Amazon Linux 2023 : crit, criu, criu-devel (ALAS2023-2026-2126)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2126 advisory. A flaw was found in CRIU's handling of restartable sequences rseq during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite co...

Amazon Linux 2 : dracut, --advisory ALAS2-2026-3875 (ALAS-2026-3875)

The version of dracut installed on the remote host is prior to 033-535. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3875 advisory. A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hoo...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-2114)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2114 advisory. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, i...

Amazon Linux 2023 : gstreamer1-plugins-good, gstreamer1-plugins-good-gtk (ALAS2023-2026-2121)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2121 advisory. GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer...

Amazon Linux 2023 : postgresql17, postgresql17-contrib, postgresql17-llvmjit (ALAS2023-2026-2076)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2076 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...

Amazon Linux 2 : postgresql, --advisory ALAS2-2026-3900 (ALAS-2026-3900)

The version of postgresql installed on the remote host is prior to 9.2.24-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3900 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to caus...

Amazon Linux 2 : java-11-amazon-corretto, --advisory ALAS2-2026-3879 (ALAS-2026-3879)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.32+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3879 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produc...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2026-129 (ALASKERNEL-5.4-2026-129)

The version of kernel installed on the remote host is prior to 5.4.302-226.486. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2026-129 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring...

Amazon Linux 2023 : python3.13-pip, python3.13-pip-wheel (ALAS2023-2026-2089)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2089 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

Amazon Linux 2023 : firefox (ALAS2023-2026-2105)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2105 advisory. Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with...

Amazon Linux 2023 : java-26-amazon-corretto, java-26-amazon-corretto-devel, java-26-amazon-corretto-headless (ALAS2023-2026-2101)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2101 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Amazon Linux 2 : java-17-amazon-corretto, --advisory ALAS2-2026-3878 (ALAS-2026-3878)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.20+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3878 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produc...

Amazon Linux 2023 : clamav1.4, clamav1.4-data, clamav1.4-devel (ALAS2023-2026-2084)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2084 advisory. A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-2108)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2108 advisory. Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserveraccept, causing...

Amazon Linux 2 : libvirt, --advisory ALAS2-2026-3873 (ALAS-2026-3873)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3873 advisory. libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection CVE-2026-61477...

Amazon Linux 2 : kernel, --advisory ALAS2-2026-3881 (ALAS-2026-3881)

The version of kernel installed on the remote host is prior to 4.14.355-284.742. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3881 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3882 (ALAS-2026-3882)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3882 advisory. Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without resetting values left by setsalfirst, so a crafted spell file containing a...

Amazon Linux 2 : libXfont, --advisory ALAS2-2026-3890 (ALAS-2026-3890)

The version of libXfont installed on the remote host is prior to 1.5.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3890 advisory. A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font...

Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-2119)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2119 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2106 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftcounter: serialize reset with spinlock CVE-2026-45897 In the Linux kernel, the following vulnerability has bee...