Amazon Linux 2 : microcode_ctl, --advisory ALAS2-2026-3872 (ALAS-2026-3872)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3872 advisory. Improper handling of overlap between protected memory ranges for some IntelR XeonR 6 processors when using IntelR TDX...

Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2026-028 (ALASTOMCAT9-2026-028)

The version of tomcat installed on the remote host is prior to 9.0.121-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2026-028 advisory. Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat:...

Amazon Linux 2 : golang, --advisory ALAS2-2026-3893 (ALAS-2026-3893)

The version of golang installed on the remote host is prior to 1.26.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3893 advisory. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2026-129 (ALASKERNEL-5.4-2026-129)

The version of kernel installed on the remote host is prior to 5.4.302-226.486. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2026-129 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring...

Amazon Linux 2 : libvirt, --advisory ALAS2-2026-3873 (ALAS-2026-3873)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3873 advisory. libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection CVE-2026-61477...

Amazon Linux 2 : java-17-amazon-corretto, --advisory ALAS2-2026-3878 (ALAS-2026-3878)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.20+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3878 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produc...

Amazon Linux 2 : gstreamer-plugins-bad-free, --advisory ALAS2-2026-3896 (ALAS-2026-3896)

The version of gstreamer-plugins-bad-free installed on the remote host is prior to 0.10.23-42. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3896 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when...

Amazon Linux 2 : webkitgtk4, --advisory ALAS2-2026-3891 (ALAS-2026-3891)

The version of webkitgtk4 installed on the remote host is prior to 2.52.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3891 advisory. The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. Processi...

Amazon Linux 2 : gd, --advisory ALAS2-2026-3870 (ALAS-2026-3870)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3870 advisory. NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24DEBIANBUG: 1143152...

Amazon Linux 2 : dracut, --advisory ALAS2-2026-3875 (ALAS-2026-3875)

The version of dracut installed on the remote host is prior to 033-535. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3875 advisory. A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hoo...

Amazon Linux 2 : kernel, --advisory ALAS2-2026-3881 (ALAS-2026-3881)

The version of kernel installed on the remote host is prior to 4.14.355-284.742. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3881 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring...

Amazon Linux 2 : libXfont, --advisory ALAS2-2026-3890 (ALAS-2026-3890)

The version of libXfont installed on the remote host is prior to 1.5.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3890 advisory. A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3882 (ALAS-2026-3882)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3882 advisory. Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without resetting values left by setsalfirst, so a crafted spell file containing a...

Amazon Linux 2 : iperf3, --advisory ALAS2-2026-3869 (ALAS-2026-3869)

The version of iperf3 installed on the remote host is prior to 3.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3869 advisory. A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized...

Important: iperf3

Issue Overview: A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive...

Amazon Linux 2 : thunderbird, --advisory ALAS2-2026-3880 (ALAS-2026-3880)

The version of thunderbird installed on the remote host is prior to 140.14.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3880 advisory. Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the...

Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2026-064 (ALASFIREFOX-2026-064)

The version of firefox installed on the remote host is prior to 140.14.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-064 advisory. Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the...

Amazon Linux 2 : ipa, --advisory ALAS2-2026-3877 (ALAS-2026-3877)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3877 advisory. A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-113)

The version of kernel installed on the remote host is prior to 5.15.213-150.251. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-113 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero...

Amazon Linux 2 : docker, --advisory ALAS2DOCKER-2026-138 (ALASDOCKER-2026-138)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2026-138 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has extract...