Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

206 results · Clear filters · Feed

Critical max 9.5

ELSA-2026-96240 1 CVE

Critical: edk2 security update (Oracle Linux 10)

[20251114-5.0.1.el10_2.3] - Replace upstream references [Orabug:36569119] [20251114-5.el10_2.3] - edk2-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch [RHEL-291254] - Resolves: RHEL-291254 (CVE-2026-97631 edk2: Pre-boot RCE in EDK II PXE driver [rh…

Nov 9, 2026
Critical max 9.4

ELSA-2026-86192 22 CVEs

Critical: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 8)

[10.0.114-1.0.2] - Add support for Oracle Linux - build dotnet-host [10.0.114-1] - Update to .NET SDK 10.0.114 and Runtime 10.0.14 - Resolves: RHEL-291741 [10.0.113-2] - Update to .NET SDK 10.0.113 and Runtime 10.0.13 - Resolves: RHEL-277805

Nov 3, 2026
Critical max 9.1

ELSA-2026-94500 5 CVEs

Critical: fence-agents security update (Oracle Linux 9)

[4.10.0-110.8] - bundled PyJWT: upgrade to v2.15.1 to fix CVE-2026-102266, CVE-2026-102267, CVE-2026-102268, CVE-2026-102271, and CVE-2026-102272 Resolves: RHEL-281011, RHEL-281460, RHEL-286482, RHEL-278388, RHEL-281053

Nov 3, 2026
Critical max 9.1

ELSA-2026-94501 5 CVEs

Critical: fence-agents security update (Oracle Linux 10)

[4.16.0-21.7] - bundled PyJWT: upgrade to v2.15.1 to fix CVE-2026-102266, CVE-2026-102267, CVE-2026-102268, CVE-2026-102271, and CVE-2026-102272 Resolves: RHEL-281025, RHEL-281457, RHEL-286479, RHEL-278385, RHEL-281051

Nov 3, 2026
Critical max 9.2

ELSA-2026-93077 3 CVEs

Critical: python-pillow security update (Oracle Linux 8)

[5.1.1-36] - CVE-2026-112900 python-pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE Resolves: RHEL-295960 [5.1.1-35] - CVE-2026-112398 python-pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to co…

Nov 2, 2026
Critical max 9.8

ELSA-2026-93414 1 CVE

Critical: kernel security update (Oracle Linux 8)

[4.18.0-553.182.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Nov 2, 2026
Critical max 9.1

ELSA-2026-92157 1 CVE

Critical: mod_auth_openidc:2.3 security update (Oracle Linux 8)

cjose [0.6.1-6] - CVE-2026-53939 mod_auth_openidc:2.3/cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption Resolves: RHEL-287898 mod_auth_openidc [2.4.9.4-9] - Resolves: RHEL-248080 CVE-2026-54789 Denial of Service via mal…

Oct 29, 2026
Critical max 9.1

ELSA-2026-92145 1 CVE

Critical: cjose security update (Oracle Linux 9)

[0.6.1-17.2] - CVE-2026-53939 cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption Encryption Key for AES-CBC-HMAC JWE encryption Resolves: RHEL-287912

Oct 29, 2026
Critical max 7.5

ELSA-2026-89744 5 CVEs

Critical: grafana security update (Oracle Linux 9)

[10.2.6-23.7] - CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting - Resolves RHEL-290771 [10.2.6-23.6] - Rebuild against updated golang - Resolves RHEL-287510 - Resolves RHEL-279380 - Resolves RHEL-279012 - Resolves RHE…

Oct 26, 2026
Critical max 9.1

ELSA-2026-72199 1 CVE

Critical: unbound security update (Oracle Linux 7)

[1.6.6-5.0.3] - Fix CVE-2026-81642 DNSKEY digest buffer overflow and add regression test [Orabug: 40081199] [1.6.6-5.0.1] - Fix CVE-2023-50387 and CVE-2023-50868 [Orabug: 37387426]

Oct 23, 2026
Critical max 6.8

ELSA-2026-88550 1 CVE

Critical: ca-certificates security update (Oracle Linux 8)

[2026.2.92_v9.0.319-81.3] - Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch [2026.2.92_v9.0.319-81.2] - Removing: emSign Root CS CA - G3 from Microsoft Code Signing certificates [2026.2.92_v9.0.319-81] - Update to CKBI 2.92_v9.0.319 from NSS 3…

Oct 23, 2026
Critical max 6.8

ELSA-2026-88459 1 CVE

Critical: ca-certificates security update (Oracle Linux 9)

[2026.2.92_v9.0.319-90.3] - Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch [2026.2.92_v9.0.319-90.2] - Removing: emSign Root CS CA - G3 from Microsoft Code Signing certificates [2026.2.92_v9.0.319-90.1] - Removing: AAA Certificate Services ro…

Oct 23, 2026
Critical max 6.8

ELSA-2026-88455 1 CVE

Critical: ca-certificates security update (Oracle Linux 10)

[2026.2.92_v9.0.319-100.3] - Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch [2026.2.92_v9.0.319-100.2] - Removing: emSign Root CS CA - G3 from Microsoft Code Signing certificates [2026.2.92_v9.0.319-100.1] - Removing: AAA Certificate Services…

Oct 23, 2026
Critical max 7.5

ELSA-2026-88354 3 CVEs

Critical: grafana-pcp security update (Oracle Linux 9)

[5.1.1-17.2] - Rebuild against updated golang - Resolves RHEL-287511 - Resolves RHEL-279381 - Resolves RHEL-278739

Oct 22, 2026
Critical max 9.4

ELSA-2026-86170 20 CVEs

Critical: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 8)

[9.0.122-1.0.1] - Add support for Oracle Linux [9.0.122-1] - Update to .NET SDK 9.0.122 and Runtime 9.0.21 - Resolves: RHEL-277797

Oct 21, 2026
Critical max 9.4

ELSA-2026-86594 21 CVEs

Critical: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 8)

[8.0.132-2.0.1] - Add support for Oracle Linux [8.0.132-2] - Fix apphost hash duplication under compiler optimizations on ppc64le - Resolves: RHEL-277790 [8.0.132-1] - Update to .NET SDK 8.0.132 and Runtime 8.0.32 - Resolves: RHEL-277790

Oct 21, 2026
Critical max 9.4

ELSA-2026-86171 20 CVEs

Critical: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 9)

[9.0.122-1.0.1] - Add support for Oracle Linux [9.0.122-1] - Update to .NET SDK 9.0.122 and Runtime 9.0.21 - Resolves: RHEL-277800

Oct 21, 2026
Critical max 9.4

ELSA-2026-86169 21 CVEs

Critical: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 9)

[8.0.132-1.0.1] - Add support for Oracle Linux [8.0.132-1] - Update to .NET SDK 8.0.132 and Runtime 8.0.32 - Resolves: RHEL-277793

Oct 21, 2026
Critical max 9.4

ELSA-2026-86193 22 CVEs

Critical: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 9)

[10.0.113-1.0.1] - Add support for Oracle Linux [10.0.113-1] - Update to .NET SDK 10.0.113 and Runtime 10.0.13 - Resolves: RHEL-277808

Oct 21, 2026
Critical max 9.4

ELSA-2026-86172 20 CVEs

Critical: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 10)

[9.0.122-1.0.1] - Add support for Oracle Linux [9.0.122-1] - Update to .NET SDK 9.0.122 and Runtime 9.0.21 - Resolves: RHEL-277801

Oct 21, 2026
Critical max 9.4

ELSA-2026-86195 22 CVEs

Critical: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 10)

[10.0.113-1.0.1] - Add support for Oracle Linux [10.0.113-1] - Update to .NET SDK 10.0.113 and Runtime 10.0.13 - Resolves: RHEL-277809

Oct 21, 2026
Critical max 9.4

ELSA-2026-86168 21 CVEs

Critical: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 10)

[8.0.132-1.0.1] - Add support for Oracle Linux [8.0.132-1] - Update to .NET SDK 8.0.132 and Runtime 8.0.32 - Resolves: RHEL-277794

Oct 21, 2026
Critical max 9.6

ELSA-2026-84584 11 CVEs

Critical: webkit2gtk3 security, bug fix, and enhancement update (Oracle Linux 8)

[2.54.1-1] - Update to 2.54.1 - Add patch to update ANGLE even further

Oct 19, 2026
Critical max 9.6

ELSA-2026-84583 11 CVEs

Critical: webkit2gtk3 security, bug fix, and enhancement update (Oracle Linux 9)

[2.54.1-1] - Update to 2.54.1 - Add patch to update ANGLE even further

Oct 19, 2026
Critical max 9.8

ELSA-2026-83460 8 CVEs

Critical: idm:DL1 security, bug fix, and enhancement update (Oracle Linux 8)

bind-dyndb-ldap [11.6-6] - Fix rpminspect warnings Resolves: RHEL-22497 custodia [0.6.0-3] - Require platform-python-setuptools instead of python3-setuptools - Resolves: rhbz#1650508 ipa [4.9.13-21.3.0.2] - Set IPAPLATFORM=rhel when build on Oracle Linux [Ora…

Oct 15, 2026
Critical max 9.1

ELSA-2026-80605 1 CVE

Critical: cjose security update (Oracle Linux 10)

[0.6.2.2-7.2] - Fix CVE-2026-53939 cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption Resolves: RHEL-276901

Oct 11, 2026
Critical max 9.6

ELSA-2026-74084 322 CVEs 1 exploited

Critical: webkit2gtk3 security update (Oracle Linux 8)

[2.54.0-1] - Update to 2.54.0

Oct 1, 2026
Critical max 9.3

ELSA-2026-73979 1 CVE

Critical: freerdp security update (Oracle Linux 10)

[2:3.10.3-12.13] - Abort after PROTOCOL_FAILED_NEGO (CVE-2026-91949) Resolves: RHEL-264913 [2:3.10.3-12.12] - Fix several regressions in CVE-2026-73241 Resolves: RHEL-257781

Sep 30, 2026
Critical max 9.8

ELSA-2026-72279 8 CVEs

Critical: ipa security, bug fix, and enhancement update (Oracle Linux 10)

[4.13.4-1.0.1] - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674] - Add bind to ipa-server-common Requires [Orabug: 36518596] [4.13.4-1] - Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval() reachable before authorization check…

Sep 28, 2026
Critical max 9.1

ELSA-2026-70754 3 CVEs

Critical: unbound security update (Oracle Linux 8)

[1.16.2-5.14.4] - Prevent heap corruption during CNAME synthesis (CVE-2026-82717) [1.16.2-5.14.3] - Prevent heap buffer overflow when digesting DNSKEY (CVE-2026-81642) - Prevent heap buffer overflow during DNSSEC canonicalization (CVE-2026-81634) - Add unit t…

Sep 24, 2026
Critical max 9.8

ELSA-2026-70564 8 CVEs

Critical: ipa security, bug fix, and enhancement update (Oracle Linux 9)

[4.13.4-1.0.1] - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674] - Add bind to ipa-server-common Requires [Orabug: 36518596] [4.13.4-1] - RHEL-218866 CVE-2026-18147 ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code …

Sep 24, 2026
Critical max 9.1

ELSA-2026-71487 3 CVEs

Critical: unbound security update (Oracle Linux 9)

[1.24.2-3.8] - Prevent heap corruption during CNAME synthesis (CVE-2026-82717) [1.24.2-3.7] - Prevent heap buffer overflow when digesting DNSKEY (CVE-2026-81642) - Prevent heap buffer overflow during DNSSEC canonicalization (CVE-2026-81634) - Add unit tests f…

Sep 24, 2026
Critical max 9.1

ELSA-2026-71419 3 CVEs

Critical: unbound security update (Oracle Linux 10)

[1.24.2-23] - Prevent heap corruption during CNAME synthesis (CVE-2026-82717) [1.24.2-22] - Prevent heap buffer overflow during DNSSEC canonicalization (CVE-2026-81634) [1.24.2-21] - Prevent heap buffer overflow when digesting DNSKEY (CVE-2026-81642) - Add un…

Sep 24, 2026
Critical max 9.8

ELSA-2026-49758 1 CVE

Critical: perl-GD security update (Oracle Linux 7)

[2.49-3.0.1] - Security update for CVE-2026-11526 [Orabug: 39825996]

Sep 3, 2026
Critical max 8.1

ELSA-2026-19159 1 CVE

Critical: nginx security update (Oracle Linux 10)

[1.26.3-6.0.1.el10_2.5] - Reference oracle-indexhtml within Requires [Orabug: 33802044] [2:1.26.3-6.5] - Resolves: RHEL-191778 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes - Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution …

Jul 21, 2026
Critical max 9.0

ELSA-2026-22963 6 CVEs

Critical: samba security update (Oracle Linux 10)

[0:4.23.5-109] - Bump build number [0:4.23.5-108] - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: …

Jul 16, 2026
Critical max 9.8

ELSA-2026-25191 7 CVEs

Critical: kernel security update (Oracle Linux 10)

[6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jul 16, 2026
Critical max 8.1

ELSA-2026-19372 1 CVE

Critical: nginx:1.26 security update (Oracle Linux 9)

[1.26.3-9.0.1] - Require oracle-indexhtml [2:1.26.3-9] - Resolves: RHEL-176218 - nginx:1.26/nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) [2:1.26.3-8] - CVE-2026-32647 nginx:1.26/nginx: NGINX: Denial of Service or Code Execution via sp…

Jun 24, 2026
Critical max 8.1

ELSA-2026-19374 1 CVE

Critical: nginx security update (Oracle Linux 9)

[1.20.1-28.0.1.el9_8.2] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] - Update upstream references [Orabug: 36579090] [2:1.20.1-28.2] - Resolves: RHEL-176232 - nginx: NGINX: Arbitrary Code Execu…

Jun 23, 2026
Critical max 8.1

ELSA-2026-19371 1 CVE

Critical: nginx:1.24 security update (Oracle Linux 9)

[1.24.0-7.1.0.1] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-7.1] - Resolves: RHEL-176234 - nginx:1.24/nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) [1:1.24.0…

Jun 23, 2026