Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

367 results · Clear filters · Feed

High max 7.8

ELSA-2022-9141 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.302.7.2.3] - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33832574] {CVE-2022-0492}

Feb 9, 2022
High max 7.8

ELSA-2022-9088 6 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.60.1] - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) [Orabug: 33699627] [Orabug: 33762471] {CVE-2021-4155} - fix regression in 'epoll: Keep a reference on files added to the check list' (Al Viro) [Orabu…

Feb 1, 2022
High max 7.8

ELSA-2022-0274 1 CVE 1 exploited

Important: polkit security update (Oracle Linux 7)

[0.112-26.0.1] - Increase timeout to avoid defunct processes [Orabug: 26930744] [0.112-26.1] - pkexec: argv overflow results in local privilege esc. - Resolves: CVE-2021-4034

Jan 25, 2022
High max 7.8

ELSA-2022-0267 1 CVE 1 exploited

Important: polkit security update (Oracle Linux 8)

[0.115-13.0.1] - Increase timeout to avoid defunct processes [Orabug: 26930744] [0.115-13.el8_5.1] - pkexec: argv overflow results in local privilege esc. - Resolves: CVE-2021-4034

Jan 25, 2022
High max 8.4

ELSA-2022-0188 2 CVEs 1 exploited

Important: kernel security and bug fix update (Oracle Linux 8)

[4.18.0-348.12.2_5.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

Jan 21, 2022
High max 8.4

ELSA-2022-9028 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.302.7.2.1] - vfs: fs_context: fix up param length parsing in legacy_parse_param (Jamie Hill-Daniel) [Orabug: 33761451] {CVE-2022-0185}

Jan 19, 2022
High max 8.4

ELSA-2022-9029 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.302.7.2.1] - vfs: fs_context: fix up param length parsing in legacy_parse_param (Jamie Hill-Daniel) [Orabug: 33761451] {CVE-2022-0185}

Jan 19, 2022
Medium max 8.8

ELSA-2022-0059 1 CVE 1 exploited

Moderate: webkitgtk4 security update (Oracle Linux 7)

[2.28.2-3] - Fix CVE-2021-30858 - Resolves: #2006421

Jan 12, 2022
High max 6.4

ELSA-2022-9011 2 CVEs 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.510.5.2] - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) [Orabug: 33722441] {CVE-2021-4155} [4.14.35-2047.510.5.1] - fget: check that the fd still exists after getting a ref to it (Linus Torvalds) [Ora…

Jan 10, 2022
High max 6.4

ELSA-2022-9010 2 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.510.5.2.el7uek] - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) [Orabug: 33722441] {CVE-2021-4155} [4.14.35-2047.510.5.1.el7uek] - fget: check that the fd still exists after getting a ref to it (Linus …

Jan 10, 2022
High max 7.8

ELSA-2022-9014 3 CVEs 2 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.59.1.2] - fix regression in 'epoll: Keep a reference on files added to the check list' (Al Viro) [Orabug: 33679854] {CVE-2021-1048} - fget: check that the fd still exists after getting a ref to it (Linus Torvalds) [Orabug: 33679806] {CVE-2021-0920…

Jan 10, 2022
High max 6.4

ELSA-2022-9012 2 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.302.7.2] - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) [Orabug: 33699625] {CVE-2021-4155} [5.4.17-2136.302.7.1] - fget: check that the fd still exists after getting a ref to it (Linus Torvalds) [Orabu…

Jan 10, 2022
High max 6.4

ELSA-2022-9013 2 CVEs 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.302.7.2] - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) [Orabug: 33699625] {CVE-2021-4155} [5.4.17-2136.302.7.1] - fget: check that the fd still exists after getting a ref to it (Linus Torvalds) [Orabu…

Jan 10, 2022
Low max 6.9

ELSA-2021-9552 2 CVEs 1 exploited

Low: pcs security update (Oracle Linux 8)

[0.10.10-4.0.1] - Replace HAM-logo.png with a generic one [0.10.10-4] - Fixed unfencing in - Resolves: rhbz#bz1991654 [0.10.10-3] - Added add/remove syntax for command - Resolves: rhbz#1992668 [0.10.10-2] - Fixed create resources with depth operation attribut…

Nov 19, 2021
Medium max 9.8

ELSA-2021-4381 29 CVEs 5 exploited

Moderate: GNOME security, bug fix, and enhancement update (Oracle Linux 8)

accountsservice [0.6.55-2] - Add support for user templates so user can specify default session Resolves: #1812788 gdm [40.0-14] - Fix XDMCP Resolves: #2004170 - Fix crash at shutdown Related: #2004170 [40.0-13] - Disable Wayland on HyperV - Fix Xorg fallback…

Nov 16, 2021
Medium max 8.8

ELSA-2021-4097 1 CVE 1 exploited

Moderate: webkit2gtk3 security and bug fix update (Oracle Linux 8)

[2.30.4-3] - Fix crashing on aarch64 - Resolves: #2010825 [2.30.4-2] - Fix CVE-2021-30858 - Resolves: #2006427

Nov 2, 2021
High max 8.5

ELSA-2021-3956 14 CVEs 1 exploited

Important: xstream security update (Oracle Linux 7)

[1.3.1-16] - Fix workaround - Resolves: CVE-2021-39148 [1.3.1-15] - Fix remote code execution vulnerabilities - Resolves: CVE-2021-39139 - Resolves: CVE-2021-39140 - Resolves: CVE-2021-39141 - Resolves: CVE-2021-39144 - Resolves: CVE-2021-39145 - Resolves: CV…

Oct 25, 2021
High max 9.0

ELSA-2021-3856 1 CVE 1 exploited

Important: httpd security update (Oracle Linux 7)

[2.4.6-97.0.1.1] - replace index.html with Oracle's index page oracle_index.html [2.4.6-97.1] - Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted request uri-path containing 'unix:'

Oct 14, 2021
High max 9.0

ELSA-2021-3816 2 CVEs 1 exploited

Important: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-39.1.0.1.1] - Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-39.1] - Resolves: #2007234 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via a crafted request ur…

Oct 13, 2021
High max 9.8

ELSA-2021-3771 1 CVE 1 exploited

Important: grafana security update (Oracle Linux 8)

[7.3.6-3] - resolve CVE-2021-39226 - resolve CVE-2021-27358

Oct 12, 2021
High max 8.3

ELSA-2021-3327 5 CVEs 1 exploited

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1160.41.1.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and…

Aug 31, 2021
High max 8.7

ELSA-2021-3057 3 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-305.12.1_4.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

Aug 11, 2021
High max 6.9

ELSA-2021-9400 1 CVE 1 exploited

Important: bootstrap security update (Oracle Linux 7)

[3.0.0-7.0.1] - Backport jQuery CVE-2020-11023 fixes from jQuery v3.5.0 to bundled v1.10.2 [Orabug: 33181852]

Aug 9, 2021
High max 8.3

ELSA-2021-9395 4 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.53.5] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33143006] {CVE-2021-33909} [4.1.12-124.53.3] - net/mlx4: Fix EEPROM dump support (Vladyslav Tarasiuk) [Orabug: 31895301] {CVE-2020-14304} - net/mlx4_en: etht…

Aug 4, 2021
High max 7.8

ELSA-2021-2238 1 CVE 1 exploited

Important: polkit security update (Oracle Linux 8)

[0.115-11.0.1] - Increase timeout to avoid defunct processes [Orabug: 26930744] [0.115-11.1] - early disconnection from D-Bus results in privilege esc. - Resolves: CVE-2021-3560

Jun 4, 2021
Medium max 6.9

ELSA-2021-1846 1 CVE 1 exploited

Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update (Oracle Linux 8)

bind-dyndb-ldap [11.6-2] - Rebuild against bind 9.11.26 - Resolves: rhbz#1904612 [11.6-1] - New upstream release - Resolves: rhbz#1891735 ipa [4.9.2-3.0.1] - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674] [4.9.2-3] - ipa-client-install dis…

May 25, 2021
Medium max 5.5

ELSA-2021-1647 3 CVEs 1 exploited

Moderate: samba security, bug fix, and enhancement update (Oracle Linux 8)

openchange [2.3-27.0.1] - Use ldconfig_scriptlets [2.3-27] - Rebuild for newer samba samba [4.13.3-3] - resolves: #1924615 - Fix a memcache bug when cache is full - resolves: #1924571 - Ensure that libwbclient has been updated before restarting services [4.13…

May 25, 2021
Medium max 6.9

ELSA-2021-0860 1 CVE 1 exploited

Moderate: ipa security and bug fix update (Oracle Linux 7)

[4.6.8-5.0.1] - Blank out header-logo.png product-name.png - Replace login-screen-logo.png [Orabug: 20362818] [4.6.8-5.el7_9.4] - Resolves: #1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing - wgi/plugins.py: ignore e…

Mar 19, 2021
High max 7.8

ELSA-2021-0221 1 CVE 1 exploited

Important: sudo security update (Oracle Linux 7)

[1.8.23-10.1] - RHEL 7.9.Z ERRATUM - CVE-2021-3156 Resolves: rhbz#1917729

Jan 27, 2021
High max 7.8

ELSA-2021-0218 1 CVE 1 exploited

Important: sudo security update (Oracle Linux 8)

[1.8.29-6.1] - RHEL 8.3.Z ERRATUM - CVE-2021-3156 Resolves: rhbz#1917732

Jan 27, 2021
Medium max 5.5

ELSA-2020-5439 3 CVEs 1 exploited

Moderate: samba security and bug fix update (Oracle Linux 7)

[4.10.17-9] - related: #1853272 - Add back missing patch hunks [4.10.16-8] - resolves: #1878205 - Fix restarting winbind on package upgrade - resolves: #1892632 - Fix CVE-2020-14318 - resolves: #1891687 - Fix CVE-2020-14323 - resolves: #1879834 - Fix CVE-2020…

Dec 16, 2020
High max 9.6

ELSA-2020-4952 1 CVE 1 exploited

Important: freetype security update (Oracle Linux 8)

[2.9.1-4.el8_3.1] - Test bitmap size earlier for PNGs - Fix memory leak in pngshim.c - Resolves: #1891905

Nov 13, 2020
Medium max 8.8

ELSA-2020-4451 53 CVEs 1 exploited

Moderate: GNOME security, bug fix, and enhancement update (Oracle Linux 8)

dleyna-renderer [0.6.0-3] - Add a manual Resolves: #1612579 frei0r-plugins [1.6.1-7] - Rebuild with newer annobin to fix rpmdiff problems - Fix the build with a newer opencv - Resolves: rhbz#1703994 gdm [3.28.3-34] - Fix file descriptor leak Resolves: #187785…

Nov 10, 2020
Medium max 6.9

ELSA-2020-4847 13 CVEs 1 exploited

Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update (Oracle Linux 8)

Nov 10, 2020
High max 9.6

ELSA-2020-4907 1 CVE 1 exploited

Important: freetype security update (Oracle Linux 7)

[2.8-14.el7_9.1] - Test bitmap size earlier for PNGs - Fix memory leak in pngshim.c - Resolves: #1891635

Nov 6, 2020
Medium max 8.8

ELSA-2020-4035 101 CVEs 2 exploited

Moderate: webkitgtk4 security, bug fix, and enhancement update (Oracle Linux 7)

[2.28.2-2] - Resolves: rhbz#1817144 Rebuild to support ppc and s390 [2.28.2-1] - Resolves: rhbz#1817144 Rebase to 2.28.2

Oct 6, 2020
Critical max 7.8

ELSA-2020-2954 1 CVE 1 exploited

Critical: .NET Core 3.1 security and bugfix update (Oracle Linux 8)

[3.1.106-1.0.1] - Update patch to support 8.2 (alexander.burmashev@oracle.com) - support OL release scheme (alexander.burmashev@oracle.com) [3.1.106-1] - Update to .NET Core Runtime 3.1.6 and SDK 3.1.106 - Resolves: RHBZ#1854137

Jul 17, 2020
Critical max 7.8

ELSA-2020-2938 1 CVE 1 exploited

Critical: .NET Core security and bugfix update (Oracle Linux 8)

[2.1.516-1] - Update to .NET Core SDK 2.1.516 and Runtime 2.1.20 - Resolves: RHBZ#1851983

Jul 16, 2020
High max 8.1

ELSA-2020-1495 5 CVEs 2 exploited

Important: thunderbird security update (Oracle Linux 8)

[68.7.0-1.0.1.el8_1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.7.0-1] - Update to 68.7.0 build1

Apr 18, 2020
High max 8.1

ELSA-2020-1489 5 CVEs 2 exploited

Important: thunderbird security update (Oracle Linux 7)

[68.7.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.7.0-1] - Update to 68.7.0 build1

Apr 17, 2020