Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,096 results · Clear filters · Feed

High max 8.2

ELSA-2020-5859 3 CVEs

Important: olcne nginx security update (Oracle Linux 7)

olcne [1.1.6-1] - support upgrading nginx - Adress CVE-2019-9511 - Adress CVE-2018-16845 - Adress CVE-2017-7529 - support upgrading flannel nginx [1.17.7-2] - Changed nginx home dir to /var/lib/nginx for consistency [1.17.7-1] - Added Oracle Specific Build Fi…

Sep 24, 2020
High

ELSA-2020-3832 4 CVEs

Important: firefox security update (Oracle Linux 8)

[78.3.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.3.0-1] - Update to 78.3.0 build1

Sep 24, 2020
High

ELSA-2020-3631 2 CVEs

Important: thunderbird security update (Oracle Linux 7)

[68.12.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Build with rust-toolset 1.43 [68.12.0-1] - Update to 68.12.0 build1

Sep 17, 2020
High max 7.2

ELSA-2020-3732 98 CVEs

Important: mysql:8.0 security update (Oracle Linux 8)

mysql [8.0.21-1] - Rebase to 8.0.21 - Use bundled libzstd and libevent for RHSCL and RHEL-8.0.0 - Check that we have correct versions in bundled(*) Provides - Remove re2 bundled dependency [8.0.20-1] - Rebase to 8.0.20 [8.0.19-2] - Specify all perl dependenci…

Sep 16, 2020
High max 6.1

ELSA-2020-5848 6 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2011.6.2] - Revert 'aarch64/BM: config failed, hub doesnt have any ports' (Thomas Tai) [Orabug: 31838351] [Orabug: 31844671] - kvm: ioapic: Restrict lazy EOI update to edge-triggered interrupts (Paolo Bonzini) [Orabug: 31839185] [Orabug: 31844556] [5.…

Sep 14, 2020
High max 7.4

ELSA-2020-5845 32 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.306.2] - rename kABI whitelists to lockedlists (Dan Duval) [Orabug: 31783150] - sched/fair: Fix low cpu usage with high throttling by removing expiration of cpu-local slices (Dave Chiluk) [Orabug: 31350999] {CVE-2019-19922} - sched/fair: Fix thr…

Sep 11, 2020
High max 5.5

ELSA-2020-5844 7 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2025.400.9] - btrfs: merge btrfs_find_device and find_device (Anand Jain) [Orabug: 31867382] {CVE-2019-18885} - sctp: implement memory accounting on tx path (Xin Long) [Orabug: 31867387] {CVE-2019-3874} - Revert 'zram: convert remaining CLASS_ATTR() …

Sep 11, 2020
High

ELSA-2020-3713 3 CVEs

Important: dovecot security update (Oracle Linux 8)

[1:2.3.8-2.2] - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866755) - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866760) - fix CVE-2020-12674 crash due to assert in RPA implementation (#1866767)

Sep 11, 2020
High max 7.5

ELSA-2020-3699 1 CVE

Important: .NET Core 3.1 security and bugfix update (Oracle Linux 8)

[3.1.108-2.0.1.el8_2] - Update patch to support 8.2 (alexander.burmashev@oracle.com) - support OL release scheme (alexander.burmashev@oracle.com) [3.1.108-2] - Rebuild to fix tests - Resolves: RHBZ#1874512 [3.1.108-1] - Update to .NET Core Runtime 3.1.8 and S…

Sep 11, 2020
High

ELSA-2020-3714 1 CVE

Important: httpd:2.4 security update (Oracle Linux 8)

mod_http2 [1.11.3-3.1] - Resolves: #1869072 - CVE-2020-9490 httpd:2.4/mod_http2: httpd: Push diary crash on specifically crafted HTTP/2 header

Sep 11, 2020
High max 6.5

ELSA-2020-5841 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.49.1] - sunrpc: use SVC_NET() in svcauth_gss_* functions (Vasily Averin) [Orabug: 31351996] {CVE-2018-16884} - sunrpc: use-after-free in svc_process_common() (Vasily Averin) [Orabug: 31351996] {CVE-2018-16884} - af_packet: set defaule v…

Sep 10, 2020
High

ELSA-2020-3658 1 CVE

Important: librepo security update (Oracle Linux 8)

[1.11.0-3] - Validate paths read from repomd.xml (RhBug:1866498)

Sep 9, 2020
High

ELSA-2020-3556 2 CVEs

Important: firefox security update (Oracle Linux 7)

[68.12.0-1.0.3] - Build with rust-toolset 1.43 [68.12.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Improve …

Sep 8, 2020
High

ELSA-2020-3634 2 CVEs

Important: thunderbird security update (Oracle Linux 8)

