Amazon Linux 2 : docker (ALASDOCKER-2026-146)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-146 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-3162)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3162 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...

Amazon Linux 2023 : php8.5, php8.5-bcmath, php8.5-cli (ALAS2023-2026-3164)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3164 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3197)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3197 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access inside a guest virtual machine to send specially crafted network packets that corrupt...

Amazon Linux 2023 : openssl, openssl-devel, openssl-fips-provider-latest (ALAS2023-2026-3204)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3204 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes disproportionate heap growth when OpenSSL cachesX.509 extensions. Impact summary: Receiving a craft...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-117)

The version of kernel installed on the remote host is prior to 5.15.221-157.262. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-117 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged acces...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-133)

The version of kernel installed on the remote host is prior to 5.10.269-270.1108. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-133 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged acce...

Amazon Linux 2023 : perl-DBI, perl-DBI-tests (ALAS2023-2026-3191)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3191 advisory. A critical arbitrary code execution vulnerability CWE-94 found in the DBD::DBM database driver, which is a core component shipped within the Perl DBI Database Interface module. The flaw exists because...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-3161)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3161 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...

Important: rpm

Issue Overview: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious...

Amazon Linux 2023 : soci-snapshotter (ALAS2023-2026-3153)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3153 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASNITRO-ENCLAVES-2026-121)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-121 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2026-3963)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.5226.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3963 advisory. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a...

Amazon Linux 2 : kernel (ALAS-2026-3962)

The version of kernel installed on the remote host is prior to 4.14.355-287.753. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3962 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access inside a...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2026-131)

The version of kernel installed on the remote host is prior to 5.4.302-229.498. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2026-131 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3148)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3148 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. CVE-2026-80521 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3146)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3146 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. CVE-2026-80521 Tenable has extracted the preceding description block directly from the tested...

Important: bubblewrap

Issue Overview: A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts...

Amazon Linux 2 : crash (ALAS-2026-3937)

The version of crash installed on the remote host is prior to 8.0.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3937 advisory. A flaw was found in GDB's STABS debug format parser. Thereadmemberfunctions function in gdb/stabsread.c contains a linkedlist removal...

Amazon Linux 2023 : systemd, systemd-boot-unsigned, systemd-container (ALAS2023-2026-3117)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3117 advisory. systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user CVE-2026-16742 Tenable has extracted the preceding description bloc...