Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

367 results · Clear filters · Feed

High max 9.8

ELSA-2025-20719 10 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-104.43.4.3] - io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38572958] {CVE-2025-39698} - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38572953] {CVE-2025-39866} - kernfs: …

Oct 24, 2025
High max 9.8

ELSA-2025-20662 102 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-104.43.4.2.el10uek] - Revert 'sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails' (Joseph Salisbury) [Orabug: 38517178] [6.12.0-104.43.4.1.el10uek] - io_uring: Hide kabi magic from user space (Sherry Yang) [Orabug: 38478874] [6.12.0-1…

Oct 14, 2025
High max 7.8

ELSA-2025-17509 1 CVE 1 exploited

Important: open-vm-tools security update (Oracle Linux 8)

[12.3.5-2.0.1.el8.1] - Fix spaces in vmware udev rule for scsi devices [Orabug: 24461968] - Fix vmware udev rule in 99-vmware-scsi-timeout.rules file. [Orabug: 22815019] - Increase timeout for scsi devices on VMWare guests by adding a udev rule. [Orabug: 2181…

Oct 7, 2025
High max 7.8

ELSA-2025-17428 1 CVE 1 exploited

Important: open-vm-tools security update (Oracle Linux 9)

[12.5.0-1.0.1.2] - Fix spaces in vmware udev rule for scsi devices [Orabug: 24461968] - Fix vmware udev rule in 99-vmware-scsi-timeout.rules file. [Orabug: 22815019] - Increase timeout for scsi devices on VMWare guests by adding a udev rule. [Orabug: 21819156…

Oct 7, 2025
High max 7.8

ELSA-2025-17429 1 CVE 1 exploited

Important: open-vm-tools security update (Oracle Linux 10)

[12.5.0-1.0.1.el10_0.1] - Fix spaces in vmware udev rule for scsi devices [Orabug: 24461968] - Fix vmware udev rule in 99-vmware-scsi-timeout.rules file. [Orabug: 22815019] - Increase timeout for scsi devices on VMWare guests by adding a udev rule. [Orabug: 2…

Oct 7, 2025
Medium max 9.8

ELSA-2025-16904 6 CVEs 1 exploited

Moderate: kernel security update (Oracle Linux 10)

[6.12.0-55.37.1.0.1] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Di…

Oct 1, 2025
Medium max 9.8

ELSA-2025-16880 5 CVEs 1 exploited

Moderate: kernel security update (Oracle Linux 9)

[5.14.0-570.49.1.0.1_6.OL9] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Sep 29, 2025
High max 7.8

ELSA-2025-15648 2 CVEs 1 exploited

Important: kernel security update (Oracle Linux 7)

[3.10.0-1160.119.1.0.12] - scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332) [Orabug: 38414589] - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352) [Orabug: 38414589]

Sep 25, 2025
High max 9.8

ELSA-2025-20608 6 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-103.40.4.3] - x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38453836] {CVE-2025-38560} - xfrm: interface: fix use-after-free after changing collect_md xfrm interface (Eyal Birger) [Orabug: 38453837] {CVE-2025-38500} -…

Sep 22, 2025
High max 7.8

ELSA-2025-15661 4 CVEs 1 exploited

Important: kernel security update (Oracle Linux 9)

[5.14.0-570.42.2.0.1_6.OL9] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Sep 12, 2025
High max 7.8

ELSA-2025-15662 1 CVE 1 exploited

Important: kernel security update (Oracle Linux 10)

[6.12.0-55.32.1.0.1] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Di…

Sep 12, 2025
High max 7.8

ELSA-2025-15471 2 CVEs 1 exploited

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.74.1_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.ge…

Sep 9, 2025
High max 9.8

ELSA-2025-20553 47 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.347.6] - net_sched: sch_sfq: move the limit validation (Octavian Purdila) [Orabug: 38377926] {CVE-2025-37752} - net_sched: sch_sfq: use a temporary work area for validating configuration (Octavian Purdila) [Orabug: 38377926] - net_sched: sch_sfq:…

