Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-1094)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1094 advisory. Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable...

Amazon Linux 2 : firefox (ALASFIREFOX-2025-041)

The version of firefox installed on the remote host is prior to 128.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2025-041 advisory. On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT,...

Amazon Linux 2023 : python3.12-pip, python3.12-pip-wheel (ALAS2023-2025-1096)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1096 advisory. urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disab...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2025-1092)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1092 advisory. The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::codedinputstream::CodedInputStream::skipgroup parsing of unknown fields in untrusted input. CVE-2025-53605 Tenabl...

Amazon Linux 2023 : mtr, mtr-gtk (ALAS2023-2025-1102)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1102 advisory. mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTRPACKET environment variable. CVE-2025-49809 Tenable has extracted the preceding description block...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2025-1101)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1101 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE:...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2025-2956)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.462.b08-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2956 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product ...

Important: unbound

Issue Overview: A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along wit...

Important: tomcat

Issue Overview: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from...

Amazon Linux 2023 : jq, jq-devel (ALAS2023-2025-1112)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1112 advisory. jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial ...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2025-1095)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1095 advisory. urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disab...

Amazon Linux 2 : kernel, --advisory ALAS2-2025-2955 (ALAS-2025-2955)

The version of kernel installed on the remote host is prior to 4.14.355-280.664. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2955 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tap: NULL pointer derefence in...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1130)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1130 advisory. In the Linux kernel, the following vulnerability has been resolved: virtio: break and reset virtio devices on deviceshutdown CVE-2025-38064 In the Linux kernel, the following vulnerability has...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null CVE-2022-50073 In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a server shutdown leak CVE-2023-53131 ...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2025-105)

The version of kernel installed on the remote host is prior to 5.4.296-217.423. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2025-105 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported versi...

Amazon Linux 2023 : libmicrohttpd, libmicrohttpd-devel (ALAS2023-2025-1133)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1133 advisory. GNU libmicrohttpd before 0.9.76 allows remote DoS Denial of Service due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHDcreatepostprocessor method. This allows an attack...

Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2025-1134)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1134 advisory. A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service DoS. CVE-2025-32049 Tenable has...

Amazon Linux 2023 : nvidia-kmod-common (ALAS2023NVIDIA-2025-134)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-134 advisory. NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outside bounds permitted under normal use cases. A...

Important: unbound

Issue Overview: A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along wit...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2025-1122)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1122 advisory. A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is also vulnerable when compiled with ECS...