Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2025-1243)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1243 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2025-1235)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1235 advisory. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory EOCD Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record...

Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2025-1242)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1242 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2025-1227)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1227 advisory. In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration CVE-2025-38248 In the Linux kernel, the following...

Amazon Linux 2023 : (ALAS2023-2025-1247)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1247 advisory. gi-docgen does not encode search terms before inserting them into HTML, allowing XSS via a crafted URL. Description obtained from: https://gitlab.gnome.org/GNOME/gi-docgen/-/issues/228 CVE-2025-11687...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2025-1232)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1232 advisory. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory EOCD Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record...

Important: kernel-livepatch-6.1.148-173.267

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bamdma: Fix DT error handling for num-channels/ees CVE-2025-39923 Affected Packages: kernel-livepatch-6.1.148-173.267 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.12.37-61.105

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bamdma: Fix DT error handling for num-channels/ees CVE-2025-39923 Affected Packages: kernel-livepatch-6.12.37-61.105 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Medium: libxslt

Issue Overview: A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. CVE-2025-10911 Affected Packages: libxslt Issue Correction: Run dnf update libxslt --releasever 2023.9.20251027 or dnf update...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration CVE-2025-38248 In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix backlog accounting in qdiscdequeueinternal...

Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2025-1231)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1231 advisory. Improper link resolution before file access 'link following' in .NET allows an authorized attacker to elevate privileges locally. CVE-2025-55247 Inadequate encryption strength in .NET, .NET...

Amazon Linux 2023 : polkit, polkit-devel, polkit-libs (ALAS2023-2025-1217)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1217 advisory. A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior,...

Amazon Linux 2023 : cuda-cccl-13 (ALAS2023NVIDIA-2025-192)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023NVIDIA-2025-192 advisory. NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successfu...

Amazon Linux 2023 : cuda-tools-12 (ALAS2023NVIDIA-2025-207)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023NVIDIA-2025-207 advisory. NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit of this vulnerability might lead to...

Amazon Linux 2023 : nvidia (ALAS2023NVIDIA-2025-195)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023NVIDIA-2025-195 advisory. NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit of this vulnerability might lead to...

Amazon Linux 2023 : cuda-cudart-12, cuda-cudart-devel-12, cuda-driver-devel-12 (ALAS2023NVIDIA-2025-233)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023NVIDIA-2025-233 advisory. NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit of this vulnerability might lead to...

Amazon Linux 2023 : libnvfatbin-12, libnvfatbin-devel-12 (ALAS2023NVIDIA-2025-199)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023NVIDIA-2025-199 advisory. NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit of this vulnerability might lead to...

Amazon Linux 2023 : cuda-nsight-compute-12 (ALAS2023NVIDIA-2025-222)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023NVIDIA-2025-222 advisory. NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit of this vulnerability might lead to...

Amazon Linux 2023 : libcusolver-12, libcusolver-devel-12 (ALAS2023NVIDIA-2025-202)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023NVIDIA-2025-202 advisory. NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit of this vulnerability might lead to...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2025-1216)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1216 advisory. When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.Note that upgrading pip to a fixed version for this...