Sep 9, 2025
High max 9.8

ELSA-2025-20552 117 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-312.187.5] - Revert 'mm: hugetlb: independent PMD page table shared count' (Harshit Mogalapalli) [Orabug: 38327655] [5.15.0-312.187.4] - rds: Fix NULL ptr deref in xas_start (Hakon Bugge) [Orabug: 38166374] - KVM: x86: use array_index_nospec with indi…

Sep 8, 2025
High max 9.8

ELSA-2025-20551 268 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-103.40.4.1.el10uek] - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38361037] [6.12.0-103.40.4.el10uek] - rds: Fix NULL ptr deref in xas_start (Hakon Bugge) [Orabug: 38169301] - KVM: x86: use array_index_nospec w…

Sep 8, 2025
High max 10.0

ELSA-2025-20530 1345 CVEs 3 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-102.36.5.2] - iommu/vt-d: Fix misplaced domain_attached assignment (Ban ZuoXiang) [Orabug: 38294635] [6.12.0-102.36.5.1] - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [Orabug: 38217337] [6.12.0-102.36.5] - uek-…

Aug 18, 2025
High max 8.8

ELSA-2025-13780 9 CVEs 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.48.5-1] - Update to 2.48.5

Aug 13, 2025
High max 8.8

ELSA-2025-13782 9 CVEs 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.48.5-1] - Update to 2.48.5

Aug 13, 2025
High max 8.1

ELSA-2025-11688 1 CVE 1 exploited

Important: git security update (Oracle Linux 7)

[1.8.3.1-25.0.1] - Fixed CVE-2025-48384 [Orabug: 38234220 ]

Aug 12, 2025
High max 8.6

ELSA-2025-11534 7 CVEs 1 exploited

Important: git security update (Oracle Linux 8)

[2.43.7-1] - update to 2.43.7 - Resolves: RHEL-102440, RHEL-102454, RHEL-102674, RHEL-102680

Jul 22, 2025
High max 8.6

ELSA-2025-11533 7 CVEs 1 exploited

Important: git security update (Oracle Linux 10)

[2.47.3-1] - update to 2.47.3 - Resolves: RHEL-102437, RHEL-102451, RHEL-102673, RHEL-102679

Jul 22, 2025
High max 9.3

ELSA-2025-11537 2 CVEs 1 exploited

Important: sudo security update (Oracle Linux 10)

[1.9.15-8.p5.2] - RHEL 10.1 ERRATUM - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100009 - CVE-2025-32463 sudo: LPE via chroot option Resolves: RHEL-100022

Jul 22, 2025
High max 8.6

ELSA-2025-11462 7 CVEs 1 exploited

Important: git security update (Oracle Linux 9)

[2.47.3-1] - update to 2.47.3 - Resolves: RHEL-102449, RHEL-102463, RHEL-102675, RHEL-102681

Jul 21, 2025
High max 10.0

ELSA-2025-20480 1345 CVEs 3 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-101.33.4.3.el10uek] - Revert 'Add normal counters' (Boris Ostrovsky) [Orabug: 38171405] [6.12.0-101.33.4.2.el10uek] - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38178286] {CVE-2025-38089} - mm: memcontro…

Jul 17, 2025
High max 7.8

ELSA-2025-8137 2 CVEs 1 exploited

Important: kernel security update (Oracle Linux 10)

[6.12.0-55.19.1.0.1_0.OL10] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyon…

Jul 3, 2025
Medium max 10.0

ELSA-2025-7494 1 CVE 1 exploited

Moderate: tomcat9 security update (Oracle Linux 10)

[1:9.0.87-5] - Resolves: RHEL-82927 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

Jun 27, 2025
Medium max 10.0

ELSA-2025-7497 3 CVEs 1 exploited

Moderate: tomcat security update (Oracle Linux 10)

[1:10.1.36-1] - Rebase tomcat to 10.1.36 - Resolves: RHEL-82925 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) - Resolves: RHEL-87272 tomcat: DoS in examples web application (CVE-2024-54677)…

Jun 27, 2025
High max 9.0

ELSA-2025-8292 10 CVEs 1 exploited

Important: mingw-freetype and spice-client-win security update (Oracle Linux 8)

[2.8-3.1] - Fix CVE-2025-27363 Resolves: RHEL-83101

Jun 2, 2025
Medium max 7.1

ELSA-2025-3937 1 CVE 1 exploited

Moderate: kernel security update (Oracle Linux 9)

- [5.14.0-503.38.1_5.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_ke…

Apr 17, 2025
Medium max 7.1

ELSA-2025-3893 2 CVEs 1 exploited

Moderate: kernel security update (Oracle Linux 8)

[4.18.0-553.50.1_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.ge…

Apr 15, 2025
High max 8.1

ELSA-2025-3395 1 CVE 1 exploited

Important: freetype security update (Oracle Linux 7)

[2.8-14.0.1.el7_9.1] - Fix CVE-2025-27363 Out-of-bounds Write [Orabug: 37770275][CVE-2025-27363]

Apr 11, 2025
Medium max 10.0

ELSA-2025-3683 2 CVEs 1 exploited

Moderate: tomcat security update (Oracle Linux 8)

[1:9.0.87-1.el8_10.3] - Resolves: RHEL-82934 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) - Resolves: RHEL-71708 tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)

Apr 8, 2025
Medium max 10.0

ELSA-2025-3645 2 CVEs 1 exploited

Moderate: tomcat security update (Oracle Linux 9)

[1:9.0.87-2.el9_5.1] - Resolves: RHEL-82946 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) - Resolves: RHEL-71719 tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)

Apr 7, 2025
High max 8.1

ELSA-2025-3421 1 CVE 1 exploited

Important: freetype security update (Oracle Linux 8)

[2.9.1-10] - Fix CVE-2025-27363 Out-of-bounds Write - Resolves: RHEL-83094

Mar 31, 2025
High max 8.1

ELSA-2025-3407 1 CVE 1 exploited

Important: freetype security update (Oracle Linux 9)

[2.10.4-10] - Fix for CVE-2025-27363 out-of-bound write vulnerability - Patch initially by Marc Deslauriers of Canonical - https://www.openwall.com/lists/oss-security/2025/03/14/3 - Adjusted for EL9 by Jonathan Wright of AlmaLinux - and a member of the Meta s…

Mar 31, 2025
High max 7.8

ELSA-2025-2501 3 CVEs 2 exploited

Important: kernel security update (Oracle Linux 7)

[3.10.0-1160.119.1.0.7] - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Beno_t Sevens) {CVE-2024-53197} [Orabug: 37686305] - can: bcm: Fix UAF in bcm_proc_show() (YueHaibing) {CVE-2023-52922} [Orabug: 37686305] - HID: core:…

Mar 28, 2025
High max 10.0

ELSA-2025-2863 1 CVE 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.46.6-2] - Add patch for CVE-2025-24201

Mar 17, 2025
High max 10.0

ELSA-2025-2864 1 CVE 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.46.6-2] - Add patch for CVE-2025-24201

Mar 17, 2025
High max 7.8

ELSA-2025-1281 1 CVE 1 exploited

Important: kernel security update (Oracle Linux 7)

[3.10.0-1160.119.1.0.6.el7.OL7] - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Benoit Sevens) {CVE-2024-53104} [Orabug: 37584712]

Mar 13, 2025
Medium max 6.9

ELSA-2025-1601 1 CVE 1 exploited

Moderate: gcc security update (Oracle Linux 7)

[4.8.5-45.0.1] - [Orabug: 37603707] ELSA-2025-1601 Moderate: gcc security update CVE-2020-11023 rebuild for CVE-2020-11023 - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> [4.8.5-44.0.5] - fix arm cross building inline issue. gcc48-cfns-fix-protos.p…

Mar 12, 2025