Amazon Linux 2023 : 7zip, 7zip-reduced, 7zip-standalone (ALAS2023-2026-2037)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2037 advisory. NOTE: Since p7zip/16.02+transitional.1 src:p7zip is only an empty source packageNOTE: depending on 7zip. Mark this version as fixed version.NOTE:...

Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2026-2038)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2038 advisory. OpenVPN memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes CVE-2026-12932 When dynamic tls-crypt is active, it is possibl...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-2033)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2033 advisory. In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1998)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1998 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated...

Amazon Linux 2 : glib2, --advisory ALAS2-2026-3850 (ALAS-2026-3850)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3850 advisory. A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in xdgmimemagicparsemagicline in the xdgmimemagic.c file ...

Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2026-2036)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2036 advisory. A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-2044)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2044 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...

Amazon Linux 2023 : python3.13-tornado (ALAS2023-2026-2015)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2015 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving...

Amazon Linux 2 : java-1.8.0-amazon-corretto, --advisory ALAS2CORRETTO8-2026-024 (ALASCORRETTO8-2026-024)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0502.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2026-024 advisory. Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected ar...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3829 (ALAS-2026-3829)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3829 advisory. Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents ...

Amazon Linux 2 : rclone, --advisory ALAS2-2026-3834 (ALAS-2026-3834)

The version of rclone installed on the remote host is prior to 1.55.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3834 advisory. Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to...

Amazon Linux 2 : java-17-amazon-corretto, --advisory ALAS2-2026-3842 (ALAS-2026-3842)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.20+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3842 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product...

Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-2042)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2042 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...

Amazon Linux 2023 : python3-rpm, rpm, rpm-apidocs (ALAS2023-2026-1991)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1991 advisory. A heap buffer overflow exists in RPM's NDB database backend lib/backend/ndb/rpmpkg.c due to unchecked 32-bit arithmetic when parsing the slot table. The slotnpages value is read directly from the on-di...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1996)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1996 advisory. The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated unterminated markup declarations whenprocessing uncontrolled data. CVE-2026-15308 In the...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2026-2022)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2022 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java S...

Amazon Linux 2023 : jbig2dec, jbig2dec-devel, jbig2dec-libs (ALAS2023-2026-2027)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2027 advisory. An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input. CVE-2026-38076 Tenable has extracted the precedi...

Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2026-2021)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2021 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java S...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2032)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2032 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6output CVE-2025-40158 In the Linux kernel, the following vulnerability has been resolved: xfrm: Wait for...

Amazon Linux 2 : libxml2, --advisory ALAS2-2026-3827 (ALAS-2026-3827)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3827 advisory. libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershel...