Skip to content
OpenAdvisories

Source

Amazon Linux Security Center (ALAS)

Source: https://alas.aws.amazon.com/

All Critical High Medium Low With exploited CVEs

4,948 results · Feed

  • Medium max 9.1
    ALAS2023-2026-1401 4 CVEs

    Moderate: nerdctl security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate…

    first Feb 5, 2026
  • Medium max 9.1
    ALAS2023-2026-1389 4 CVEs

    Moderate: libcap security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate…

    first Feb 5, 2026
  • Medium max 9.1
    ALAS2023-2026-1382 4 CVEs

    Moderate: golist security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate…

    first Feb 5, 2026
  • Medium max 6.3
    ALAS2023-2026-1375 6 CVEs

    Moderate: curl security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-15224: libssh key passphrase bypass without agent set NOTE: https://curl.se/docs/CVE-2025-15224.html NOTE: Introduced with: https://github.com/curl/curl/commi…

    first Feb 16, 2026
  • Medium max 9.1
    ALAS2023-2026-1373 4 CVEs

    Moderate: cni-plugins security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate…

    first Feb 5, 2026
  • Medium max 9.1
    ALAS2023-2026-1370 4 CVEs

    Moderate: amazon-ecr-credential-helper security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate…

    first Feb 5, 2026
  • High max 7.2
    ALAS2023-2025-1307 2 CVEs

    Important: linux-firmware security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-62626: Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, pote…

    first Dec 8, 2025
  • High max 7.2
    ALAS2-2025-3092 2 CVEs

    Important: linux-firmware security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-62626: Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potenti…

    first Dec 8, 2025
  • Medium max 6.3
    ALAS2-2026-3173 6 CVEs

    Moderate: curl security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-15224: libssh key passphrase bypass without agent set NOTE: https://curl.se/docs/CVE-2025-15224.html NOTE: Introduced with: https://github.com/curl/curl/commit/c…

    first Feb 16, 2026
  • High max 8.6
    ALAS2-2026-3172 1 CVE

    Important: golang security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-61732: A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

    first Feb 16, 2026
  • Medium max 6.9
    ALAS2-2026-3171 4 CVEs

    Moderate: thunderbird security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-25210: In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag bu…

    first Feb 16, 2026
  • Medium max 6.9
    ALAS2-2026-3170 1 CVE

    Moderate: expat security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-25210: In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag bu…

    first Feb 16, 2026
  • High max 7.5
    ALAS2-2026-3169 7 CVEs

    Important: openssl11 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function NOTE: https://openssl-library.org/news/secadv/20260127.txt CVE-2026-22795: An inva…

    first Feb 16, 2026
  • High max 7.5
    ALAS2-2026-3168 4 CVEs

    Important: openssl security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function NOTE: https://openssl-library.org/news/secadv/20260127.txt CVE-2025-69421: Process…

    first Feb 16, 2026
  • High max 9.8
    ALAS2-2026-3167 14 CVEs

    Important: thunderbird security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-0891: Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corru…

    first Feb 16, 2026
  • Medium max 6.8
    ALAS2-2026-3166 6 CVEs

    Moderate: freerdp security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-23732: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never val…

    first Feb 16, 2026
  • High max 7.8
    ALAS2-2026-3165 14 CVEs 1 exploited

    Important: kernel security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-42090: In the Linux kernel, the following vulnerability has been resolved: pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER CVE-2024-42070: …

    first Feb 16, 2026
  • High max 8.8
    ALAS2-2026-3164 1 CVE

    Important: fontforge security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-15270: FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a…

    first Feb 16, 2026
  • High max 7.7
    ALAS2-2026-3162 7 CVEs

    Important: freerdp security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-23884: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to free…

    first Feb 16, 2026
  • High max 7.5
    ALAS2-2026-3154 4 CVEs

    Important: java-1.8.0-openjdk security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-21945: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported …

    first Feb 16, 2026
  • High max 7.5
    ALAS2-2026-3150 7 CVEs

    Important: edk2 security update (Amazon Linux 2)

    Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function NOTE: https://openssl-library.org/news/secadv/20260127.txt CVE-2026-22795: An inva…

    first Feb 16, 2026
  • Medium max 6.0
    ALAS2023-2026-1444 5 CVEs

    Moderate: python3.12 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-1299: The email module, specifically the "BytesGenerator" class, didn't properly quote newlines for email headers when serializing an email message allowing f…

    first Feb 16, 2026
  • Low max 3.6
    ALAS2023-2026-1441 2 CVEs

    Low: openssh security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-61985: ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. CVE-2025-6198…

    first Feb 16, 2026
  • Medium max 5.5
    ALAS2023-2026-1440 2 CVEs

    Moderate: libpng security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-28164: Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function. CVE-2…

    first Feb 16, 2026
  • Medium max 6.5
    ALAS2023-2026-1439 5 CVEs

    Moderate: libsoup security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-32910: A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the libsoup client…

    first Feb 16, 2026
  • High max 8.6
    ALAS2023-2026-1438 1 CVE

    Important: golang security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-61732: A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

    first Feb 16, 2026
  • Medium max 6.0
    ALAS2023-2026-1437 5 CVEs

    Moderate: python3.13 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-1299: The email module, specifically the "BytesGenerator" class, didn't properly quote newlines for email headers when serializing an email message allowing f…

    first Feb 16, 2026
  • Medium max 5.9
    ALAS2023-2026-1436 1 CVE

    Moderate: nginx security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-1642: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-i…

    first Feb 16, 2026
  • Medium max 6.8
    ALAS2023-2026-1435 3 CVEs

    Moderate: firefox security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-22801: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26…

    first Feb 16, 2026
  • High max 7.5
    ALAS2023-2026-1434 9 CVEs

    Important: openssl security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function NOTE: https://openssl-library.org/news/secadv/20260127.txt CVE-2026-22795: An i…

    first Feb 16, 2026
  • Medium max 6.9
    ALAS2023-2026-1433 8 CVEs

    Moderate: freerdp security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-23732: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never …

    first Feb 16, 2026
  • Medium max 6.5
    ALAS2023-2026-1432 1 CVE

    Moderate: vsftpd security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-14242: A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered …

    first Feb 16, 2026
  • High max 8.8
    ALAS2023-2026-1431 1 CVE

    Important: fontforge security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-15270: FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut…

    first Feb 16, 2026
  • High max 9.8
    ALAS2023-2026-1430 76 CVEs

    Important: kernel6.12 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-68764: In the Linux kernel, the following vulnerability has been resolved: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags CVE-2025-687…

    first Feb 16, 2026
  • High max 9.8
    ALAS2023-2026-1429 13 CVEs

    Important: firefox security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-0891: Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory co…

    first Feb 16, 2026
  • Medium max 4.5
    ALAS2023-2026-1428 1 CVE

    Moderate: python3.13-virtualenv security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-22702: virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in…

    first Feb 16, 2026
  • High max 8.4
    ALAS2023-2026-1427 1 CVE

    Important: gnupg2 security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-24882: In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

    first Feb 16, 2026
  • Medium max 4.6
    ALAS2023-2026-1426 1 CVE

    Moderate: alsa-lib security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-25068: alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decod…

    first Feb 16, 2026
  • Medium max 6.9
    ALAS2023-2026-1425 1 CVE

    Moderate: expat security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-25210: In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag…

    first Feb 16, 2026
  • Medium max 6.9
    ALAS2023-2026-1424 1 CVE

    Moderate: firefox security update (Amazon Linux 2023)

    Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-25210: In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag…

    first Feb 16, 2026