Important: libXfont

Issue Overview: A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fsreadglyphs function fails to properly validate the total size of the incoming data, leading to an overwrite of...

Amazon Linux 2 : gd, --advisory ALAS2-2026-3870 (ALAS-2026-3870)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3870 advisory. NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24DEBIANBUG: 1143152...

Medium: gd

Issue Overview: NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24 DEBIANBUG: 1143152 CVE-2026-9672 Affected Packages: gd Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference betwe...

Amazon Linux 2 : libXfont, --advisory ALAS2-2026-3890 (ALAS-2026-3890)

The version of libXfont installed on the remote host is prior to 1.5.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3890 advisory. A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3882 (ALAS-2026-3882)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3882 advisory. Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without resetting values left by setsalfirst, so a crafted spell file containing a...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.15 Extra. Visit this page to learn more about...

Amazon Linux 2 : kernel, --advisory ALAS2-2026-3881 (ALAS-2026-3881)

The version of kernel installed on the remote host is prior to 4.14.355-284.742. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3881 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2026-129 (ALASKERNEL-5.4-2026-129)

The version of kernel installed on the remote host is prior to 5.4.302-226.486. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2026-129 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-114)

The version of kernel installed on the remote host is prior to 5.15.215-152.252. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-114 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust again...

Amazon Linux 2 : libsoup, --advisory ALAS2-2026-3876 (ALAS-2026-3876)

The version of libsoup installed on the remote host is prior to 2.56.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3876 advisory. A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specifie...

Amazon Linux 2 : java-17-amazon-corretto, --advisory ALAS2-2026-3878 (ALAS-2026-3878)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.20+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3878 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produc...

Amazon Linux 2 : java-1.8.0-openjdk, --advisory ALAS2-2026-3888 (ALAS-2026-3888)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.504.b01-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3888 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product ...

Amazon Linux 2 : java-11-amazon-corretto, --advisory ALAS2-2026-3879 (ALAS-2026-3879)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.32+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3879 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produc...

Important: gstreamer-plugins-good

Issue Overview: A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuou...

Important: containerd

Issue Overview: A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Affected Packages: containerd Note: This advisory is applicable to Amazon Linux 2 - Ecs Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ secti...

Important: iperf3

Issue Overview: A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive...

Amazon Linux 2 : gimp, --advisory ALAS2GIMP-2026-019 (ALASGIMP-2026-019)

The version of gimp installed on the remote host is prior to 2.8.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GIMP-2026-019 advisory. A flaw was found in GIMP. A signed integer overflow vulnerability exists in the file-fli plugin when processing FLI image...

Amazon Linux 2 : samba, --advisory ALAS2-2026-3886 (ALAS-2026-3886)

The version of samba installed on the remote host is prior to 4.10.16-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3886 advisory. A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory...

Medium: alsa-lib

Issue Overview: The Advanced Linux Sound Architecture ALSA library before 1.2.16.1 contains a double-free vulnerability in parsedef in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration...