Amazon Linux 2023 : ca-certificates (ALAS2023-2026-3306)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3306 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-3231)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3231 advisory. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2026-3242)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3242 advisory. Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152. CVE-2026-12318 Incorrect boundary conditions, integer overflow...

Amazon Linux 2023 : nerdctl (ALAS2023-2026-3274)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3274 advisory. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-3327)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3327 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-3232)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3232 advisory. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-3277)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3277 advisory. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in...

Amazon Linux 2023 : perl, perl-Attribute-Handlers, perl-AutoLoader (ALAS2023-2026-3279)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3279 advisory. Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch. The regex engine's superlinear cache...

Amazon Linux 2 : ecs-init (ALASECS-2026-149)

The version of ecs-init installed on the remote host is prior to 1.108.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2026-149 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer m...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-3312)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3312 advisory. Inbound-message resource exhaustion CWE-400 leading to denial of service. No configuration precondition; version applicability is the deciding factor. Affected versions: 9.11.0-9.18.50,...

Amazon Linux 2 : docker (ALASECS-2026-150)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2026-150 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the...

Amazon Linux 2023 : docker (ALAS2023-2026-3324)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3324 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by th...

Amazon Linux 2023 : git-lfs (ALAS2023-2026-3322)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3322 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates...

Amazon Linux 2023 : docker (ALAS2023-2026-3266)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3266 advisory. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A...

Amazon Linux 2023 : oci-add-hooks (ALAS2023-2026-3272)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3272 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-3229)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3229 advisory. When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-3314)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3314 advisory. Fix GHSA-w7mc-p8jc-p853: heap OOB read / info disclosure OpYCbCr420toRRGGBBaa Fix GHSA-9rj8-5mp5-26c9: Out-of-bounds read in RGBYCbCr identity-matrix colour conversion with mismatched...

Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2026-3315)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3315 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updat...

Amazon Linux 2023 : qemu, qemu-common, qemu-guest-agent (ALAS2023-2026-3241)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3241 advisory. hw/usb/hcd-xhci: Set reentrancy guard in timer functions CVE-2026-17588 NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba v11.1.0-rc3NOTE:...

Amazon Linux 2 : docker (ALASECS-2026-148)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-148 advisory. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers...