Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

High max 7.3

ELSA-2026-98105 1 CVE

Important: libimobiledevice security update (Oracle Linux 8)

[1.2.0-18] - Fix double free in afc_receive_data() when service_receive() fails [1.2.0-17] - CVE-2026-116260 libimobiledevice: libimobiledevice: Denial of Service via double free in service_receive double free in service_receive

Nov 11, 2026
High max 7.8

ELSA-2026-98119 1 CVE

Important: vim security, bug fix, and enhancement update (Oracle Linux 8)

[8.0.1763-34.0.1] - Remove upstream references [Orabug: 31197557] - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984] [2:8.0.1763-34] - RHEL-285535 CVE-2026-43961 vim: Vimscript injection via unescaped filename in netrw s:Net…

Nov 11, 2026
High max 7.5

ELSA-2026-96234 7 CVEs

Important: nodejs:22 security, bug fix, and enhancement update (Oracle Linux 9)

nodejs [1:22.23.2-2.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds [1:22.23.2-2] - Patches Pacote CVE and upd…

Nov 11, 2026
High max 8.8

ELSA-2026-96083 14 CVEs

Important: dpdk security update (Oracle Linux 8)

[23.11-3] - Backport fixes for CVE-2026-86846 CVE-2026-86848 CVE-2026-86561 CVE-2026-86562 CVE-2026-86563 CVE-2026-86567 CVE-2026-86566 CVE-2026-86849 CVE-2026-86845 CVE-2026-86847 CVE-2026-86856 CVE-2026-86565 CVE-2026-93683 CVE-2026-100236

Nov 9, 2026
Medium max 5.5

ELSA-2026-96215 1 CVE

Moderate: patch security update (Oracle Linux 8)

[2.7.6-12] - CVE-2026-115207 patch: Filename validation bypass in reversal fallback allows file creation outside the working directory allows file creation outside the working directory - Resolves: RHEL-289587

Nov 9, 2026
Medium max 6.3

ELSA-2026-96087 4 CVEs

Moderate: glibc security update (Oracle Linux 8)

[2.28-251.0.5.53] - Forward port of Oracle patches to 2.28-251.53 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Oracle history: October-14-2026 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.28-251.0.5.48 - Forward port of Oracle patches to 2.28-2…

Nov 9, 2026
High

ELSA-2026-500589 0 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.361.4.1] - iommu/amd: Force device table to maximum size (Suravee Suthikulpanit) [Orabug: 40172712] {CVE-2024-21963} - x86/microcode/AMD: Increase PATCH_MAX_SIZE for Family 1Ah (Saeed Mirzamohammadi) [Orabug: 40172712] [5.4.17-2136.361.4] - vhost…

Nov 9, 2026
High max 7.7

ELSA-2026-96078 1 CVE

Important: squid:4 security update (Oracle Linux 8)

libecap [1.0.1-2] - Resolves: #1695587 - Ensure modular RPM upgrade path [1.0.1-1] - new version 1.0.1 - autoconf.h moved from lookaside to dist-git [1.0.0-7] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild [1.0.0-6] - Rebuilt for…

Nov 9, 2026
High max 8.7

ELSA-2026-96075 1 CVE

Important: qt5-qtdeclarative security update (Oracle Linux 8)

[5.15.3-3] - CVE-2025-12385 qt5-qtdeclarative: Improper validation of <img> tag size in Text component parser Resolves: RHEL-287799

Nov 9, 2026
High max 9.6

ELSA-2026-96080 18 CVEs

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.54.2-2] - Update bundled Skia to aa789d9bd566

Nov 9, 2026
High max 8.0

ELSA-2026-96212 3 CVEs

Important: util-linux security update (Oracle Linux 8)

[2.32.1-50.0.1] - Orabug 38983542 - libblkid: use checksum for jmicron - Orabug 35995159 - report lost loop device [2.32.1-50] - fix RHEL-283368 - libblkid: validate EBR data [CVE-2026-53615] [2.32.1-49] - fix RHEL-215636 - libblkid: use-after-free in nested …

Nov 9, 2026
High max 7.8

ELSA-2026-96226 10 CVEs

Important: nodejs:24 security update (Oracle Linux 9)

nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds [1:24.21.0-1] - Update to version 24.21.0 …

Nov 9, 2026
High max 9.8

ELSA-2026-96081 155 CVEs

Important: thunderbird security update (Oracle Linux 9)

[153.6.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [153.6.0] - Add OpenELA debranding [153.6.0-1] - Update to 153.6.0 ESR

Nov 9, 2026
High max 5.6

ELSA-2026-500588 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-326.222.4.1] - Fix TSA microcode check for ZEN5 (Dave Kleikamp) [Orabug: 40172717] {CVE-2024-36350} {CVE-2024-36357} {CVE-2026-0004} - Fix Zen5 TSA (Borislav Petkov (AMD)) [Orabug: 40172717] {CVE-2024-36350} {CVE-2024-36357} {CVE-2026-0004} - iommu/am…

Nov 9, 2026
High max 5.6

ELSA-2026-500590 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-326.224.5.0.1] - Fix TSA microcode check for ZEN5 (Dave Kleikamp) [Orabug: 40172717] {CVE-2024-36350} {CVE-2024-36357} {CVE-2026-0004} - Fix Zen5 TSA (Borislav Petkov (AMD)) [Orabug: 40172717] {CVE-2024-36350} {CVE-2024-36357} {CVE-2026-0004} - iommu/…

Nov 9, 2026
High max 8.1

ELSA-2026-96092 1 CVE

Important: curl security update (Oracle Linux 10)

[8.12.1-4.el10_2.8] - fix HTTP/2 upload use-after-free in multi_done (CVE-2026-92392)

Nov 9, 2026
High max 9.8

ELSA-2026-96079 155 CVEs

Important: thunderbird security update (Oracle Linux 10)

[153.6.0-1.0.1] - Add Oracle prefs [153.6.0-1] - Update to 153.6.0 ESR

Nov 9, 2026
Medium max 10.0

ELSA-2026-96235 4 CVEs 1 exploited

Moderate: ruby security, bug fix, and enhancement update (Oracle Linux 10)

[3.3.13-16] - Rebase to Ruby 3.3.13. Resolves: RHEL-300972 - Fix: integer overflow issue in regular expression compiler (CVE-2026-110264) Resolves: RHEL-292066 - Fix: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229) Resolves: RHEL-…

Nov 9, 2026
High max 7.5

ELSA-2026-96236 2 CVEs

Important: nodejs-nodemon security update (Oracle Linux 10)

[3.1.14-5] - CVE-2026-102278 nodejs-nodemon: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns [3.1.14-4] - CVE-2026-102276 nodejs-nodemon: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns

Nov 9, 2026
Medium max 10.0

ELSA-2026-96233 3 CVEs 1 exploited

Moderate: ruby4.0 security, bug fix, and enhancement update (Oracle Linux 10)

[4.0.9-38] - Upgrade to ruby 4.0.9. Resolves: RHEL-300942 - Fix: integer overflow issue in regular expression compiler (CVE-2026-110264) Resolves: RHEL-292062 - Fix: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229) Resolves: RHEL-2…

Nov 9, 2026
Critical max 9.5

ELSA-2026-96240 1 CVE

Critical: edk2 security update (Oracle Linux 10)

[20251114-5.0.1.el10_2.3] - Replace upstream references [Orabug:36569119] [20251114-5.el10_2.3] - edk2-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch [RHEL-291254] - Resolves: RHEL-291254 (CVE-2026-97631 edk2: Pre-boot RCE in EDK II PXE driver [rh…

Nov 9, 2026
High max 7.5

ELSA-2026-96094 8 CVEs

Important: nodejs22 security update (Oracle Linux 10)

[1:22.23.4-1] - Rebase to 22.23.4

Nov 9, 2026
High max 5.6

ELSA-2026-500587 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-208.112.5.1] - iommu/amd: Force device table to maximum size (Suravee Suthikulpanit) [Orabug: 40172716] {CVE-2024-21963} - Fix Zen5 TSA (Borislav Petkov (AMD)) [Orabug: 40172716] {CVE-2024-36350} {CVE-2024-36357} {CVE-2026-0004}

Nov 9, 2026
High max 10.0

ELSA-2026-76741 10 CVEs

Important: firefox security update (Oracle Linux 7)

[140.15.0-1.0.1] - Update to 140.15.0 ESR [Orabug: 40120040][CVE-2026-16365][CVE-2026-75874] [CVE-2026-84119][CVE-2026-84120][CVE-2026-84121][CVE-2026-84122][CVE-2026-84124] [CVE-2026-84131][CVE-2026-84143][CVE-2026-84145] [140.14.0-1.0.1] - Update to 140.14.…

Nov 6, 2026
High max 9.6

ELSA-2026-83496 28 CVEs

Important: firefox security update (Oracle Linux 7)

[140.16.0-1.0.1] - Update to 140.16.0 ESR [Orabug: 40189898][CVE-2026-92005][CVE-2026-92006] [CVE-2026-92007][CVE-2026-92008][CVE-2026-92009][CVE-2026-92010][CVE-2026-92011] [CVE-2026-92012][CVE-2026-92013][CVE-2026-92014][CVE-2026-92015][CVE-2026-92016] [CVE…

Nov 6, 2026
High max 9.8

ELSA-2026-92363 43 CVEs

Important: firefox security update (Oracle Linux 7)

[140.17.0-1.0.1] - Update to 140.17.0 ESR [Orabug: 40229686][CVE-2026-92035][CVE-2026-96869] [CVE-2026-100756][CVE-2026-100757][CVE-2026-100758][CVE-2026-100759][CVE-2026-100762] [CVE-2026-100766][CVE-2026-100767][CVE-2026-100769][CVE-2026-100770][CVE-2026-10…

