Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2142)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2142 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to ma...

Amazon Linux 2023 : rsyslog, rsyslog-crypto, rsyslog-elasticsearch (ALAS2023-2026-2133)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2133 advisory. A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace function by sending specially crafted syslog messages. This vulnerability...

Amazon Linux 2023 : ruby3.4, ruby3.4-bundled-gems, ruby3.4-default-gems (ALAS2023-2026-2145)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2145 advisory. An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new...

Amazon Linux 2023 : nerdctl (ALAS2023-2026-2129)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2129 advisory. A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such...

Amazon Linux 2023 : mount-s3 (ALAS2023-2026-2137)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2137 advisory. libgit2 Submodule path traversal CVE-2026-53584 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for this issue...

Important: kernel-livepatch-6.1.172-216.339

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel-livepatch-6.1.172-216.339 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Amazon Linux 2023 : ruby4.0, ruby4.0-bundled-gems, ruby4.0-default-gems (ALAS2023-2026-2144)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2144 advisory. An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-2132)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2132 advisory. A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream- dependency tree via CURLOPTSTREAMDEPENDS or CURLOPTSTREAMDEPENDSE, subsequently invokes...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2026-2135)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2135 advisory. A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as ...

Amazon Linux 2023 : gstreamer1-plugins-good, gstreamer1-plugins-good-gtk (ALAS2023-2026-2140)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2140 advisory. GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer...

Important: libtiff

Issue Overview: An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the processcommandopts function in tools/tiffcrop.c CVE-2026-52490 Affected Packages: libtiff Issue Correction: Run dnf update libtiff --releasever 2023.12.20260914 or dnf...

Amazon Linux 2023 : libvirt, libvirt-client, libvirt-client-qemu (ALAS2023-2026-2139)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2139 advisory. A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check,...

Amazon Linux 2023 : libevent, libevent-devel (ALAS2023-2026-2128)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2128 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when decodetaginternal requests at most five...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2026-2157)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2157 advisory. libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handlers in cases of a policy violatio...

Amazon Linux 2023 : composer (ALAS2023-2026-2152)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2152 advisory. Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2143)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2143 advisory. In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: always decrease sk refcount CVE-2026-46158 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2023 : gstreamer1-plugins-base, gstreamer1-plugins-base-devel, gstreamer1-plugins-base-tools (ALAS2023-2026-2158)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2158 advisory. GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-2134)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2134 advisory. libheif: Integer underflow in Fraction constructor via double clap transform application CVE-2026-62289 libheif: Out-of-bounds read in uncompressed unci tile range slicing CVE-2026-62292 Tenab...

Amazon Linux 2023 : runc (ALAS2023-2026-2138)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2138 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, . to execute repeatedly on the same...

Important: kernel-livepatch-6.1.177-224.371

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel-livepatch-6.1.177-224.371 Issue Correction: Please ensure you have live patching enabled. Run dnf update...