Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,083 results · Clear filters · Feed

  • High max 9.8
    ELSA-2026-71233 13 CVEs 1 exploited

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.60.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 8.8
    ELSA-2026-73997 1 CVE

    Important: gvfs security update (Oracle Linux 8)

    [1.36.2-22] - Fix heap buffer overflow in SFTP backend (CVE-2026-84268) Resolves: RHEL-252300

  • High max 8.2
    ELSA-2026-74095 17 CVEs

    Important: rsync security, bug fix, and enhancement update (Oracle Linux 8)

    [3.1.3-28] - Resolves: RHEL-256903 - Fix latest CVEs in rsync in RHEL8 - Fixing a regression introduced with the security patches

  • High max 10.0
    ELSA-2026-73971 44 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [140.16.0-1] - Add Oracle prefs file [140.16.0-1] - Update to 140.16.0 ESR [140.15.0-1] - Update to 140.15.0 ESR - Fix ML-DSA certificate validation Resolves: RHEL-252227

  • High max 7.0
    ELSA-2026-73426 1 CVE

    Important: gdb security update (Oracle Linux 9)

    [16.3-3.1.0.1] - Merge Oracle patches for ol9-u8. Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Oracle history: March-06-2026 Claudiu Zissulescu <claudiu.zissulescu-ianculescu@oracle.com> - 16.3-3.0.1 - Merge Oracle patches for ol9-u8. Reviewed-by:…

  • High max 8.8
    ELSA-2026-74370 2 CVEs

    Important: gvfs security update (Oracle Linux 9)

    [1.48.1-8.1] - Backport several CVE fixes (CVE-2026-84268, CVE-2026-88924) Resolves: RHEL-252312, RHEL-257348

  • High max 8.7
    ELSA-2026-74441 1 CVE

    Important: libpcap security update (Oracle Linux 9)

    [14:1.10.0-4.1] - Fix CVE-2026-0799: add bounds checks for BPF scratch memory register indices in the BPF interpreter Related: RHEL-256935

  • High max 7.5
    ELSA-2026-74001 2 CVEs

    Important: expat security update (Oracle Linux 10)

    [2.7.3-61] - CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing [2.7.3-60] - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input [2.7.3-59] - Fix CVE-2026-56132: out-of-bound scaffolding index sto…

  • High max 8.7
    ELSA-2026-74442 1 CVE

    Important: libpcap security update (Oracle Linux 10)

    [14:1.10.4-7.1] - Fix CVE-2026-0799: validate BPF scratch memory register indices in the BPF interpreter to prevent out-of-bounds memory access Resolves: RHEL-256921

  • High max 7.0
    ELSA-2026-73427 1 CVE

    Important: gdb security update (Oracle Linux 10)

    [16.3-3.1.0.1] Merge Oracle patches for ol10-u2 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Oracle history: March-4-2026 Claudiu Zissulescu <claudiu.zissulescu-ianculescu@oracle.com> - 16.3-3.0.1 Merge Oracle patches for ol10-u2 Reviewed-by: Davi…

  • High max 8.8
    ELSA-2026-73998 2 CVEs

    Important: gvfs security update (Oracle Linux 10)

    [1.54.4-4.1] - Backport several CVE fixes (CVE-2026-84268, CVE-2026-88924) Resolves: RHEL-252305, RHEL-257341 [1.54.4-4] - udisks2: Correct add to hash table for items which can clash in the monitor (RHEL-143935)

  • High max 8.1
    ELSA-2026-73766 2 CVEs

    Important: pki-core security update (Oracle Linux 9)

    [11.7.1-2.0.1] - Replaced upstream graphical references [Orabug: 33952704] [11.7.0-2] - RHEL-245465 CVE-2026-76561 pki-core: ExternalProcessConstraint executable allow-list - RHEL-248586 CVE-2026-80110 pki-core: ACLFilter sort order fix

  • High max 7.5
    ELSA-2026-73838 3 CVEs

    Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 9)

    nodejs [1:24.21.0-1] - Update to version 24.21.0 nodejs-nodemon [3.1.14-3] - Fix CVE-2026-69152 - brace-expansion [3.1.14-2] - Correction to sources for 3.1.14. [3.1.14-1] - Update to version 3.1.14 [3.0.3-3] - Keep BR on just npm [3.0.3-2] - Fix BR for nodej…

