Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

367 results · Clear filters · Feed

Medium max 7.5

ELSA-2023-5712 1 CVE 1 exploited

Moderate: nginx:1.20 security update (Oracle Linux 8)

[1:1.20.1-1.0.1.1] - Resolves: RHEL-12732 - nginx:1.20/nginx: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

Oct 17, 2023
Medium max 7.5

ELSA-2023-5713 1 CVE 1 exploited

Moderate: nginx:1.22 security update (Oracle Linux 8)

[1:1.22.1-1.0.1.1] - Resolves: RHEL-12728 - nginx:1.22/nginx: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)(CVE-2023-44487)

Oct 17, 2023
Medium max 7.5

ELSA-2023-5711 1 CVE 1 exploited

Moderate: nginx security update (Oracle Linux 9)

[1:1.20.1-14.0.1.1] - Resolves: RHEL-12518 - nginx: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

Oct 17, 2023
High max 9.8

ELSA-2023-5477 5 CVEs 1 exploited

Important: firefox security update (Oracle Linux 7)

[115.3.1-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [115.3.1-1] - Update to 115.3.1 [115.3.0-1] - Update to 1…

Oct 13, 2023
High max 9.8

ELSA-2023-5475 5 CVEs 1 exploited

Important: thunderbird security update (Oracle Linux 7)

[115.3.1-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [115.3.1-1] - Update to 115.3.1 build1 [115.3.0-1] - Update to 115.3.0 [115.2.1-5] - Update to 115.2.1

Oct 13, 2023
High max 8.8

ELSA-2023-5539 2 CVEs 1 exploited

Important: libvpx security update (Oracle Linux 9)

[1.9.0-7] - Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217) Resolves: rhbz#2241191 - crash related to VP9 encoding in libvpx (CVE-2023-44488) Resolves: rhbz#2241806

Oct 11, 2023
High max 8.8

ELSA-2023-5537 2 CVEs 1 exploited

Important: libvpx security update (Oracle Linux 8)

[1.7.0-10] - Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217) Resolves: rhbz#2241191 - crash related to VP9 encoding in libvpx (CVE-2023-44488) Resolves: rhbz#2241806

Oct 10, 2023
High max 7.8

ELSA-2023-5453 4 CVEs 1 exploited

Important: glibc security update (Oracle Linux 9)

[2.34-60.0.3.7] - CVE-2023-4527: Stack read overflow in getaddrinfo in no-aaa mode (#2234716). - CVE-2203-4806: potential use-after-free in getaddrinfo. - CVE-2023-4813: potential use-after-free in gaih_inet. Reviewed by: Jose E. Marchesi <jose.marchesi@oracl…

Oct 10, 2023
High max 9.8

ELSA-2023-5433 5 CVEs 1 exploited

Important: firefox security update (Oracle Linux 8)

[115.3.1-1.0.1] - Update to 115.3.1

Oct 6, 2023
High max 9.8

ELSA-2023-5428 5 CVEs 1 exploited

Important: thunderbird security update (Oracle Linux 8)

[115.3.1-1.0.1] - Update to 115.3.1 build1

Oct 6, 2023
High max 7.8

ELSA-2023-12851 1 CVE 1 exploited

Important: glibc security update (Oracle Linux 8)

[2.28-225.0.4] - CVE-2023-4911: tunables: Terminate immediately if end of input is reached Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>

Oct 5, 2023
High max 9.8

ELSA-2023-5434 5 CVEs 1 exploited

Important: firefox security update (Oracle Linux 9)

[115.3.1-1.0.1] - Update to 115.3.1

Oct 5, 2023
High max 7.8

ELSA-2023-12850 1 CVE 1 exploited

Important: glibc security update (Oracle Linux 9)

[2.34-60.0.3] - CVE-2023-4911: tunables: Terminate immediately if end of input is reached Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>

Oct 5, 2023
High max 9.8

ELSA-2023-5435 5 CVEs 1 exploited

Important: thunderbird security update (Oracle Linux 9)

[115.3.1-1.0.1] - Update to 115.3.1 build1

Oct 5, 2023
High max 8.8

ELSA-2023-5309 1 CVE 1 exploited

Important: libwebp security update (Oracle Linux 8)

[1.0.0-8.1] - Added fix for CVE-2023-4863

Sep 20, 2023
High max 8.8

ELSA-2023-5191 1 CVE 1 exploited

Important: thunderbird security update (Oracle Linux 7)

[102.15.1-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [102.15.1-1] - Update to 102.15.1

Sep 19, 2023
High max 8.8

ELSA-2023-5197 1 CVE 1 exploited

Important: firefox security update (Oracle Linux 7)

[102.15.1-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [102.15.1-1] - Update to 102.15.1

Sep 19, 2023
High max 8.8

ELSA-2023-5201 1 CVE 1 exploited

Important: thunderbird security update (Oracle Linux 8)

[102.15.1-1.0.1] - Update to 102.15.1

Sep 19, 2023
High max 8.8

ELSA-2023-5184 1 CVE 1 exploited

Important: firefox security update (Oracle Linux 8)

[102.15.1-1.0.1] - Update to 102.15.1 build2

Sep 19, 2023
High max 8.8

ELSA-2023-5224 1 CVE 1 exploited

Important: thunderbird security update (Oracle Linux 9)

