Amazon Linux 2 : java-1.8.0-openjdk, --advisory ALAS2-2026-3888 (ALAS-2026-3888)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.504.b01-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3888 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product ...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2026-2077)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2077 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...

Amazon Linux 2 : libsoup, --advisory ALAS2-2026-3876 (ALAS-2026-3876)

The version of libsoup installed on the remote host is prior to 2.56.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3876 advisory. A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specifie...

Amazon Linux 2023 : libudisks2, libudisks2-devel, udisks2 (ALAS2023-2026-2104)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2104 advisory. Local privilege escalation via as-user mount spoofing NOTE: https://github.com/azqzazq1/CVE-2026-7867-disk2root CVE-2026-7867 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2023 : iperf3, iperf3-devel (ALAS2023-2026-2070)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2070 advisory. A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized numeric parameters, such as parallel and len, which are not properly...

Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2026-2090)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2090 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

Amazon Linux 2 : gd, --advisory ALAS2-2026-3870 (ALAS-2026-3870)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3870 advisory. NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24DEBIANBUG: 1143152...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2026-2080)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2080 advisory. Improper handling of overlap between protected memory ranges for some IntelR XeonR 6 processors when using IntelR TDX within SMM may allow an escalation of privilege. SMM adversary with a...

Amazon Linux 2 : iperf3, --advisory ALAS2-2026-3869 (ALAS-2026-3869)

The version of iperf3 installed on the remote host is prior to 3.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3869 advisory. A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized...

Amazon Linux 2 : webkitgtk4, --advisory ALAS2-2026-3891 (ALAS-2026-3891)

The version of webkitgtk4 installed on the remote host is prior to 2.52.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3891 advisory. The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. Processi...

Amazon Linux 2 : perl-DBI, --advisory ALAS2-2026-3871 (ALAS-2026-3871)

The version of perl-DBI installed on the remote host is prior to 1.627-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3871 advisory. DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder...

Amazon Linux 2023 : jackson-databind (ALAS2023-2026-2081)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2081 advisory. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-114)

The version of kernel installed on the remote host is prior to 5.15.215-152.252. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-114 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust again...

Amazon Linux 2023 : postgresql18, postgresql18-contrib, postgresql18-llvmjit (ALAS2023-2026-2079)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2079 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2026-2099)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2099 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Amazon Linux 2 : apr-util, --advisory ALAS2-2026-3892 (ALAS-2026-3892)

The version of apr-util installed on the remote host is prior to 1.6.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3892 advisory. APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or password...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2107)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2107 advisory. In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable CVE-2026-64017 In the Linux kernel, the following vulnerability has been resolved...

Amazon Linux 2 : kbd, --advisory ALAS2-2026-3885 (ALAS-2026-3885)

The version of kbd installed on the remote host is prior to 1.15.5-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3885 advisory. openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the...

Amazon Linux 2023 : iscsi-initiator-utils, iscsi-initiator-utils-devel, iscsi-initiator-utils-iscsiuio (ALAS2023-2026-2120)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2120 advisory. open-iscsi: open-iscsi: Stack buffer overflow in idbm record parsing CVE-2026-18724 open-iscsi: open-iscsi: Out-of-bounds access in iscsiuio ICMPv6 echo handling CVE-2026-18725 A flaw was foun...

Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2026-2100)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2100 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...