[68.12.0-1.0.1] * Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.12.0-1] - Update to 68.12.0 build1

Sep 8, 2020
High

ELSA-2020-3623 2 CVEs

Important: squid:4 security update (Oracle Linux 8)

libecap squid [7:4.4-8.2] - Resolves: #1872345 - CVE-2020-15811 squid:4/squid: HTTP Request Splitting could result in cache poisoning - Resolves: #1872330 - CVE-2020-15810 squid:4/squid: HTTP Request Smuggling could result in cache poisoning [7:4.4-8.1] - Res…

Sep 4, 2020
High max 3.3

ELSA-2020-5837 8 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.42.3] - can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices (Tomas Bortoli) [Orabug: 31351221] {CVE-2019-19535} - media: hdpvr: Fix an error handling path in hdpvr_probe() (Arvind Yadav) [Orabug: 31352053] {CVE-2017-16644} - fs/binfmt_misc.c…

Sep 3, 2020
High

ELSA-2020-3617 3 CVEs

Important: dovecot security update (Oracle Linux 7)

[1:2.2.36-6.1] - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1871841) - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1871843) - fix CVE-2020-12674 crash due to assert in RPA implementation (#1871842)

Sep 3, 2020
High

ELSA-2020-5828 1 CVE

Important: coredns cri-o cri-tools etcd flannel kata kata-agent kata-image kata-ksm-throttler kata-proxy kata-runtime kata-shim kubernetes kubernetes-cni kubernetes-cni-plugins kubernetes-dashboard olcne yq security update (Oracle Linux 7)

coredns [1.3.1-1.0.6] - Address CVE-2020-16845 [1.3.1-1.0.5] - Fix image location cri-o [1.14.7-1.0.8] - Address CVE-2020-16845 cri-tools [1.14.0-1.0.6] - Address CVE-2020-16845 etcd [3.3.10-1.0.5] - Address CVE-2020-16845 [3.3.10-1.0.4] - Fix image location …

Aug 31, 2020
High

ELSA-2020-5827 1 CVE

Important: olcne conmon coredns cri-o cri-tools etcd flannel grafana helm istio kata kata-agent kata-image kata-ksm-throttler kata-proxy kata-runtime kata-shim kubernetes kubernetes-cni kubernetes-cni-plugins kubernetes-dashboard prometheus yq security update (Oracle Linux 7)

olcne [1.1.5-2] - kubernetes pod subnet flag not honored in flannel configuration [1.1.5-1] - Address CVE-2020-16845 conmon [2.0.10-3] - Address CVE-2020-16845 coredns [1.6.5-1.0.3] - Address CVE-2020-16845 cri-o [1.17.0-1.0.5] - Address CVE-2020-16845 cri-to…

Aug 31, 2020
High

ELSA-2020-3557 10 CVEs

Important: firefox security update (Oracle Linux 8)

[78.2.0-2.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.2.0-2] - Update to 78.2.0 build1

Aug 28, 2020
High

ELSA-2020-5825 1 CVE

Important: kubernetes kubeadm-ha-setup kubernetes-cni kubernetes-cni-plugins security update (Oracle Linux 7)

kubernetes [1.12.10-1.0.15] - Address CVE-2020-16845 kubeadm-ha-setup [0.0.2-1.0.73] - Fix update to coredns image tag [0.0.2-1.0.72] - Address CVE-2020-16845 kubernetes-cni [0.7.1-1.0.3] - Pin min version of cni-plugins kubernetes-cni-plugins [0.8.6-1.0.3] -…

Aug 24, 2020
High

ELSA-2020-5823 1 CVE

Important: docker-cli docker-engine security update (Oracle Linux 7)

docker-cli [19.03.11-5] - Bugfix for 'docker images [name]' not working on docker 19.03.11-ol - Address CVE-2020-16845 [19.03.11-4] - added patch for registry list [19.03.11-3] - update to 19.03.11 for CVE-2020-13401 [19.03.1-1.0.0] - update to 19.03.1 [19.03…

Aug 24, 2020
High max 7.5

ELSA-2020-3422 1 CVE

Important: .NET Core 3.1 security and bugfix update (Oracle Linux 8)

[3.1.107-1.0.1] - Update patch to support 8.2 (alexander.burmashev@oracle.com) - support OL release scheme (alexander.burmashev@oracle.com) [3.1.107-1] - Update to .NET Core Runtime 3.1.7 and SDK 3.1.107 - Resolves: RHBZ#1862593 - Resolves: RHBZ#1861113

Aug 16, 2020
High max 5.5

ELSA-2020-5804 11 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.305.4] - ptp: free ptp device pin descriptors properly (Vladis Dronov) [Orabug: 31710994] [4.14.35-1902.305.3] - fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() (Alexander Potapenko) [Orabug: 31350638] {CVE-2020-10732} - …

