Important: krb5

Issue Overview: No CVE associated with this advisory Affected Packages: krb5 Issue Correction: Run dnf update krb5 --releasever 2023.12.20261012 or dnf update --advisory ALAS2023-2026-3182 --releasever 2023.12.20261012 to update your system. More information on how to update your system can be...

Important: rpcbind

Issue Overview: A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a large number of unique requests. The rpcbind service records previously unseen RPC Remote Procedure Call statistics in unbounded in-memory lists,...

Medium: oci-add-hooks

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Important: fetchmail

Issue Overview: A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM...

Amazon Linux 2023 : docker (ALAS2023-2026-3205)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3205 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-3163)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3163 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...

Amazon Linux 2023 : oci-add-hooks (ALAS2023-2026-3206)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3206 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-3162)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3162 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...

Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2026-3156)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3156 advisory. A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3197)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3197 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access inside a guest virtual machine to send specially crafted network packets that corrupt...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2026-131)

The version of kernel installed on the remote host is prior to 5.4.302-229.498. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2026-131 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access...

Amazon Linux 2 : kernel (ALAS-2026-3962)

The version of kernel installed on the remote host is prior to 4.14.355-287.753. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3962 advisory. An issue in the Linux kernel's virtio-net/TAP networking path could allow an actor with privileged access inside a...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2026-3963)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.5226.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3963 advisory. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3146)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3146 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. CVE-2026-80521 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3148)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3148 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. CVE-2026-80521 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2026-3144)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3144 advisory. The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer overflow guard inside the if masked block, leaving unmasked server-to-client frames unprotected. A malicious WebSocke...

Amazon Linux 2023 : python3-rpm, rpm, rpm-apidocs (ALAS2023-2026-3125)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3125 advisory. A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote...

Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-3114)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3114 advisory. Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. CVE-2026-58649 Integer overflow or wraparound in .NET allows an unauthorized attacker to...

Amazon Linux 2 : qemu (ALAS-2026-3934)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3934 advisory. NOTE: https://gitlab.com/qemu-project/qemu/-/workitems/4073NOTE: Fixed by: https://gitlab.com/qemu-...

Important: bubblewrap

Issue Overview: A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts...