Oracle Linux Security Advisories (ELSA)

206 results · Clear filters · Feed

• Critical max 9.0
  ELSA-2026-25049 6 CVEs

  Critical: samba security update (Oracle Linux 9)

  [0:4.23.5-10] - Bump build number [0:4.23.5-9] - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHE…

  Jun 23, 2026
• Critical max 9.8
  ELSA-2026-25121 13 CVEs

  Critical: kernel security update (Oracle Linux 8)

  [4.18.0-553.132.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  Jun 15, 2026
• Critical max 8.1
  ELSA-2026-18041 1 CVE

  Critical: nginx:1.24 security update (Oracle Linux 8)

  [1.24.0-3.0.1.1] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-3.1] - Resolves: RHEL-176224 - nginx:1.24/nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) [1:1.24.0-3] - Resolves: RHEL-157877 CVE-2026-32647 nginx:1.24/nginx: NGI…

  May 19, 2026
• Critical max 8.1
  ELSA-2026-18029 1 CVE

  Critical: nginx security update (Oracle Linux 9)

  [2:1.20.1-24.0.1.el9_7.3] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] - Update upstream references [Orabug: 36579090] [2:1.20.1-24.3] - Resolves: RHEL-176230 - nginx: NGINX: Arbitrary Code Exe…

  May 19, 2026
• Critical max 8.1
  ELSA-2026-18063 1 CVE

  Critical: nginx security update (Oracle Linux 10)

  [2:1.26.3-2.0.1.el10_1.2] - Reference oracle-indexhtml within Requires [Orabug: 33802044] [2:1.26.3-8] - Fix release number [2:1.26.3-7] - Resolves: RHEL-176217 - nginx: NGINX: Arbitrary Code [2:1.26.3-6] - Resolves: RHEL-157874 CVE-2026-32647 nginx: NGINX: D…

  May 19, 2026
• Critical max 9.8
  ELSA-2026-7383 1 CVE

  Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection (Oracle Linux 10)

  [344-3.0.1] - Storage: Enable btrfs support [Orabug: 37464632] - Replaced upstream urls in documentation with oracle links [Orabug: 36528753] - Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110] - Remove duplicate reference to server in c…

  Apr 14, 2026
• Critical max 9.8
  ELSA-2026-7384 1 CVE

  Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection (Oracle Linux 9)

  [344-2.0.1] - Storage: Enable btrfs support [Orabug: 37464632] - Replaced upstream urls in documentation with oracle links [Orabug: 36528753] - Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110] - Remove duplicate reference to server in c…

  Apr 10, 2026
• Critical max 9.4
  ELSA-2026-2224 1 CVE

  Critical: keylime security update (Oracle Linux 9)

  [7.12.1-11.4] - CVE-2026-1709: Registrar authentication bypass Resolves: RHEL-145390

  Feb 9, 2026
• Critical max 9.4
  ELSA-2026-2225 1 CVE

  Critical: keylime security update (Oracle Linux 10)

  [7.12.1-16] - CVE-2026-1709: Registrar authentication bypass [7.12.1-15] - Registrar allows identity takeover via duplicate UUID registration [7.12.1-14] - Properly fix malformed TPM certificates workaround [7.12.1-13] - Avoid opening /dev/stdout when printin…

  Feb 9, 2026
• Critical max 9.8
  ELSA-2025-21404 1 CVE

  Critical: lasso security update (Oracle Linux 7)

  [2.5.1-8.0.1] - Fixes CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso [Orabug: 38658691]

  Dec 10, 2025
• Critical max 9.8
  ELSA-2025-21462 1 CVE

  Critical: lasso security update (Oracle Linux 9)

  [ - 2.7.0-11.3] - Fix CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso Resolves: RHEL-126684

  Nov 25, 2025
• Critical max 9.8
  ELSA-2025-21628 1 CVE

  Critical: lasso security update (Oracle Linux 8)

  [2.6.0-14] - Fixing CVE-2025-47151 Resolves: RHEL-126687 CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso

  Nov 19, 2025
• Critical max 10.0
  ELSA-2025-20656 1 CVE

  Critical: redis security update (Oracle Linux 8)

  [6.2.9-1.0.2] - Fix for CVE-2025-49844 [Orabug: 38515582]

  Oct 8, 2025
• Critical max 9.8
  ELSA-2025-11747 9 CVEs

  Critical: firefox security update (Oracle Linux 8)

  [128.13.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] [128.13.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [128.13.0-1] - Update to 128.13.0 build1

  Jul 24, 2025
• Critical max 9.8
  ELSA-2025-11748 9 CVEs

  Critical: firefox security update (Oracle Linux 9)

  [128.13.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [128.13.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

  Jul 24, 2025
• Critical max 8.8
  ELSA-2024-1486 10 CVEs

  Critical: firefox security update (Oracle Linux 7)

  [115.9.1-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [115.9.1-1] - Update to 115.9.1 [115.9.0-2] - Update to 1…

  Mar 26, 2024
• Critical max 8.8
  ELSA-2024-1484 10 CVEs

  Critical: firefox security update (Oracle Linux 8)

  [115.9.1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding OpenELA file [115.9.1] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [115.9.1-1] - Update to 115.9.1 [115.9.0-2] - Update to 115.9.0 bui…

  Mar 26, 2024
• Critical max 8.8
  ELSA-2024-1485 10 CVEs

  Critical: firefox security update (Oracle Linux 9)

  [115.9.1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding OpenELA file [115.9.1] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [115.9.1-1] - Update to 115.9.1 [115.9.0-2] - Update to 115.9.0 bui…

  Mar 26, 2024
• Critical max 9.3
  ELSA-2023-7213 2 CVEs

  Critical: squid:4 security update (Oracle Linux 8)

  libecap squid [7:4.15-7.1] - Resolves: RHEL-14801 - squid: squid: Denial of Service in HTTP Digest Authentication - Resolves: RHEL-14776 - squid: squid: Request/Response smuggling in HTTP/1.1 and ICAP

  Nov 22, 2023
• Critical max 9.3
  ELSA-2023-6748 3 CVEs

  Critical: squid security update (Oracle Linux 9)

  [7:5.5-6.1] - Resolves: RHEL-14819 - squid: squid: denial of Servicein FTP - Resolves: RHEL-14807 - squid: squid: Denial of Service in HTTP Digest Authentication - Resolves: RHEL-14780 - squid: squid: Request/Response smuggling in HTTP/1.1 and ICAP [7:5.5-6] …

  Nov 16, 2023
• Critical max 8.6
  ELSA-2023-6805 1 CVE

  Critical: squid security update (Oracle Linux 7)

  [7:3.5.20-17.0.1] - Mutiple CVE fixes for squid [Orabug: 33146289] - Resolves: CVE-2021-28651 squid: Bug 5104: Memory leak in RFC 2169 response parsing (#778) - Resolves: CVE-2021-28652 squid: Bug 5106: Broken cache manager URL parsing (#788) - Resolves: CVE-…

  Nov 8, 2023
• Critical max 9.3
  ELSA-2023-6267 2 CVEs

  Critical: squid:4 security update (Oracle Linux 8)

  libecap squid [4.15-6.0.1] - Improve HTTP chunked encoding compliance (CVE-2023-46846) - Fix stack buffer overflow when parsing Digest Authorization (CVE-2023-46847)

  Nov 7, 2023
• Critical max 9.3
  ELSA-2023-6266 3 CVEs

  Critical: squid security update (Oracle Linux 9)

  [7:5.5-5.el9_2.1] - Improve HTTP chunked encoding compliance (CVE-2023-46846) - Fix stack buffer overflow when parsing Digest Authorization (CVE-2023-46847) - Fix userinfo percent-encoding (CVE-2023-46848)

  Nov 3, 2023
• Critical max 9.8
  ELSA-2023-12711 1 CVE

  Critical: openssh security update (Oracle Linux 7)

  [7.4p1-23.0.1_fips] - Change Epoch from 1 to 10 - Enable fips KDF POST [Orabug: 32461750] - Disable diffie-hellman-group-exchange-sha256 KEX FIPS method [Orabug: 32461739] [7.4p1-23.0.1] - enlarge format buffer size for certificate serial number so the log me…

  Aug 10, 2023
• Critical
  ELSA-2023-12689 1 CVE

  Critical: linux-firmware security update (Oracle Linux 7)

  [20230516-999.22.git6c9e0ed5.el7] - remove amd-ucode/README (Orabug: 35645306) - Resolves 'Zenbleed' (Orabug: 35650345) {CVE-2023-20593}

  Jul 31, 2023
• Critical
  ELSA-2023-12690 1 CVE

  Critical: linux-firmware security update (Oracle Linux 7)

  [20230516-999.22.git6c9e0ed5.el7] - remove amd-ucode/README (Orabug: 35645306) - Resolves 'Zenbleed' (Orabug: 35650345) {CVE-2023-20593}

  Jul 31, 2023
• Critical
  ELSA-2023-12691 1 CVE

  Critical: linux-firmware security update (Oracle Linux 8)

  [20230516-999.22.git6c9e0ed5.el8] - remove amd-ucode/README (Orabug: 35645306) - Resolves 'Zenbleed' (Orabug: 35650345) {CVE-2023-20593}

  Jul 31, 2023
• Critical
  ELSA-2023-12692 1 CVE

  Critical: linux-firmware security update (Oracle Linux 9)

  [20230516-999.23.git6c9e0ed5.el9] - Firmware files need to be uncompressed for early kernel load to work - Resolves 'Zenbleed' (Orabug: 35650345) {CVE-2023-20593} [20230516-999.22.git6c9e0ed5.el9] - Move the README removal, it needs to happen during build (Or…

  Jul 31, 2023
• Critical
  ELSA-2023-12654 1 CVE

  Critical: linux-firmware security update (Oracle Linux 7)

  [20230516-999.20.git6c9e0ed5.el7] - cd72938cb480 linux-firmware: Update AMD fam17h cpu microcode - 92624e57af69 linux-firmware: Update AMD cpu microcode

  Jul 26, 2023
• Critical
  ELSA-2023-12657 1 CVE

  Critical: linux-firmware security update (Oracle Linux 7)

  [20230516-999.20.git6c9e0ed5.el7] - cd72938cb480 linux-firmware: Update AMD fam17h cpu microcode - 92624e57af69 linux-firmware: Update AMD cpu microcode [20230516-999.19.git6c9e0ed5.el7] - Rebase to upstream - Revert removal of old iwlwifi firmwares (Orabug: …

  Jul 26, 2023
• Critical
  ELSA-2023-12655 1 CVE

  Critical: linux-firmware security update (Oracle Linux 8)

  [20230516-999.20.git6c9e0ed5.el8] - cd72938cb480 linux-firmware: Update AMD fam17h cpu microcode - 92624e57af69 linux-firmware: Update AMD cpu microcode [20230516-999.19.git6c9e0ed5.el8] - Rebase to upstream - Revert removal of old iwlwifi firmwares (Orabug: …

  Jul 26, 2023
• Critical
  ELSA-2023-12656 1 CVE

  Critical: linux-firmware security update (Oracle Linux 9)

  [20230516-999.20.git6c9e0ed5.el9] - cd72938cb480 linux-firmware: Update AMD fam17h cpu microcode - 92624e57af69 linux-firmware: Update AMD cpu microcode [20230516-999.19.git6c9e0ed5.el9] - Rebase to upstream - Revert removal of old iwlwifi firmwares (Orabug: …

  Jul 26, 2023
• Critical max 9.4
  ELSA-2023-4030 1 CVE

  Critical: grafana security update (Oracle Linux 9)

  [9.0.9-3] - resolve CVE-2023-3128 grafana: Remove Email Lookup from oauth integrations (rhbz#2213701 rhbz#2213626)

  Jul 19, 2023
• Critical max 9.8
  ELSA-2023-3923 4 CVEs

  Critical: go-toolset and golang security update (Oracle Linux 9)

  golang [1.19.10-1.0.1] - New Go version 1.19.10 [CVE-2023-29402] [CVE-2023-29403] [CVE-2023-29404] [CVE-2023-29405] go-toolset [1.19.10-1.0.1] - New Go version 1.19.10 [CVE-2023-29402] [CVE-2023-29403] [CVE-2023-29404] [CVE-2023-29405]

  Jul 7, 2023
• Critical max 9.8
  ELSA-2023-3922 4 CVEs

  Critical: go-toolset:ol8 security update (Oracle Linux 8)

  delve [1.9.1-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.9.1-1] - Rebase to 1.9.1 - Related: rhbz#2131026 golang [1.19.10-1.0.1] - New Go version 1.19.10 [CVE-2023-29402] [CVE-2023-29403] [CVE-2023-29404] [CVE-2023-29405] go-toolse…

  Jul 4, 2023
• Critical max 8.8
  ELSA-2022-4772 2 CVEs

  Critical: thunderbird security update (Oracle Linux 9)

  [91.9.1-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Reference oracle-indexhtml within Requires [Orabug: 33802044] [91.9.1-1] - Update to 91.9.1 build1

  Jun 30, 2022
• Critical max 8.8
  ELSA-2022-4765 2 CVEs

  Critical: firefox security update (Oracle Linux 9)

  [91.9.1-1.0.1] - Replaced upstream package with oracle-indexhtml [Orabug: 33802044] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Removed Upstream references [91.9.1-1] - Update to 91.9.1 build1

  Jun 30, 2022
• Critical max 8.8
  ELSA-2022-4776 2 CVEs

  Critical: firefox security update (Oracle Linux 8)

  [91.9.1-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.9.1-1] - Update to 91.9.1 build1

  May 30, 2022
• Critical max 8.8
  ELSA-2022-4769 2 CVEs

  Critical: thunderbird security update (Oracle Linux 8)

  [91.9.1-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.9.1-1] - Update to 91.9.1 build1

  May 30, 2022
• Critical max 8.8
  ELSA-2022-4729 2 CVEs

  Critical: firefox security update (Oracle Linux 7)

  [91.9.1-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Enabled aarch64 build [91.9.1-1] - Update to 91.9.1 buil…

  May 25, 2022