Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-2108)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2108 advisory. Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserveraccept, causing...

Medium: alsa-lib

Issue Overview: The Advanced Linux Sound Architecture ALSA library before 1.2.16.1 contains a double-free vulnerability in parsedef in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration...

Amazon Linux 2 : ipa, --advisory ALAS2-2026-3877 (ALAS-2026-3877)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3877 advisory. A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-113)

The version of kernel installed on the remote host is prior to 5.15.213-150.251. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-113 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero...

Amazon Linux 2 : docker, --advisory ALAS2DOCKER-2026-138 (ALASDOCKER-2026-138)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2026-138 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has extract...

Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2053)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2053 advisory. FreeRDP before 3.28.0 affected outlength, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client rand...

Amazon Linux 2023 : iscsi-initiator-utils, iscsi-initiator-utils-devel, iscsi-initiator-utils-iscsiuio (ALAS2023-2026-2066)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2066 advisory. An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open- iscsi allows remote MITM attackers to create root-owned files outside the database and...

Amazon Linux 2 : containerd, --advisory ALAS2NITRO-ENCLAVES-2026-117 (ALASNITRO-ENCLAVES-2026-117)

The version of containerd installed on the remote host is prior to 2.1.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-117 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable h...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-2060)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2060 advisory. brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attack...

Amazon Linux 2 : docker, --advisory ALAS2NITRO-ENCLAVES-2026-116 (ALASNITRO-ENCLAVES-2026-116)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-116 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has...

Amazon Linux 2023 : docker (ALAS2023-2026-2062)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2062 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has extracted the preceding description block directly from the tested product security...

Amazon Linux 2023 : spice-vdagent (ALAS2023-2026-2061)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2061 advisory. A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer...

Amazon Linux 2023 : python3-idna (ALAS2023-2026-2052)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2052 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2058)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2058 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count CVE-2026-53392 In the Linux kernel, the following vulnerability has be...

Amazon Linux 2 : spice-vdagent, --advisory ALAS2-2026-3863 (ALAS-2026-3863)

The version of spice-vdagent installed on the remote host is prior to 0.14.0-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3863 advisory. A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write...

slot2 Amazon Linux 2023 UEFI Bootkit

slot2 is a two-stage UEFI GRUB2 bootkit designed to establish a persistent pre-OS implant on Amazon Linux 2023 x8664 EC2 instances. It installs a custom GRUB EFI image and Unified Kernel Image, creates a UEFI NVRAM boot entry ahead of the stock Amazon entry, executes an implant with network and...

Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2026-2048)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2048 advisory. Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47303 Improper verification of cryptographic...

Amazon Linux 2023 : libssh2, libssh2-devel (ALAS2023-2026-2056)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2056 advisory. libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any...

Amazon Linux 2023 : isns-utils, isns-utils-devel, isns-utils-libs (ALAS2023-2026-2054)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2054 advisory. A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. CVE-2026-55995...

Amazon Linux 2023 : gnome-remote-desktop (ALAS2023-2026-2068)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2068 advisory. A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection...