Amazon Linux 2023 : libcap, libcap-devel, libcap-static (ALAS2023-2025-897)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-897 advisory. The PAM module pamcap.so of libcap configuration supports group names starting with @, during actual parsing, configurations not starting with @ are incorrectly recognized as group names. This may resul...

Amazon Linux 2023 : libsndfile, libsndfile-devel, libsndfile-utils (ALAS2023-2025-902)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-902 advisory. libsndfile through 1.2.2 has an oggvorbis.c vorbisanalysiswrote out-of-bounds read. CVE-2024-50612 Tenable has extracted the preceding description block directly from the tested product security advisor...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2025-898)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-898 advisory. The Python standard library functions urllib.parse.urlsplit and urlparse accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2025-892)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-892 advisory. A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-899)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-899 advisory. The Python standard library functions urllib.parse.urlsplit and urlparse accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be...

Amazon Linux 2023 : python3-twisted, python3-twisted+tls (ALAS2023-2025-903)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-903 advisory. Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2025-095 (ALASKERNEL-5.4-2025-095)

The version of kernel installed on the remote host is prior to 5.4.282-194.378. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-095 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: use timestamp to...

Amazon Linux 2 : python-pillow (ALAS-2025-2803)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2803 advisory. Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-901)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-901 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nfctfindexpectation CVE-2023-52927 In the Linux kernel, the following vulnerability...

Amazon Linux 2 : python-pip (ALAS-2025-2799)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2799 advisory. The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as globally reachable or private. This affected the isprivate and isglobal properties of...

Amazon Linux 2 : libxml2 (ALAS-2025-2794)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2794 advisory. libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2025-064 (ALASKERNEL-5.15-2025-064)

The version of kernel installed on the remote host is prior to 5.15.166-111.163. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2025-064 advisory. In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix null pointer...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2025-086)

The version of kernel installed on the remote host is prior to 5.10.135-122.509. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-086 advisory. An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a...

Amazon Linux 2 : kernel (ALAS-2025-2790)

The version of kernel installed on the remote host is prior to 4.14.290-217.505. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2790 advisory. An out-of-bounds write flaw was found in the Linux kernel's framebuffer-based console driver functionality in the...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2025-900)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-900 advisory. The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potential...

Amazon Linux 2 : xorg-x11-server (ALAS-2025-2791)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2791 advisory. A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to free...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2025-871)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-871 advisory. A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands...

Amazon Linux 2 : kernel (ALAS-2025-2800)

The version of kernel installed on the remote host is prior to 4.14.355-275.603. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2800 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in smb2reconnectserver...

Medium: libsndfile

Issue Overview: libsndfile through 1.2.2 has an oggvorbis.c vorbisanalysiswrote out-of-bounds read. CVE-2024-50612 Affected Packages: libsndfile Issue Correction: Run dnf update libsndfile --releasever 2023.6.20250317 to update your system. New Packages: aarch64: ...

Medium: libsndfile

Issue Overview: libsndfile through 1.2.2 has an oggvorbis.c vorbisanalysiswrote out-of-bounds read. CVE-2024-50612 Affected Packages: libsndfile Issue Correction: Run dnf update libsndfile --releasever 2023.6.20250317 or dnf update --advisory ALAS2023-2025-902 --releasever 2023.6.20250317 to upda...