[102.15.1-1.0.1] - Update to 102.15.1

Sep 19, 2023
High max 8.8

ELSA-2023-5214 1 CVE 1 exploited

Important: libwebp security update (Oracle Linux 9)

[1.2.0-7] - Added fix for CVE-2023-4863

Sep 19, 2023
High max 8.8

ELSA-2023-5200 1 CVE 1 exploited

Important: firefox security update (Oracle Linux 9)

[102.15.1-1.0.1] - Update to 102.15.1 build2

Sep 19, 2023
High max 7.8

ELSA-2023-4644 2 CVEs 1 exploited

Important: .NET 6.0 security, bug fix, and enhancement update (Oracle Linux 9)

[6.0.121-1.0.1] - Update to .NET SDK 6.0.121 and Runtime 6.0.21 - Resolves: RHBZ#2228567

Aug 16, 2023
High max 7.8

ELSA-2023-4642 2 CVEs 1 exploited

Important: .NET 7.0 security, bug fix, and enhancement update (Oracle Linux 9)

[7.0.110-1.0.1] - Update to .NET SDK 7.0.110 and Runtime 7.0.10 - Resolves: RHBZ#2228571

Aug 16, 2023
High max 7.8

ELSA-2023-4645 2 CVEs 1 exploited

Important: .NET 6.0 security, bug fix, and enhancement update (Oracle Linux 8)

[6.0.121-1.0.1] - Update to .NET SDK 6.0.121 and Runtime 6.0.21 - Resolves: RHBZ#2228567

Aug 15, 2023
High max 7.8

ELSA-2023-4643 2 CVEs 1 exploited

Important: .NET 7.0 security, bug fix, and enhancement update (Oracle Linux 8)

[7.0.110-1.0.1] - Update to .NET SDK 7.0.110 and Runtime 7.0.10 - Resolves: RHBZ#2228571

Aug 15, 2023
High max 8.8

ELSA-2023-4202 2 CVEs 2 exploited

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.38.5-1.5] - Disable JIT (CVE-2023-32435, CVE-2023-32439)

Jul 20, 2023
High max 8.8

ELSA-2023-4201 2 CVEs 2 exploited

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.38.5-1.3] - Disable JIT (CVE-2023-32435, CVE-2023-32439)

Jul 20, 2023
Low max 3.9

ELSA-2023-3949 1 CVE 1 exploited

Low: open-vm-tools security update (Oracle Linux 8)

[12.1.5-1.0.2] - [CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module

Jul 7, 2023
Low max 3.9

ELSA-2023-3948 1 CVE 1 exploited

Low: open-vm-tools security update (Oracle Linux 9)

[12.1.5-1.0.2] - [CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module

Jul 7, 2023
Low max 3.9

ELSA-2023-3944 1 CVE 1 exploited

Low: open-vm-tools security and bug fix update (Oracle Linux 7)

[11.0.5-3.0.1] - fix spaces in vmware udev rule for scsi devices [Orabug: 24461968] - Fix vmware udev rule in 99-vmware-scsi-timeout.rules file. [Orabug: 22815019] - Increase timeout for scsi devices on VMWare guests by adding a udev rule. - Created a new fil…

Jun 30, 2023
High max 8.8

ELSA-2023-3433 2 CVEs 2 exploited

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.38.5-1.4] - Add patch for CVE-2023-28204 Resolves: #2209744 - Add patch for CVE-2023-32373 Resolves: #2209727

Jun 6, 2023
High max 8.8

ELSA-2023-3432 2 CVEs 2 exploited

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.38.5-1.2] - Add patch for CVE-2023-28204 Resolves: #2209747 - Add patch for CVE-2023-32373 Resolves: #2209730

Jun 6, 2023
High max 8.8

ELSA-2023-1919 1 CVE 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.36.7-1.3] - Add patch for CVE-2023-28205 Resolves: #2185740

Apr 20, 2023
High max 8.8

ELSA-2023-1918 1 CVE 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.36.7-1.3] - Add patch for CVE-2023-28205 Resolves: #2185744

Apr 20, 2023
High max 7.8

ELSA-2023-1703 1 CVE 1 exploited

Important: kernel security and bug fix update (Oracle Linux 9)

- [5.14.0-162.23.1_1.OL9] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.g…

Apr 12, 2023
High max 7.9

ELSA-2023-1566 4 CVEs 2 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-425.19.2_7.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

Apr 5, 2023
High max 7.9

ELSA-2023-1470 3 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

- [5.14.0-162.22.2_1.OL9] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.g…

Mar 28, 2023
High max 7.9

ELSA-2023-12206 13 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.317.5.3] - udf: Fix file corruption when appending just after end of preallocated extent (Jan Kara) [Orabug: 35192150] - selftests/ftrace: Fix bash specific '==' operator (Masami Hiramatsu (Google)) [Orabug: 35192150] - net: Fix unwanted sign ext…

Mar 21, 2023
High max 7.9

ELSA-2023-12196 8 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-8.91.4.1] - uek-rpm: Add opbmc to core rpm (Somasundaram Krishnasamy) [Orabug: 35157130] [5.15.0-8.91.4] - selftests/vm: remove ARRAY_SIZE define from individual tests (Shuah Khan) [Orabug: 35088471] - selftests: Provide local define of __cpuid_count(…

Mar 16, 2023