Amazon Linux 2 : iscsi-initiator-utils, --advisory ALAS2-2026-3897 (ALAS-2026-3897)

The version of iscsi-initiator-utils installed on the remote host is prior to 6.2.0.874-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3897 advisory. open-iscsi: open-iscsi: Stack buffer overflow in idbm record parsing CVE-2026-18724 open-iscsi:...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2026-2080)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2080 advisory. Improper handling of overlap between protected memory ranges for some IntelR XeonR 6 processors when using IntelR TDX within SMM may allow an escalation of privilege. SMM adversary with a...

Amazon Linux 2 : iperf3, --advisory ALAS2-2026-3869 (ALAS-2026-3869)

The version of iperf3 installed on the remote host is prior to 3.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3869 advisory. A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2026-2077)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2077 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...

Amazon Linux 2023 : postgresql16, postgresql16-contrib, postgresql16-llvmjit (ALAS2023-2026-2078)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2078 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...

Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2026-028 (ALASTOMCAT9-2026-028)

The version of tomcat installed on the remote host is prior to 9.0.121-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2026-028 advisory. Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat:...

Amazon Linux 2023 : python3.12-pip, python3.12-pip-wheel (ALAS2023-2026-2091)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2091 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

Amazon Linux 2 : postgresql, --advisory ALAS2POSTGRESQL14-2026-025 (ALASPOSTGRESQL14-2026-025)

The version of postgresql installed on the remote host is prior to 14.24-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL14-2026-025 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database us...

Amazon Linux 2 : mrtg, --advisory ALAS2-2026-3884 (ALAS-2026-3884)

The version of mrtg installed on the remote host is prior to 2.17.4-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3884 advisory. A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged...

Amazon Linux 2 : libXfont, --advisory ALAS2-2026-3890 (ALAS-2026-3890)

The version of libXfont installed on the remote host is prior to 1.5.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3890 advisory. A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font...

Amazon Linux 2 : kernel, --advisory ALAS2-2026-3881 (ALAS-2026-3881)

The version of kernel installed on the remote host is prior to 4.14.355-284.742. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3881 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring...

Amazon Linux 2023 : iperf3, iperf3-devel (ALAS2023-2026-2070)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2070 advisory. A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized numeric parameters, such as parallel and len, which are not properly...

Amazon Linux 2023 : firefox (ALAS2023-2026-2105)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2105 advisory. Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with...

Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2026-064 (ALASFIREFOX-2026-064)

The version of firefox installed on the remote host is prior to 140.14.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-064 advisory. Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the...

Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2026-2097)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2097 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Important: containerd

Issue Overview: A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Affected Packages: containerd Note: This advisory is applicable to Amazon Linux 2 - Ecs Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ secti...

Medium: alsa-lib

Issue Overview: The Advanced Linux Sound Architecture ALSA library before 1.2.16.1 contains a double-free vulnerability in parsedef in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-2108)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2108 advisory. Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserveraccept, causing...

Amazon Linux 2 : webkitgtk4, --advisory ALAS2-2026-3891 (ALAS-2026-3891)

The version of webkitgtk4 installed on the remote host is prior to 2.52.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3891 advisory. The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. Processi...

Amazon Linux 2023 : libudisks2, libudisks2-devel, udisks2 (ALAS2023-2026-2104)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2104 advisory. Local privilege escalation via as-user mount spoofing NOTE: https://github.com/azqzazq1/CVE-2026-7867-disk2root CVE-2026-7867 Tenable has extracted the preceding description block directly from the...