Low: unbound

Issue Overview: No CVE associated with this advisory Affected Packages: unbound Issue Correction: Run dnf update unbound --releasever 2023.9.20251105 or dnf update --advisory ALAS2023-2025-1256 --releasever 2023.9.20251105 to update your system. More information on how to update your system can b...

Low: unbound

Issue Overview: No CVE associated with this advisory Affected Packages: unbound Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update unbound or yum update...

Low: runc

Issue Overview: No CVE associated with this advisory Affected Packages: runc Note: This advisory is applicable to Amazon Linux 2 - Docker Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue...

Amazon Linux 2 : unbound, --advisory ALAS2-2025-3055 (ALAS-2025-3055)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3055 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-109 (ALASKERNEL-5.10-2025-109)

The version of kernel installed on the remote host is prior to 5.10.245-241.976. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-109 advisory. In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix memory leak in...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2025-093 (ALASKERNEL-5.15-2025-093)

The version of kernel installed on the remote host is prior to 5.15.194-135.217. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-093 advisory. In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix memory leak in...

Amazon Linux 2023 : 7zip, 7zip-reduced, 7zip-standalone (ALAS2023-2025-1251)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1251 advisory. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2025-1237)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1237 advisory. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory EOCD Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1253)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1253 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: target: targetcoreconfigfs: Add length check to avoid buffer overflow CVE-2025-39998 In the Linux kernel, the followin...

Amazon Linux 2 : pcs, --advisory ALAS2-2025-3046 (ALAS-2025-3046)

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3046 advisory. Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser buffers...

Amazon Linux 2 : docker, --advisory ALAS2ECS-2025-076 (ALASECS-2025-076)

The version of docker installed on the remote host is prior to 25.0.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-076 advisory. Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container...

Amazon Linux 2 : thunderbird, --advisory ALAS2-2025-3052 (ALAS-2025-3052)

The version of thunderbird installed on the remote host is prior to 140.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3052 advisory. There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpximgalloc with a large value of the...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2025-1236)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1236 advisory. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory EOCD Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record...

Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2025-044 (ALASFIREFOX-2025-044)

The version of firefox installed on the remote host is prior to 140.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2025-044 advisory. Use-after-free in MediaTrackGraphImpl::GetInstance This vulnerability affects Firefox 144, Firefox ESR 140.4,...

Amazon Linux 2023 : squid (ALAS2023-2025-1238)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1238 advisory. Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. . This potentially allows a...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2025-1243)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1243 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Amazon Linux 2023 : xmlrpc-c, xmlrpc-c-apps, xmlrpc-c-c++ (ALAS2023-2025-1229)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1229 advisory. libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case of a large token for which multiple buffer fills are needed...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2025-1235)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1235 advisory. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory EOCD Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record...

Amazon Linux 2 : sssd, --advisory ALAS2-2025-3050 (ALAS-2025-3050)

The version of sssd installed on the remote host is prior to 1.16.5-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3050 advisory. A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default...

Amazon Linux 2023 : libxslt, libxslt-devel, python3-libxslt (ALAS2023-2025-1228)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1228 advisory. A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. CVE-2025-10911 Tenable has extracted the precedin...