Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,096 results · Clear filters · Feed

High

ELSA-2019-2836 1 CVE

Important: dovecot security update (Oracle Linux 7)

[1:2.2.36-3.1] - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes (#1751383)

Sep 20, 2019
High

ELSA-2019-2798 2 CVEs

Important: patch security update (Oracle Linux 8)

[2.7.6-9] - CVE-2018-20969, invoke ed directly instead of using the shell

Sep 19, 2019
High max 7.5

ELSA-2019-2799 3 CVEs

Important: nginx:1.14 security update (Oracle Linux 8)

[1:1.14.1-9.0.1] - Remove Red Hat references [Orabug: 29498217] [1:1.14.1-9] - Resolves: #1744811 - CVE-2019-9511 nginx:1.14/nginx: HTTP/2: large amount of data request leads to denial of service - Resolves: #1744325 - CVE-2019-9513 nginx:1.14/nginx: HTTP/2: …

Sep 19, 2019
High max 7.2

ELSA-2019-4789 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.5.2.1] - vhost: make sure log_num < in_num (yongduan) [Orabug: 30312787] {CVE-2019-14835} - vhost: block speculation of translated descriptors (Michael S. Tsirkin) [Orabug: 30312787] {CVE-2019-14835} - vhost: Fix Spectre V1 vulnerability (Jason …

Sep 17, 2019
High

ELSA-2019-2774 7 CVEs

Important: thunderbird security update (Oracle Linux 8)

[60.9.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [60.9.0-2] - Update to 60.9.0

Sep 17, 2019
High max 5.9

ELSA-2019-2720 1 CVE

Important: pki-deps:10.6 security update (Oracle Linux 8)

jackson-databind

Sep 17, 2019
High

ELSA-2019-2773 7 CVEs

Important: thunderbird security update (Oracle Linux 7)

[60.9.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [60.9.0-1] - Update to 60.9.0

Sep 16, 2019
High max 5.6

ELSA-2019-4785 11 CVEs

Important: edk2 security update (Oracle Linux 7)

[1:1.2-5.el7] - Update spec file to remove 'modprobe kvm-intel' and remove --enable-kvm arg to ovmf_vars_generator so qemu will not require kvm kernel module. (Aaron Young) - Update spec file to modprobe kvm_intel module prior to running qemu to enroll defaul…

Sep 13, 2019
High max 8.0

ELSA-2019-2703 7 CVEs

Important: kernel security and bug fix update (Oracle Linux 8)

- [4.18.0-80.11.1_0.OL8] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] [4.18.0-80.11.1_0] - [w…

Sep 12, 2019
High max 7.5

ELSA-2019-2692 2 CVEs

Important: nghttp2 security update (Oracle Linux 8)

[1.33.0-1.el8_0_0.1] - backport security fixes from nghttp2-1.39.2 (CVE-2019-9511 and CVE-2019-9513)

Sep 10, 2019
High max 7.3

ELSA-2019-2591 4 CVEs

Important: ghostscript security update (Oracle Linux 8)

[9.25-2.3] - Resolves: #1744010 - CVE-2019-14811 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator (701445) - Resolves: #1744014 - CVE-2019-14812 ghostscript: Safer Mode Bypass by .forceput Exposure in setuserparams (701444) - Reso…

Sep 6, 2019
High max 5.6

ELSA-2019-4775 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.38.1] - x86/speculation: Exclude ATOMs from speculation through SWAPGS (Thomas Gleixner) [Orabug: 30165288] {CVE-2019-1125} - x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [Orabug: 30165288] {CVE-2019-1125} - x8…

Sep 5, 2019
High

ELSA-2019-2606 1 CVE

Important: kdelibs and kde-settings security and bug fix update (Oracle Linux 7)

kdelibs [6:4.14.8-11] - KConfig: malicious .desktop files would execute code Resolves: bz#1740736 kde-settings [19-23.10.0.1] - Change GreetString [bug 11710280] [19-23.10] - Use correct tcsh syntax for config scripts Resolves: bz#1738491

Sep 4, 2019
High max 7.9

ELSA-2019-2600 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1062.1.1] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] [3.10.0-1062.1.1] - [fs] nfsv4.1: Avo…

Sep 4, 2019
High

ELSA-2019-2593 1 CVE

Important: squid:4 security update (Oracle Linux 8)

libecap [1.0.1-2] - Resolves: #1696354 - Ensure modular RPM upgrade path squid [7:4.4-5] - Resolves: #1744672 - CVE-2019-12527 squid:4/squid: heap-based buffer overflow in HttpHeader::getAuth

Sep 3, 2019
High max 7.3

ELSA-2019-2586 4 CVEs

Important: ghostscript security update (Oracle Linux 7)

[9.25-2.2] - Resolves: #1744008 - CVE-2019-14811 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator (701445) - Resolves: #1744012 - CVE-2019-14812 ghostscript: Safer Mode Bypass by .forceput Exposure in setuserparams (701444) - Reso…

Sep 2, 2019
High

ELSA-2019-2582 1 CVE

Important: pango security update (Oracle Linux 8)

[1.42.4-5] - Fixes crash in pango_fc_font_key_get_variations when key is null [1.42.4-4] - Fixes bidi crash - Security fix for CVE-2019-1010238 - Resolves: #1738461 [1.42.4-3] - rebuild [1.42.4-2] - rebuild

Aug 29, 2019
High

ELSA-2019-2571 1 CVE

Important: pango security update (Oracle Linux 7)

[1.42.4-4] - Fixes bidi crash - Security fix for CVE-2019-1010238 - Resolves: #1738459

Aug 27, 2019
High

ELSA-2019-4756 0 CVEs

Important: docker-engine security update (Oracle Linux 7)

[ 18.03.1.ol-0.0.15] - cherry-picked fix for CVE-2018-15664 from upstream [18.03.1.ol-0.0.14] - rebuild [18.03.1.ol-0.0.13] - update for CVE-2018-20699 [18.03.1.ol-0.0.12] - correct the version string of containerd [18.03.1.ol-0.0.11] - update runc for CVE-20…

Aug 19, 2019
High

ELSA-2019-2511 95 CVEs

Important: mysql:8.0 security update (Oracle Linux 8)

mecab [0.996-1.9] - Release bump for rebuilding on new arches Related: #1518842 [0.996-1.8] - skip %verify of /etc/opt/rh/rh-mysql57/mecabrc Resolves: #1382315 [0.996-1.7] - Prefix library major number with SCL name in soname [0.996-1.6] - Require runtime pac…

Aug 19, 2019
High

ELSA-2019-2512 1 CVE

Important: subversion:1.10 security update (Oracle Linux 8)

libserf [1.3.9-9] - Resolves: #1696354 - Ensure modular RPM upgrade path subversion [1.10.2-2] - rebuild to ensure NVR ordering (#1696354) [1.10.2-1.1] - Resolves: #1733442 - CVE-2019-0203 subversion:1.10/subversion: remote unauthenticated denial-of-service i…

Aug 19, 2019
High max 7.2

ELSA-2019-2002 2 CVEs

Important: redis:5 security update (Oracle Linux 8)

[5.0.3-2] - fix Heap buffer overflow in HyperLogLog triggered by malicious client CVE-2019-10192 - fix Stack buffer overflow in HyperLogLog triggered by malicious client CVE-2019-10193

Aug 19, 2019
High max 7.8

ELSA-2019-2411 2 CVEs 1 exploited

Important: kernel security update (Oracle Linux 8)

- [4.18.0-80.7.2_0.OL8] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] [4.18.0-80.7.2_0] - [x86…

Aug 19, 2019
High

ELSA-2019-1959 4 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

- [4.18.0-80.7.1_0.OL8] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] [4.18.0-80.7.1_0] - [x86…

Aug 19, 2019
High max 7.3

ELSA-2019-2462 1 CVE

Important: ghostscript security update (Oracle Linux 7)

[9.25-2.1] - Resolves: #1737338 - CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 (701394)

Aug 16, 2019
High max 7.8

ELSA-2019-4746 8 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.4.8] - x86/boot: Clear RSDP address in boot_params for broken loaders (Juergen Gross) [Orabug: 30111373] [4.14.35-1902.4.7] - rds: ib: Qualify CM REQ duplicate detection with connection being up (Hakon Bugge) [Orabug: 30062149] - rds: Further pr…

Aug 15, 2019
High max 7.0

ELSA-2019-2029 25 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

[3.10.0-1062.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] [3.10.0-1062] - [fs] revert 'xfs: dis…

Aug 13, 2019
High max 7.3

ELSA-2019-2465 1 CVE

Important: ghostscript security update (Oracle Linux 8)

[9.25-2.2] - Resolves: #1737336 - CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 (701394)

Aug 13, 2019
High

ELSA-2019-4741 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.37.1] - Input: gtco - bounds check collection indent level (Grant Hernandez) [Orabug: 30074414] {CVE-2019-13631}

Aug 8, 2019
High

ELSA-2019-4739 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.30.1] - xen: let alloc_xenballooned_pages() fail if not enough memory free (Juergen Gross) [Orabug: 30073695] - mm/page_alloc.c: calculate 'available' memory in a separate function (Igor Redko) [Orabug: 30073695] - Input: gtco - bounds check colle…

Aug 8, 2019
High max 5.6

ELSA-2019-4733 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.3.2] - x86/speculation: Exclude ATOMs from speculation through SWAPGS (Thomas Gleixner) [Orabug: 29967570] {CVE-2019-1125} - x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [Orabug: 29967570] {CVE-2019-1125} - x86/speculat…

Aug 6, 2019
High max 5.6

ELSA-2019-4735 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.29.3.1] - x86/speculation: Exclude ATOMs from speculation through SWAPGS (Thomas Gleixner) [Orabug: 29967571] {CVE-2019-1125} - x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [Orabug: 29967571] {CVE-2019-1125} - x86/specula…

Aug 6, 2019
High max 8.8

ELSA-2019-1972 1 CVE

Important: ruby:2.5 security update (Oracle Linux 8)

ruby [2.5.3-104] - Prohibit arbitrary code execution when installing a malicious gem. Resolves: CVE-2019-8324 rubygem-mongo [2.5.1-2] - Disable tests to fix FTBFS by dropped MongoDB module. Resolves: rhbz#1710863 rubygem-pg [1.0.0-2] - Assign a random testing…

Aug 5, 2019
High max 8.2

ELSA-2019-2004 3 CVEs

Important: icedtea-web security update (Oracle Linux 8)

[1.7.1-16] - Added Patch5, testTuning.patch to make tests pass inclean envirnment - Resolves: rhbz#1724958 [1.7.1-16] - added patch1, patch4 and patch11 to fix CVE-2019-10182 - added patch2 to fix CVE-2019-10181 - added patch3 and patch33 to fix CVE-2019-1018…

Aug 5, 2019
High max 8.2

ELSA-2019-2003 3 CVEs

Important: icedtea-web security update (Oracle Linux 7)

[1.7.2-16] - added patch1, patch4 and patch11 to fix CVE-2019-10182 - added patch2 to fix CVE-2019-10181 - added patch3 and patch33 to fix CVE-2019-10185 - Resolves: rhbz#1724958 - Resolves: rhbz#1725928 - Resolves: rhbz#1724989

Jul 31, 2019
High

ELSA-2019-1883 1 CVE

Important: qemu-kvm security update (Oracle Linux 7)

[1.5.3-160.el7_6.3] - kvm-slirp-check-sscanf-result-when-emulating-ident.patch [bz#1669067] - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch [bz#1669067] - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch [bz#1669067] - kvm-slirp…

Jul 30, 2019
High max 7.5

ELSA-2019-1873 4 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

[3.10.0-957.27.2.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-957.27.2] - [x86] hyper-v: fi…

Jul 30, 2019
High max 7.5

ELSA-2019-0972 1 CVE

Important: openwsman security update (Oracle Linux 8)

[2.6.5-5] - Fix CVE-2019-3816 Resolves: #1693972 - Remove Dist Tag from the oldest changelog entry

Jul 30, 2019
High

ELSA-2019-0968 1 CVE

Important: edk2 security update (Oracle Linux 8)

[20180508gitee3198e672e2-9.el8_0] - edk2-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch [bz#1690501] - edk2-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch [bz#1690501] - Resolves: bz#1690501 (CVE-2018-12180 edk2: Buffer Overflow in Blo…

Jul 30, 2019
High max 5.9

ELSA-2019-1714 1 CVE

Important: bind security update (Oracle Linux 8)

[32:9.11.4-17.P2.1] - Fix CVE-2019-6471

Jul 30, 2019