Amazon Linux 2 : samba, --advisory ALAS2-2026-3886 (ALAS-2026-3886)

The version of samba installed on the remote host is prior to 4.10.16-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3886 advisory. A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory...

Amazon Linux 2 : microcode_ctl, --advisory ALAS2-2026-3872 (ALAS-2026-3872)

The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3872 advisory. Improper handling of overlap between protected memory ranges for some IntelR XeonR 6 processors when using IntelR TDX...

Amazon Linux 2 : mrtg, --advisory ALAS2-2026-3884 (ALAS-2026-3884)

The version of mrtg installed on the remote host is prior to 2.17.4-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3884 advisory. A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged...

Amazon Linux 2 : gstreamer-plugins-bad-free, --advisory ALAS2-2026-3896 (ALAS-2026-3896)

The version of gstreamer-plugins-bad-free installed on the remote host is prior to 0.10.23-42. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3896 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when...

Amazon Linux 2 : libvirt, --advisory ALAS2-2026-3873 (ALAS-2026-3873)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3873 advisory. libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection CVE-2026-61477...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2026-129 (ALASKERNEL-5.4-2026-129)

The version of kernel installed on the remote host is prior to 5.4.302-226.486. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2026-129 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring...

Amazon Linux 2 : java-17-amazon-corretto, --advisory ALAS2-2026-3878 (ALAS-2026-3878)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.20+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3878 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produc...

Amazon Linux 2 : iperf3, --advisory ALAS2-2026-3869 (ALAS-2026-3869)

The version of iperf3 installed on the remote host is prior to 3.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3869 advisory. A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized...

Amazon Linux 2 : gd, --advisory ALAS2-2026-3870 (ALAS-2026-3870)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3870 advisory. NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24DEBIANBUG: 1143152...

Amazon Linux 2 : webkitgtk4, --advisory ALAS2-2026-3891 (ALAS-2026-3891)

The version of webkitgtk4 installed on the remote host is prior to 2.52.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3891 advisory. The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. Processi...

Amazon Linux 2 : perl-DBI, --advisory ALAS2-2026-3871 (ALAS-2026-3871)

The version of perl-DBI installed on the remote host is prior to 1.627-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3871 advisory. DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3882 (ALAS-2026-3882)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3882 advisory. Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without resetting values left by setsalfirst, so a crafted spell file containing a...

Amazon Linux 2 : kernel, --advisory ALAS2-2026-3881 (ALAS-2026-3881)

The version of kernel installed on the remote host is prior to 4.14.355-284.742. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3881 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring...

Amazon Linux 2 : libXfont, --advisory ALAS2-2026-3890 (ALAS-2026-3890)

The version of libXfont installed on the remote host is prior to 1.5.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3890 advisory. A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font...

Amazon Linux 2 : libsoup, --advisory ALAS2-2026-3876 (ALAS-2026-3876)

The version of libsoup installed on the remote host is prior to 2.56.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3876 advisory. A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specifie...

Amazon Linux 2 : dracut, --advisory ALAS2-2026-3875 (ALAS-2026-3875)

The version of dracut installed on the remote host is prior to 033-535. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3875 advisory. A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hoo...

Important: libXfont

Issue Overview: A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fsreadglyphs function fails to properly validate the total size of the incoming data, leading to an overwrite of...

Amazon Linux 2 : postgresql, --advisory ALAS2-2026-3900 (ALAS-2026-3900)

The version of postgresql installed on the remote host is prior to 9.2.24-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3900 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to caus...

Amazon Linux 2 : freerdp (ALAS-2026-3887)

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3887 advisory. FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the...

Amazon Linux 2 : postgresql, --advisory ALAS2POSTGRESQL14-2026-025 (ALASPOSTGRESQL14-2026-025)

The version of postgresql installed on the remote host is prior to 14.24-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL14-2026-025 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database us...