages: kernel-livepatch-4.14.355-280.698 Issue Correction: Please ensure you have live patching enabled. Run yum update...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: scsi: target: targetcoreconfigfs: Add length check to avoid buffer overflow CVE-2025-39998 In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ipvsftp unregister during netns cleanup...

Low: docker

Issue Overview: Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails...

Low: java-11-amazon-corretto

Issue Overview: Vulnerability in the Java SE product of Oracle Java SE component: Hotspot. Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE...

Important: sssd

Issue Overview: A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, SSSD does not enable the Kerberos local authentication plugin sssdkrb5localauthplugin, allowing an attacker with permission to modify...

Important: kernel-livepatch-6.12.37-61.105

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bamdma: Fix DT error handling for num-channels/ees CVE-2025-39923 Affected Packages: kernel-livepatch-6.12.37-61.105 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: squid

Issue Overview: Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. . This potentially allows a remote client to identify security tokens or credentials used internally by a web...

Medium: libxslt

Issue Overview: A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. CVE-2025-10911 Affected Packages: libxslt Issue Correction: Run dnf update libxslt --releasever 2023.9.20251027 or dnf update...

Important: kernel-livepatch-4.14.355-280.695

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use rawsmpprocessorid instead of smpprocessorid CVE-2023-53530 Affected Packages: kernel-livepatch-4.14.355-280.695 Issue Correction: Please ensure you have live patching enabled. Run yum update...

Important: qt5-qtsvg

Issue Overview: The module will parse a node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free. CVE-2025-10729 Affected Packages: qt5-qtsvg Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Important: gi-docgen

Issue Overview: gi-docgen does not encode search terms before inserting them into HTML, allowing XSS via a crafted URL. Description obtained from: https://gitlab.gnome.org/GNOME/gi-docgen/-/issues/228 CVE-2025-11687 Affected Packages: gi-docgen Issue Correction: Run dnf update gi-docgen...