Aug 10, 2020
High max 5.5

ELSA-2020-5805 6 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2011.5.3uek] - misc: pvpanic: add crash loaded event (zhenwei pi) [Orabug: 31677096] - misc: pvpanic: move bit definition to uapi header file (zhenwei pi) [Orabug: 31677096] - RDMA/netlink: Do not always generate an ACK for some netlink operations (Ha…

Aug 10, 2020
High

ELSA-2020-3385 1 CVE

Important: libvncserver security update (Oracle Linux 8)

[0.9.11-15.1] - Fix NVR Related: #1852356 [0.9.11-15] - Fix CVE-2017-18922 Resolves: #1852356

Aug 10, 2020
High

ELSA-2020-3344 4 CVEs

Important: thunderbird security update (Oracle Linux 7)

[68.11.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.11.0-1] - Update to 68.11.0 build1

Aug 7, 2020
High

ELSA-2020-5802 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.48.1] - crypto: user - fix memory leak in crypto_report (Navid Emamdoost) [Orabug: 31351641] {CVE-2019-19062} - media: rc: prevent memory leak in cx23888_ir_probe (Navid Emamdoost) [Orabug: 31351673] {CVE-2019-19054}

Aug 6, 2020
High

ELSA-2020-5801 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.41.4] - uek-rpm: Add OL6 shim conflict for new signing key (Eric Snowberg) [Orabug: 31688239] - Revert 'certs: Add Oracle's new X509 cert into the kernel keyring' (Eric Snowberg) [Orabug: 31688223] - blk-mq: don't overwrite rq->mq_ctx (Jens Axboe)…

Aug 6, 2020
High

ELSA-2020-3341 4 CVEs

Important: thunderbird security update (Oracle Linux 8)

[68.11.0-1.0.1.el8_2] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.11.0-1] - Update to 68.11.0 build1

Aug 6, 2020
High

ELSA-2020-3281 1 CVE

Important: libvncserver security update (Oracle Linux 7)

[0.9.9-14.1] - Fix CVE-2017-18922 Resolves: #1852509

Aug 4, 2020
High max 7.7

ELSA-2020-3285 1 CVE

Important: postgresql-jdbc security update (Oracle Linux 7)

[9.2.1002-8] - require explicitly jdk-1.7 due to ABI bytecode compatibility [9.2.1002-7] - fixed XXE vulnerability (CVE-2020-13692)

Aug 4, 2020
High

ELSA-2020-3253 4 CVEs

Important: firefox security update (Oracle Linux 7)

[68.11.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file * Thu Jul 23 2020 Jan Horak <jhorak@redhat.com> - Update …

Jul 31, 2020
High

ELSA-2020-3220 4 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1127.18.2.OL7] - Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and shim-x…

Jul 30, 2020
High

ELSA-2020-3241 4 CVEs

Important: firefox security update (Oracle Linux 8)

[68.11.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [68.11.0-1] - Update to 68.11.0 build1

Jul 30, 2020
High max 6.4

ELSA-2020-5790 8 CVEs

Important: grub2 security update (Oracle Linux 7)

[2.02-81.0.4] - Fix CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707 [Orabug: 31225072] - Update signing certificate for efi binaries [2.02-0.81.0.2] - Enable common subpackage buil…

Jul 29, 2020
High max 6.4

ELSA-2020-5782 8 CVEs

Important: grub2 security update (Oracle Linux 7)

[2.02-81.0.3] - Fix CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707 [Orabug: 31225072] - Update signing certificate for efi binaries

Jul 29, 2020
High

ELSA-2020-5791 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.304.6.3] - Revert 'uek-rpm: Move grub boot menu update to posttrans stage.' (Somasundaram Krishnasamy) [Orabug: 31358100] [4.14.35-1902.304.6.2] - certs: Remove Oracle cert compiled into the kernel (Eric Snowberg) [Orabug: 31668611] - efi: Restr…

Jul 29, 2020
High

ELSA-2020-5792 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2011.4.6.el8uek] - Revert 'uek-rpm: Move grub boot menu update to posttrans stage.' (Somasundaram Krishnasamy) [Orabug: 31358097] [5.4.17-2011.4.5.el8uek] - IB/sa: Resolv use-after-free in ib_nl_make_request() (Divya Indi) [Orabug: 31631527] - certs: …

Jul 29, 2020
High max 6.4

ELSA-2020-5786 8 CVEs

Important: grub2 security update (Oracle Linux 8)

[2.02-82.0.2.el8_2.1] - Fix CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707 [Orabug: 31225072] - Update signing certificate for efi binaries

Jul 29, 2020