Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2025-1124)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1124 advisory. Thor before 1.4.0 can construct an unsafe shell command from library input. CVE-2025-54314 Tenable has extracted the preceding description block directly from the tested product security advisory. Note...

Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2025-1103)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1103 advisory. libxml: Heap use after free UAF leads to Denial of service DoS CVE-2025-49794 libxml: Null pointer dereference leads to Denial of service DoS CVE-2025-49795 libxml: Type confusion leads to...

Amazon Linux 2023 : git, git-all, git-core (ALAS2023-2025-1108)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1108 advisory. When a user clones an untrusted repository and runs Gitk without additional command arguments, any writable file can be created and truncated. The option Support per-file encoding must have be...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null CVE-2022-50073 In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a server shutdown leak CVE-2023-53131 ...

Amazon Linux 2023 : libnvidia-cfg, libnvidia-ml, nvidia-driver-cuda (ALAS2023NVIDIA-2025-138)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-138 advisory. NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outside bounds permitted under normal use cases. A...

Amazon Linux 2023 : ImageMagick, ImageMagick-c++, ImageMagick-c++-devel (ALAS2023-2025-1126)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1126 advisory. ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the InterpretImageFilename...

Amazon Linux 2023 : libmicrohttpd, libmicrohttpd-devel (ALAS2023-2025-1133)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1133 advisory. GNU libmicrohttpd before 0.9.76 allows remote DoS Denial of Service due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHDcreatepostprocessor method. This allows an attack...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2025-105)

The version of kernel installed on the remote host is prior to 5.4.296-217.423. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2025-105 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported versi...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2025-1090)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1090 advisory. The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service. CVE-2025-6069 Tenable has...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2025-020)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0462.b08-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2025-020 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise...

Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2025-1134)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1134 advisory. A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service DoS. CVE-2025-32049 Tenable has...

Amazon Linux 2 : kernel, --advisory ALAS2-2025-2955 (ALAS-2025-2955)

The version of kernel installed on the remote host is prior to 4.14.355-280.664. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2955 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tap: NULL pointer derefence in...

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2025-1123)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1123 advisory. A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2025-021)

The version of tomcat installed on the remote host is prior to 9.0.107-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2025-021 advisory. Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache...

Amazon Linux 2023 : gdk-pixbuf2, gdk-pixbuf2-devel, gdk-pixbuf2-modules (ALAS2023-2025-1120)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1120 advisory. In GNOME GdkPixbuf aka gdk-pixbuf through 2.42.10, the ANI Windows animated cursor decoder encounters heap memory corruption in aniloadchunk in io-ani.c when parsing chunks in a crafted .ani...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2025-1114)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1114 advisory. fsockopen doesn't regard hostname as well, hostname is terminated at the null byte. This can cause Server Side Request Forgery in general case. CVE-2025-1220 Missing error checking could resul...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1130)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1130 advisory. In the Linux kernel, the following vulnerability has been resolved: virtio: break and reset virtio devices on deviceshutdown CVE-2025-38064 In the Linux kernel, the following vulnerability has...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2025-1100)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1100 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE:...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2025-1122)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1122 advisory. A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is also vulnerable when compiled with ECS...

Amazon Linux 2023 : kmod-nvidia-open-dkms (ALAS2023NVIDIA-2025-139)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-139 advisory. NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outside bounds permitted under normal use cases. A...