Amazon Linux 2023 : lemon, sqlite, sqlite-analyzer (ALAS2023-2023-264)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-264 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Medium: python-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume ...

Amazon Linux 2023 : python3.11-setuptools, python3.11-setuptools-wheel (ALAS2023-2025-1003)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1003 advisory. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version...

Amazon Linux 2023 : ecs-init (ALAS2023-2025-1015)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1015 advisory. containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum...

Amazon Linux 2 : git (ALAS-2025-2884)

The version of git installed on the remote host is prior to 2.47.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2884 advisory. Git is a source code management tool. When cloning from a server or fetching, or pushing, informational or error messages are...

Medium: ghostscript

Issue Overview: gslibctxstashsanitizedarg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the case. A created PDF document includes its password in cleartext. CVE-2025-48708 Affected Packages: ghostscript Note: This advisory is applicable to Amazon Linux 2...

Medium: screen

Issue Overview: TTY Hijacking while Attaching to a Multiuser Session in the screen package Has potential to break some reattach use cases, but the specific use case was broken already before. screen in Debian not installed setuid or setgid DEBIANBUG: 1105191 Info:...

Important: python2-setuptools

Issue Overview: setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the...

Important: amazon-ssm-agent

Issue Overview: SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. CVE-2025-22869 Affected Packages:...

Amazon Linux 2 : screen (ALAS-2025-2878)

The version of screen installed on the remote host is prior to 4.1.0-0.27.20120314git3c2946. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2878 advisory. TTY Hijacking while Attaching to a Multiuser Session in the screen package Has potential to break some reattach...

Amazon Linux 2023 : ecs-init (ALAS2023-2025-1011)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1011 advisory. The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly bei...

Amazon Linux 2023 : screen (ALAS2023-2025-1006)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1006 advisory. TTY Hijacking while Attaching to a Multiuser Session in the screen package Has potential to break some reattach use cases, but the specific use case was broken already before.screen in Debian not...

Amazon Linux 2023 : git, git-all, git-core (ALAS2023-2025-1014)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1014 advisory. Git is a source code management tool. When cloning from a server or fetching, or pushing, informational or error messages are transported from the remote Git process to the client via the so-called...

Amazon Linux 2023 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2023-2025-1001)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1001 advisory. Untrusted LDLIBRARYPATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid...

Amazon Linux 2023 : python3-tornado (ALAS2023-2025-1002)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1002 advisory. Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form- data parser encounters certain errors, it logs a warning but continues trying to parse the remainde...

Amazon Linux 2023 : mariadb1011, mariadb1011-backup, mariadb1011-client-utils (ALAS2023-2025-1016)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1016 advisory. MariaDB Server 10.10 through 10.11. and 11.0 through 11.4. crashes in JOIN::fixallsplittingsinplan. CVE-2023-52971 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2 : python-setuptools (ALAS-2025-2876)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2876 advisory. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version...

Amazon Linux 2023 : bpftool, kernel6.12, kernel6.12-modules-extra (ALAS2023-2025-995)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-995 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: track changespktdata property for global functions CVE-2024-58098 In the Linux kernel, the following vulnerability has...

Important: perl-File-Find-Rule

Issue Overview: File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when grep encounters a crafted filename. A file handle is opened with the 2 argument form of open allowing an attacker controlled filename to provide the MODE parameter to open, turning the filename...

Important: perl-File-Find-Rule

Issue Overview: File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when grep encounters a crafted filename. A file handle is opened with the 2 argument form of open allowing an attacker controlled filename to provide the MODE parameter to open, turning the filename...