  • High max 8.1
    ELSA-2026-73765 2 CVEs

    Important: dogtag-pki security update (Oracle Linux 10)

    [11.9.0-5.0.1] - Treat Oracle Linux the same as RHEL when selecting the Tomcat app server version. [11.9.0-5] - RHEL-245469 CVE-2026-76561 dogtag-pki: ExternalProcessConstraint executable allow-list - RHEL-248585 CVE-2026-80110 dogtag-pki: ACLFilter sort orde…

  • High max 7.5
    ELSA-2026-73428 3 CVEs

    Important: nodejs24 security, bug fix, and enhancement update (Oracle Linux 10)

    [24.21.0-1.0.1] - Add c-ares as dependency [orabug 39781256] - Update upstream references [1:24.21.0-1] - Update to version 24.21.0

  • High max 9.6
    ELSA-2026-71652 28 CVEs

    Important: firefox security update (Oracle Linux 8)

    [140.16.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.16.0-1] - Update to 140.16.0 ESR

  • High max 7.5
    ELSA-2026-72448 2 CVEs

    Important: expat security update (Oracle Linux 8)

    [2.5.0-4] - Fix CVE-2026-66046 in expat - Resolves: RHEL-260142 [2.5.0-3] - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input - Resolves: RHEL-268995

  • High max 8.8
    ELSA-2026-72274 2 CVEs

    Important: postgresql:12 security update (Oracle Linux 8)

    [12.22-12] - add postgresql-CVE-2026-18408.patch [12.22-11] - apply backport-of-the-patch-to-fix-CVE-2025-8714.patch [12.22-10] - Backport fixes for multiple CVEs - Resolves: CVE-2026-14662, CVE-2026-14664, CVE-2026-14668, CVE-2026-14669 - Resolves: CVE-2026-…

  • High max 7.5
    ELSA-2026-72285 1 CVE

    Important: ruby:3.3 security update (Oracle Linux 8)

    ruby [3.3.12-9] - Fix memory exhaustion via unknown DNS resource types in resolv. (CVE-2026-80212) Resolves: RHEL-252036 [3.3.12-8] - Upgrade to Ruby 3.3.12. Resolves: RHEL-170929 Resolves: RHEL-193664 [3.3.10-7] - Fix DoS via crafted IMAP responses in net-im…

  • High max 7.5
    ELSA-2026-72484 1 CVE

    Important: ruby:4.0 security update (Oracle Linux 9)

    ruby [4.0.6-35] - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion (CVE-2026-80212) Resolves: RHEL-252035 [4.0.6-34] - Upgrade to Ruby 4.0.6. Resolves: RHEL-211301 Resolves: RHEL-193663 [4.0.3-3…

  • High max 7.5
    ELSA-2026-72485 1 CVE

    Important: ruby:3.3 security update (Oracle Linux 9)

    ruby [3.3.12-9] - Fix memory exhaustion via unknown DNS resource types in resolv. (CVE-2026-80212) Resolves: RHEL-252039 [3.3.12-8] - Upgrade to Ruby 3.3.12. Resolves: RHEL-171335 Resolves: RHEL-193665 [3.3.10-7] - Fix DoS via crafted IMAP responses in net-im…

  • High max 7.5
    ELSA-2026-72286 1 CVE

    Important: ruby security, bug fix, and enhancement update (Oracle Linux 9)

    [3.0.7-168] - Fix memory exhaustion via unknown DNS resource types in resolv. (CVE-2026-80212) Resolves: RHEL-252044 [3.0.7-167] - Fix information disclosure via MITM attack bypassing TLS in net-imap. (CVE-2026-42246) Resolves: RHEL-181763 - Fix command injec…

  • High max 9.8
    ELSA-2026-72623 9 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.53.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 10.0
    ELSA-2026-73130 44 CVEs

    Important: thunderbird security update (Oracle Linux 10)

