Toward greater transparency: Introducing machine-readable Vulnerability Exploitability Xchange (VEX) for Azure Linux and beyond

Microsoft is now publishing standard attestations about third-party CVEs through the Vulnerability Exploitability eXchange VEX standard including vulnerabilities in embedded open-source software in Microsoft products and services and starting with the Azure Linux Distribution formerly CBL-Mariner...

Azure Linux 3.0 Security Update: libsoup (CVE-2025-4948)

The version of libsoup installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-4948 advisory. - A flaw was found in the soupmultipartnewfrommessage function of the libsoup HTTP library, which is commonly...

Azure Linux 3.0 Security Update: httpd (CVE-2025-54090)

The version of httpd installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-54090 advisory. - A bug in Apache HTTP Server 2.4.64 results in all RewriteCond expr ... tests evaluating as true. Users are...

Azure Linux 3.0 Security Update: edk2 (CVE-2024-38796)

The version of edk2 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-38796 advisory. - EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage. An Attacker May cause memory corruption due to...

Azure Linux 3.0 Security Update: python3 (CVE-2025-6069)

The version of python3 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-6069 advisory. - The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malform...

Azure Linux 3.0 Security Update: kata-containers / kata-containers-cc (CVE-2025-5791)

The version of kata-containers / kata-containers-cc installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-5791 advisory. - A flaw was found in the user's crate for Rust. This vulnerability allows...

Azure Linux 3.0 Security Update: edk2 / hvloader (CVE-2023-45231)

The version of edk2 / hvloader installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-45231 advisory. - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighb...

Azure Linux 3.0 Security Update: vim (CVE-2025-53906)

The version of vim installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-53906 advisory. - Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim's...

Azure Linux 3.0 Security Update: xorg-x11-server / xorg-x11-server-Xwayland (CVE-2025-49175)

The version of xorg-x11-server / xorg-x11-server-Xwayland installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-49175 advisory. - A flaw was found in the X Rendering extension's handling of animated...

Azure Linux 3.0 Security Update: xorg-x11-server / xorg-x11-server-Xwayland (CVE-2025-49179)

The version of xorg-x11-server / xorg-x11-server-Xwayland installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-49179 advisory. - A flaw was found in the X Record extension. The...

Azure Linux 3.0 Security Update: xorg-x11-server / xorg-x11-server-Xwayland (CVE-2025-49178)

The version of xorg-x11-server / xorg-x11-server-Xwayland installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-49178 advisory. - A flaw was found in the X server's request handling. Non-zero 'bytes to...

Azure Linux 3.0 Security Update: vim (CVE-2025-53905)

The version of vim installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-53905 advisory. - Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim's...

Azure Linux 3.0 Security Update: cmake (CVE-2025-4947)

The version of cmake installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-4947 advisory. - libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specifi...

Azure Linux 3.0 Security Update: python-urllib3 / python3 (CVE-2025-50181)

The version of python-urllib3 / python3 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-50181 advisory. - urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible ...

Azure Linux 3.0 Security Update: xorg-x11-server / xorg-x11-server-Xwayland (CVE-2025-49180)

The version of xorg-x11-server / xorg-x11-server-Xwayland installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-49180 advisory. - A flaw was found in the RandR extension, where the...

Azure Linux 3.0 Security Update: qt5-qtbase / qtbase (CVE-2025-5455)

The version of qt5-qtbase / qtbase installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-5455 advisory. - An issue was found in the private API function qDecodeDataUrl in QtCore, which is used in...

Azure Linux 3.0 Security Update: kata-containers / kata-containers-cc / rpm-ostree (CVE-2024-27308)

The version of kata-containers / kata-containers-cc / rpm-ostree installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27308 advisory. - Mio is a Metal I/O library for Rust. When using named pipes on...

Azure Linux 3.0 Security Update: polkit (CVE-2025-7519)

The version of polkit installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-7519 advisory. - A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an...

Azure Linux 3.0 Security Update: yasm (CVE-2024-22653)

The version of yasm installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-22653 advisory. - yasm commit 9defefae was discovered to contain a NULL pointer dereference via the yasmsectionbcsappend functio...

Azure Linux 3.0 Security Update: edk2 / hvloader (CVE-2023-45229)

The version of edk2 / hvloader installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-45229 advisory. - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA...