Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2026-3260)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3260 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues, XkbClearDoodad iscalled during cleanup and frees the same pointer again...

Amazon Linux 2023 : brotli, brotli-devel, libbrotli (ALAS2023-2026-3334)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3334 advisory. A vulnerability in the Node.js Brotli decoder can result in an out-of-bounds memory write when processing crafted Brotli input. Successful exploitation may lead to memory corruption and remote code...

Amazon Linux 2023 : credentials-fetcher (ALAS2023-2026-3228)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3228 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2023 : firefox (ALAS2023-2026-3329)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3329 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL...

Amazon Linux 2023 : python3.13-tornado (ALAS2023-2026-3293)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3293 advisory. Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response...

Amazon Linux 2 : firefox (ALASFIREFOX-2026-068)

The version of firefox installed on the remote host is prior to 153.5.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2FIREFOX-2026-068 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to...

Amazon Linux 2 : edk2 (ALAS-2026-4007)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4007 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes disproportionate heap growth when OpenSSL cachesX.509 extensions. Impact summary: Receiving a crafted...

Amazon Linux 2 : kernel (ALAS-2026-4036)

The version of kernel installed on the remote host is prior to 4.14.355-287.755. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4036 advisory. In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC failure...

Medium: docker

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Amazon Linux 2 : docker (ALASDOCKER-2026-155)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2026-155 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, th...

Medium: ca-certificates

Issue Overview: Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if...

Amazon Linux 2 : ca-certificates (ALAS-2026-4037)

The version of ca-certificates installed on the remote host is prior to 2025.2.76-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4037 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed t...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2026-134)

The version of kernel installed on the remote host is prior to 5.4.302-229.500. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2026-134 advisory. In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-119)

The version of kernel installed on the remote host is prior to 5.15.222-158.255. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-119 advisory. In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in foucreate...

Amazon Linux 2 : firefox (ALASFIREFOX-2026-067)

The version of firefox installed on the remote host is prior to 153.5.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-067 advisory. Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Firefo...

Amazon Linux 2 : spice (ALAS-2026-4030)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4030 advisory. A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPI...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2026-133)

The version of kernel installed on the remote host is prior to 5.4.302-229.501. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2026-133 advisory. In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2026-026)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0512.b08-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2026-026 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of...

Amazon Linux 2 : qemu (ALAS-2026-4009)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4009 advisory. NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba v11.1.0-rc3NOTE: Fixed...

Medium: docker

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...