Nov 6, 2026
High max 7.0

ELSA-2026-73425 1 CVE

Important: gdb security update (Oracle Linux 8)

[8.2-20.1.0.1] - Import gdb-8.2-20.1.el8_10 and forward-port Oracle changes. Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Oracle history: Thu Dec 7 2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 8.2-20.0.2 - OraBug 36055910 Support RDTSCP…

Nov 6, 2026
High max 6.8

ELSA-2026-95638 1 CVE

Important: go-toolset:ol8 security update (Oracle Linux 8)

delve [1.26.1-2.0.1] [1.26.1-2] - Add GOMODCACHE in %check - Resolves: RHEL-289505 [1.26.1-1] - Update to Delve 1.26.1 - Related: RHEL-183712 [1.25.2-1] - Update to Delve 1.25.2 (Sync from CentOS Stream 9) - Related: RHEL-121223 [1.24.1-1] - Rebase to 1.24.1 …

Nov 6, 2026
Medium max 6.3

ELSA-2026-95618 4 CVEs

Moderate: glibc security update (Oracle Linux 9)

[2.34-284.0.1.4] - Forward-port Oralce patches for ol9-u8 Oracle history: October-13-2026 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-283.0.1 - Forward-port Oracle patches for ol9-u8 Reviewed-by: Kris Van Hees <kris.van.hees@oracle.com> August-03-2026 …

Nov 6, 2026
High max 8.1

ELSA-2026-50184 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-200.74.27.2] - ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 39186444] {CVE-2025-40135} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An) [Orabug: 39181102] {CVE-2026-23231} - dst: fix races in rt6_uncached_list_del()…

Nov 6, 2026
High max 7.8

ELSA-2026-95482 1 CVE

Important: gimp:2.8 security, bug fix, and enhancement update (Oracle Linux 8)

gimp [2:2.8.22-26.10] - fix CVE-2026-112257 - modify fix for CVE-2026-4154 [2:2.8.22-26.9] - fix CVE-2026-90947 - fix CVE-2026-90948 - fix CVE-2026-92248 - fix CVE-2026-97185 [2:2.8.22-26.8] - fix CVE-2026-59090 - fix CVE-2026-18301 - fix CVE-2026-18303 - fix…

Nov 5, 2026
High max 8.6

ELSA-2026-95725 6 CVEs

Important: tesseract security update (Oracle Linux 8)

[4.1.1-7] - Rebuilt for mtime issue [4.1.1-6] - Fix incomplete CVE-2026-88051: reset 'size_used_' on validation failure in 'GenericVector::read()'; check 'fontinfo_table_' and 'fontset_table_' read return values in 'ReadIntTemplates'; fix callback leak on all…

Nov 5, 2026
High max 9.8

ELSA-2026-95212 6 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.184.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Nov 5, 2026
High max 7.5

ELSA-2026-69293 5 CVEs

Important: osbuild-composer security update (Oracle Linux 9)

[175-1.0.2] - Rebuild to fix CVE-2026-33818, CVE-2026-39820, CVE-2026-39821, CVE-2026-42499, CVE-2026-42504, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862

Nov 5, 2026
High max 9.8

ELSA-2026-95370 16 CVEs

Important: kernel security update (Oracle Linux 9)

[5.14.0-687.66.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Nov 5, 2026
High max 7.5

ELSA-2026-95518 2 CVEs

Important: delve security update (Oracle Linux 9)

[1.26.1-2.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.26.1-2] - Add GOMODCACHE in check - Resolves: RHEL-289481

Nov 5, 2026
High max 7.5

ELSA-2026-95519 5 CVEs

Important: delve security update (Oracle Linux 10)

[1.26.1-3.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.26.1-3] - Add GOMODCACHE in %check

Nov 5, 2026
High max 9.8

ELSA-2026-95367 8 CVEs

Important: kernel security update (Oracle Linux 10)

[6.12.0-211.74.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Nov 5, 2026
Medium max 6.1

ELSA-2026-95570 3 CVEs

Moderate: cockpit-files security update (Oracle Linux 10)

[36.1-1] - Fix CVE-2026-91202 - Don't de-reference a symlink when pasting (RHEL-263140) - Fix CVE-2026-91205 - Don't de-reference a symlink when creating a directory (RHEL-263132)

Nov 5, 2026
High max 5.9

ELSA-2026-71619 1 CVE

Important: host-metering security update (Oracle Linux 7)

* Tue Oct 13 2026 Kaylin Devchand <kaylin.devchand@oracle.com - 1.2.0-4.0.5 - Rebuild with latest go-toolset-1.19-golang to fix CVE-2026-56860 [Orabug: 40071668] [1.2.0-4.0.3] - Rebuild with latest go-toolset-1.19-golang to fix CVE-2026-27145 [Orabug: 3986376…

Nov 4, 2026