Medium: containerd

Issue Overview: containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container...

Amazon Linux 2023 : docker (ALAS2023-2025-945)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-945 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which...

Medium: containerd

Issue Overview: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...

Medium: docker

Issue Overview: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-947)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-947 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: handle errors from btrfsdecref properly CVE-2024-46753 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2 : runc (ALASECS-2025-057)

The version of runc installed on the remote host is prior to 1.1.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-057 advisory. Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allow...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2025-058)

The version of containerd installed on the remote host is prior to 1.6.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-058 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2025-944)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-944 advisory. golang-jwt is a Go implementation of JSON Web Tokens. Prior to5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a...

Amazon Linux 2 : docker (ALASECS-2025-055)

The version of docker installed on the remote host is prior to 25.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-055 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by ...

Amazon Linux 2023 : python3.12-pip, python3.12-pip-wheel (ALAS2023-2025-957)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-957 advisory. Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the...

Amazon Linux 2 : docker (ALASECS-2025-063)

The version of docker installed on the remote host is prior to 19.03.6ce-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-063 advisory. A flaw was found in Docker when it creates network bridges that accept IPv6 router advertisements by default. This flaw allows...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2025-954)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-954 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java...

Amazon Linux 2023 : firefox (ALAS2023-2025-943)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-943 advisory. JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after- free. This vulnerability affects Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9,...

Amazon Linux AMI : golang (ALAS-2025-1971)

The version of golang installed on the remote host is prior to 1.23.7-1.50. It is, therefore, affected by a vulnerability as referenced in the ALAS-2025-1971 advisory. Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a...

Amazon Linux AMI : kernel (ALAS-2025-1970)

The version of kernel installed on the remote host is prior to 4.14.355-196.618. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2025-1970 advisory. In the Linux kernel, the following vulnerability has been resolved: block, bfq: don't move oombfqq CVE-2022-49179 I...

Amazon Linux 2 : kernel (ALAS-2025-2826)

The version of kernel installed on the remote host is prior to 4.14.355-276.618. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2826 advisory. In the Linux kernel, the following vulnerability has been resolved: block, bfq: don't move oombfqq CVE-2022-49179 ...

Amazon Linux 2 : libxslt (ALAS-2025-2823)

The version of libxslt installed on the remote host is prior to 1.1.28-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2823 advisory. xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2025-052)

The version of containerd installed on the remote host is prior to 1.7.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2025-052 advisory. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, includi...

Amazon Linux 2023 : freetype, freetype-demos, freetype-devel (ALAS2023-2025-925)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-925 advisory. An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed...

Amazon Linux 2 : thunderbird (ALAS-2025-2830)

The version of thunderbird installed on the remote host is prior to 128.8.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2830 advisory. There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99...