Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

296 results · Clear filters · Feed

High max 7.8

ELSA-2022-9141 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.302.7.2.3] - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33832574] {CVE-2022-0492}

Feb 9, 2022
High max 7.8

ELSA-2022-9088 6 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.60.1] - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) [Orabug: 33699627] [Orabug: 33762471] {CVE-2021-4155} - fix regression in 'epoll: Keep a reference on files added to the check list' (Al Viro) [Orabu…

Feb 1, 2022
High max 7.8

ELSA-2022-0274 1 CVE 1 exploited

Important: polkit security update (Oracle Linux 7)

[0.112-26.0.1] - Increase timeout to avoid defunct processes [Orabug: 26930744] [0.112-26.1] - pkexec: argv overflow results in local privilege esc. - Resolves: CVE-2021-4034

Jan 25, 2022
High max 7.8

ELSA-2022-0267 1 CVE 1 exploited

Important: polkit security update (Oracle Linux 8)

[0.115-13.0.1] - Increase timeout to avoid defunct processes [Orabug: 26930744] [0.115-13.el8_5.1] - pkexec: argv overflow results in local privilege esc. - Resolves: CVE-2021-4034

Jan 25, 2022
High max 8.4

ELSA-2022-0188 2 CVEs 1 exploited

Important: kernel security and bug fix update (Oracle Linux 8)

[4.18.0-348.12.2_5.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

Jan 21, 2022
High max 8.4

ELSA-2022-9028 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.302.7.2.1] - vfs: fs_context: fix up param length parsing in legacy_parse_param (Jamie Hill-Daniel) [Orabug: 33761451] {CVE-2022-0185}

Jan 19, 2022
High max 8.4

ELSA-2022-9029 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.302.7.2.1] - vfs: fs_context: fix up param length parsing in legacy_parse_param (Jamie Hill-Daniel) [Orabug: 33761451] {CVE-2022-0185}

Jan 19, 2022
High max 6.4

ELSA-2022-9011 2 CVEs 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.510.5.2] - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) [Orabug: 33722441] {CVE-2021-4155} [4.14.35-2047.510.5.1] - fget: check that the fd still exists after getting a ref to it (Linus Torvalds) [Ora…

Jan 10, 2022
High max 6.4

ELSA-2022-9010 2 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.510.5.2.el7uek] - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) [Orabug: 33722441] {CVE-2021-4155} [4.14.35-2047.510.5.1.el7uek] - fget: check that the fd still exists after getting a ref to it (Linus …

Jan 10, 2022
High max 7.8

ELSA-2022-9014 3 CVEs 2 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.59.1.2] - fix regression in 'epoll: Keep a reference on files added to the check list' (Al Viro) [Orabug: 33679854] {CVE-2021-1048} - fget: check that the fd still exists after getting a ref to it (Linus Torvalds) [Orabug: 33679806] {CVE-2021-0920…

Jan 10, 2022
High max 6.4

ELSA-2022-9012 2 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.302.7.2] - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) [Orabug: 33699625] {CVE-2021-4155} [5.4.17-2136.302.7.1] - fget: check that the fd still exists after getting a ref to it (Linus Torvalds) [Orabu…

Jan 10, 2022
High max 6.4

ELSA-2022-9013 2 CVEs 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.302.7.2] - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) [Orabug: 33699625] {CVE-2021-4155} [5.4.17-2136.302.7.1] - fget: check that the fd still exists after getting a ref to it (Linus Torvalds) [Orabu…

Jan 10, 2022
High max 8.5

ELSA-2021-3956 14 CVEs 1 exploited

Important: xstream security update (Oracle Linux 7)

[1.3.1-16] - Fix workaround - Resolves: CVE-2021-39148 [1.3.1-15] - Fix remote code execution vulnerabilities - Resolves: CVE-2021-39139 - Resolves: CVE-2021-39140 - Resolves: CVE-2021-39141 - Resolves: CVE-2021-39144 - Resolves: CVE-2021-39145 - Resolves: CV…

Oct 25, 2021
High max 9.0

ELSA-2021-3856 1 CVE 1 exploited

Important: httpd security update (Oracle Linux 7)

[2.4.6-97.0.1.1] - replace index.html with Oracle's index page oracle_index.html [2.4.6-97.1] - Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted request uri-path containing 'unix:'

Oct 14, 2021
High max 9.0

ELSA-2021-3816 2 CVEs 1 exploited

Important: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-39.1.0.1.1] - Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-39.1] - Resolves: #2007234 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via a crafted request ur…

Oct 13, 2021
High max 9.8

ELSA-2021-3771 1 CVE 1 exploited

Important: grafana security update (Oracle Linux 8)

[7.3.6-3] - resolve CVE-2021-39226 - resolve CVE-2021-27358

Oct 12, 2021
High max 8.3

ELSA-2021-3327 5 CVEs 1 exploited

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1160.41.1.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and…

Aug 31, 2021
High max 8.7

ELSA-2021-3057 3 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-305.12.1_4.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

Aug 11, 2021
High max 6.9

ELSA-2021-9400 1 CVE 1 exploited

Important: bootstrap security update (Oracle Linux 7)

[3.0.0-7.0.1] - Backport jQuery CVE-2020-11023 fixes from jQuery v3.5.0 to bundled v1.10.2 [Orabug: 33181852]

Aug 9, 2021
High max 8.3

ELSA-2021-9395 4 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.53.5] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33143006] {CVE-2021-33909} [4.1.12-124.53.3] - net/mlx4: Fix EEPROM dump support (Vladyslav Tarasiuk) [Orabug: 31895301] {CVE-2020-14304} - net/mlx4_en: etht…

Aug 4, 2021
High max 7.8

ELSA-2021-2238 1 CVE 1 exploited

Important: polkit security update (Oracle Linux 8)

[0.115-11.0.1] - Increase timeout to avoid defunct processes [Orabug: 26930744] [0.115-11.1] - early disconnection from D-Bus results in privilege esc. - Resolves: CVE-2021-3560

Jun 4, 2021
High max 7.8

ELSA-2021-0221 1 CVE 1 exploited

Important: sudo security update (Oracle Linux 7)

[1.8.23-10.1] - RHEL 7.9.Z ERRATUM - CVE-2021-3156 Resolves: rhbz#1917729

Jan 27, 2021
High max 7.8

ELSA-2021-0218 1 CVE 1 exploited

Important: sudo security update (Oracle Linux 8)

[1.8.29-6.1] - RHEL 8.3.Z ERRATUM - CVE-2021-3156 Resolves: rhbz#1917732

Jan 27, 2021
High max 9.6

ELSA-2020-4952 1 CVE 1 exploited

Important: freetype security update (Oracle Linux 8)

[2.9.1-4.el8_3.1] - Test bitmap size earlier for PNGs - Fix memory leak in pngshim.c - Resolves: #1891905

Nov 13, 2020
High max 9.6

ELSA-2020-4907 1 CVE 1 exploited

Important: freetype security update (Oracle Linux 7)

[2.8-14.el7_9.1] - Test bitmap size earlier for PNGs - Fix memory leak in pngshim.c - Resolves: #1891635

Nov 6, 2020
High max 8.1

ELSA-2020-1495 5 CVEs 2 exploited

Important: thunderbird security update (Oracle Linux 8)

[68.7.0-1.0.1.el8_1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.7.0-1] - Update to 68.7.0 build1

Apr 18, 2020
High max 8.1

ELSA-2020-1489 5 CVEs 2 exploited

Important: thunderbird security update (Oracle Linux 7)

[68.7.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.7.0-1] - Update to 68.7.0 build1

Apr 17, 2020
High max 9.8

ELSA-2020-0855 1 CVE 1 exploited

Important: tomcat security update (Oracle Linux 7)

[0:7.0.76-11] - Resolves: rhbz#1806801 CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability

Mar 22, 2020
High max 8.8

ELSA-2020-0127 5 CVEs 1 exploited

Important: thunderbird security update (Oracle Linux 8)

[68.4.1-2.0.1.el8_1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.4.1-2] - Update to 68.4.1 build1

Jan 18, 2020
High max 8.8

ELSA-2020-0120 5 CVEs 1 exploited

Important: thunderbird security update (Oracle Linux 7)

[68.4.1-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.4.1-2] - Update to 68.4.1 build1

Jan 16, 2020
High max 7.8

ELSA-2019-2411 2 CVEs 1 exploited

Important: kernel security update (Oracle Linux 8)

- [4.18.0-80.7.2_0.OL8] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] [4.18.0-80.7.2_0] - [x86…

Aug 19, 2019
High max 7.8

ELSA-2019-4746 8 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.4.8] - x86/boot: Clear RSDP address in boot_params for broken loaders (Juergen Gross) [Orabug: 30111373] [4.14.35-1902.4.7] - rds: ib: Qualify CM REQ duplicate detection with connection being up (Hakon Bugge) [Orabug: 30062149] - rds: Further pr…

Aug 15, 2019
High max 7.8

ELSA-2019-0980 2 CVEs 1 exploited

Important: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-11.0.1] - Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-11] - Resolves: #1695431 - CVE-2019-0211 httpd: privilege escalation from modules scripts - Resolves: #16…

Jul 30, 2019
High max 10.0

ELSA-2019-1623 6 CVEs 2 exploited

Important: thunderbird security update (Oracle Linux 8)

[60.7.2-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [60.7.2-2] - Update to 60.7.2 build2 [60.7.2-1] - Update to 60.7.2 [60.7.1-1] - Update to 60.7.1

Jul 30, 2019
High max 10.0

ELSA-2019-1626 6 CVEs 2 exploited

Important: thunderbird security update (Oracle Linux 7)

[60.7.2-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [60.7.2-2] - Update to 60.7.2 build2 [60.7.2-1] - Update to 60.7.2 [60.7.1-1] - Update to 60.7.1

Jun 27, 2019
High max 7.8

ELSA-2018-4233 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.24.3] - exec: Limit arg stack to at most 75% of _STK_LIM (Kees Cook) [Orabug: 28710010] {CVE-2018-14634}

Sep 28, 2018
High max 7.8

ELSA-2018-4230 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.19.6] - exec: Limit arg stack to at most 75% of _STK_LIM (Kees Cook) [Orabug: 28709994] {CVE-2018-14634}

Sep 28, 2018
High max 7.8

ELSA-2018-2748 1 CVE 1 exploited

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-862.14.4.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-862.14.4] - [scsi] Revert: lp…

Sep 26, 2018
High max 8.1

ELSA-2017-3081 4 CVEs 2 exploited

Important: tomcat security update (Oracle Linux 7)

[0:7.0.76-3] - Resolves: rhbz#1498344 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws - Resolves: rhbz#1495654 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache poisoning - Resolves: rhbz#1470596 CVE-2017-5647 Add follow up revis…

Oct 30, 2017
High max 9.8

ELSA-2017-1270 1 CVE 1 exploited

Important: samba security update (Oracle Linux 7)

[3.6.23-43.0.1] - Remove use-after-free talloc_tos() inlined function problem (John Haxby) [orabug 18253258] [3.6.24-43] - resolves: #1450782 - Fix CVE-2017-7494

May 24, 2017