    [140.16.0-1.0.1] - Add Oracle prefs [140.16.0-1] - Update to 140.16.0 ESR [140.15.0-1] - Update to 140.15.0 ESR - Fix ML-DSA certificate validation Resolves: RHEL-252227

  • High max 5.9
    ELSA-2026-69129 5 CVEs

    Important: openssh security update (Oracle Linux 10)

    [9.9p1-27.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-27] - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245413 - CVE-2026-73281: Fix misinter…

  • High max 7.5
    ELSA-2026-67872 1 CVE

    Important: corosync security update (Oracle Linux 10)

    [3.1.10-1.2] - Resolves: RHEL-251541 - totempg: Replace assert with check in deliver_fn (fixes CVE-2026-81665)

  • High max 9.3
    ELSA-2026-72624 10 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.61.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 8.7
    ELSA-2026-68707 7 CVEs

    Important: freerdp security update (Oracle Linux 7)

    [2.1.1-5.0.13] - Backport fix for CVE-2026-55192 [Orabug: 40040632] - Backport fix for CVE-2026-55194 [Orabug: 40040632] [2.1.1-5.0.11] - Backport fix for CVE-2026-64624 [Orabug: 39964800] - Backport fix for CVE-2026-67299 [Orabug: 39964800] - Backport fix fo…

  • High max 9.8
    ELSA-2026-71329 5 CVEs

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.168.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 7.5
    ELSA-2026-72424 1 CVE

    Important: resteasy security update (Oracle Linux 9)

    [3.0.26-20] - Fix CVE-2026-17615: SourceProvider remote unauthenticated file read Resolves: RHEL-251553

  • High max 7.5
    ELSA-2026-72663 2 CVEs

    Important: expat security update (Oracle Linux 9)

    [2.5.0-6.5] - Fix CVE-2026-66046: dtdCopy out-of-bounds access via isCdata hash lookup - Resolves: RHEL-260179 [2.5.0-6.4] - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input - Resolves: RHEL-269002

  • High max 7.5
    ELSA-2026-72427 1 CVE

    Important: ruby4.0 security update (Oracle Linux 10)

    [4.0.6-37] - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion (CVE-2026-80212) Resolves: RHEL-252032

  • High max 7.5
    ELSA-2026-72785 1 CVE

    Important: ruby security update (Oracle Linux 10)

    [3.3.12-15] - Fix memory exhaustion via unknown DNS resource types in resolv. (CVE-2026-80212) Resolves: RHEL-252031

  • High max 9.8
    ELSA-2026-71602 22 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.60.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 8.5
    ELSA-2026-71641 5 CVEs

    Important: libxml2 security update (Oracle Linux 8)

    [2.9.7-21.9] - Fix CVE-2026-86144 (RHEL-256306) - Fix CVE-2026-86140 (RHEL-256021) - Fix CVE-2026-74860 (RHEL-255956) - Fix CVE-2026-86143 (RHEL-256895) - Fix CVE-2026-86138 (RHEL-256950)

  • High max 9.1
    ELSA-2026-71608 1 CVE

    Important: perl-DBI security update (Oracle Linux 8)

    [1.641-3] - Force placeholder limit on :N and :pN placeholders (CVE-2026-73194) Resolves: RHEL-247320

  • High max 9.8
    ELSA-2026-71700 17 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.52.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 8.5
    ELSA-2026-71586 6 CVEs

    Important: libxml2 security update (Oracle Linux 10)

    [2.12.5-10.4] - Fix CVE-2026-86144 (RHEL-256302) - Fix CVE-2026-86140 (RHEL-256024) - Fix CVE-2026-74860 (RHEL-255957) - Fix CVE-2026-86142 (RHEL-256368) - Fix CVE-2026-86143 (RHEL-256896) - Fix CVE-2026-86138 (RHEL-256948)

  • High max 8.7
    ELSA-2026-71658 1 CVE

    Important: python-cryptography security update (Oracle Linux 10)

    [43.0.0-4] - Fix CVE-2026-69249: add X.509 signature validation budget

  • High max 7.1
    ELSA-2026-57417 1 CVE

    Important: yelp security update (Oracle Linux 7)

    [2:3.28.1-1.0.1] - Backport fix for CVE-2026-13601 [Orabug: 39908376]