Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2025-1236)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1236 advisory. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory EOCD Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record...

Amazon Linux 2 : pcs, --advisory ALAS2-2025-3046 (ALAS-2025-3046)

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3046 advisory. Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser buffers...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2025-113 (ALASKERNEL-5.4-2025-113)

The version of kernel installed on the remote host is prior to 5.4.300-220.446. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-113 advisory. In the Linux kernel, the following vulnerability has been resolved: sched, cpuset: Fix dlcpubusy panic due...

Amazon Linux 2023 : p7zip, p7zip-plugins (ALAS2023-2025-1250)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1250 advisory. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack...

Amazon Linux 2023 : libxslt, libxslt-devel, python3-libxslt (ALAS2023-2025-1228)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1228 advisory. A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. CVE-2025-10911 Tenable has extracted the precedin...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2025-1239)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1239 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...

Amazon Linux 2 : golang, --advisory ALAS2-2025-3042 (ALAS-2025-3042)

The version of golang installed on the remote host is prior to 1.24.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3042 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2025-093 (ALASKERNEL-5.15-2025-093)

The version of kernel installed on the remote host is prior to 5.15.194-135.217. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-093 advisory. In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix memory leak in...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2025-1242)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1242 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1227)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1227 advisory. In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration CVE-2025-38248 In the Linux kernel, the following...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2025-1235)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1235 advisory. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory EOCD Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2025-1243)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1243 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Amazon Linux 2023 : squid (ALAS2023-2025-1238)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1238 advisory. Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. . This potentially allows a...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-107 (ALASKERNEL-5.10-2025-107)

The version of kernel installed on the remote host is prior to 5.10.244-240.970. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-107 advisory. In the Linux kernel, the following vulnerability has been resolved: iavf: Fix reset error handling...

Amazon Linux 2 : thunderbird, --advisory ALAS2-2025-3052 (ALAS-2025-3052)

The version of thunderbird installed on the remote host is prior to 140.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3052 advisory. There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpximgalloc with a large value of the...

Amazon Linux 2023 : xmlrpc-c, xmlrpc-c-apps, xmlrpc-c-c++ (ALAS2023-2025-1229)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1229 advisory. libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case of a large token for which multiple buffer fills are needed...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2025-1234)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1234 advisory. A flaw was found in Samba, in the vfsstreamsxattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-109 (ALASKERNEL-5.10-2025-109)

The version of kernel installed on the remote host is prior to 5.10.245-241.976. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-109 advisory. In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix memory leak in...

Amazon Linux 2 : perl-YAML-Syck, --advisory ALAS2-2025-3049 (ALAS-2025-3049)

The version of perl-YAML-Syck installed on the remote host is prior to 1.27-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3049 advisory. YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential informati...

Important: squid

Issue Overview: Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. . This potentially allows a remote client to identify security tokens or credentials used internally by a web...