Amazon Linux 2 : vim, --advisory ALAS2-2026-3804 (ALAS-2026-3804)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3804 advisory. Vim is an open source, command line text editor. Prior to 9.2.0653, the treecountwords function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iterative...

Amazon Linux 2 : dracut, --advisory ALAS2-2026-3812 (ALAS-2026-3812)

The version of dracut installed on the remote host is prior to 033-535. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3812 advisory. A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted...

Important: kernel-livepatch-6.1.168-203.330

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.1.168-203.330 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1963)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1963 advisory. When using the configparser module to write configuration filescontaining multi-line text values with carriage return characters \r theresulting file could be injected with unexpected keys and...

Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2026-027 (ALASTOMCAT9-2026-027)

The version of tomcat installed on the remote host is prior to 9.0.120-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2026-027 advisory. Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess examp...

Amazon Linux 2023 : compat-golang-github-cpuguy83-md2man-2-devel, golang-github-cpuguy83-md2man, golang-github-cpuguy83-md2man-devel (ALAS2023-2026-1989)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1989 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2023 : clamav1.4, clamav1.4-data, clamav1.4-devel (ALAS2023-2026-1956)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1956 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1981)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1981 advisory. A use-after-free / double-free in c-ares' query-completion handling. Thesame flaw -- a query's callback being invoked while the query is stilllinked in the channel's internal lookup structures -- is...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-1958)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1958 advisory. PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description block directly from the tested product securi...

Amazon Linux 2023 : golang-github-burntsushi-toml-test, golang-github-burntsushi-toml-test-devel (ALAS2023-2026-1977)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1977 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2026-1983)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1983 advisory. A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1954)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1954 advisory. When using the configparser module to write configuration filescontaining multi-line text values with carriage return characters \r theresulting file could be injected with unexpected keys and...

Amazon Linux 2023 : xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel (ALAS2023-2026-1944)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1944 advisory. glamor Font Atlas Heap Buffer Overflow CVE-2026-55999 GLX contextTags Use-After-Free in CommonMakeCurrent CVE-2026-56000 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2026-1990)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1990 advisory. An attacker controlling an HTTP proxy or performing MITM on the plaintext pre-TLS proxy connection can trigger a single 0-byte overrun to a buffer on the stack by sending a crafted NTLM Type 2...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2026-1951)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1951 advisory. gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0 incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guar...

Amazon Linux 2023 : GraphicsMagick, GraphicsMagick-c++, GraphicsMagick-c++-devel (ALAS2023-2026-1960)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1960 advisory. A flaw was found in GraphicsMagick's Photo CD PCD decoder. A remote attacker could exploit this vulnerability by providing a specially crafted PCD file. This could lead to an out-of-bounds...

Important: kernel-livepatch-6.12.88-119.157

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.12.88-119.157 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Medium: php8.2

Issue Overview: PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Affected Packages: php8.2 Issue Correction: Run dnf update php8.2 --releasever 2023.12.20260720 or dnf update --advisory ALAS2023-2026-1958 --releasever 2023.12.20260720 to...

Amazon Linux 2 : containerd, --advisory ALAS2ECS-2026-132 (ALASECS-2026-132)

The version of containerd installed on the remote host is prior to 2.1.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-132 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1970)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1970 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: use listdelrcu for netlink hooks CVE-2026-46324 In the Linux kernel, the following vulnerability has be...