Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,096 results · Clear filters · Feed

High max 8.8

ELSA-2019-1579 4 CVEs

Important: libvirt security and bug fix update (Oracle Linux 7)

[4.5.0-10.0.1] - added librbd1 as dependency (Keshav Sharma) [4.5.0-10.el7_6.12] - api: disallow virDomainSaveImageGetXMLDesc on read-only connections (CVE-2019-10161) - api: disallow virDomainManagedSaveDefineXML on read-only connections (CVE-2019-10166) - a…

Jun 21, 2019
High max 9.8

ELSA-2019-1587 1 CVE

Important: python security update (Oracle Linux 7)

[2.7.5-80.0.1] - Add Oracle Linux distribution in platform.py [orabug 20812544] [2.7.5-80] - Security fix for CVE-2019-10160 Resolves: rhbz#1718401

Jun 20, 2019
High max 7.3

ELSA-2019-4692 1 CVE

Important: libssh2 security update (Oracle Linux 7)

[1.4.3-12.0.1.el7_6.2] - [Orabug: 29909723] Added patch CVE-2019-3862 added length checks to prevent out-of-bounds reads and writes in _libssh2_packet_add()(CVE-2019-3862)

Jun 20, 2019
High max 7.5

ELSA-2019-1481 3 CVEs

Important: kernel security update (Oracle Linux 7)

[3.10.0-957.21.3.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-957.21.3] - [net] tcp: enforc…

Jun 18, 2019
High max 8.8

ELSA-2019-4688 1 CVE

Important: libvirt security update (Oracle Linux 7)

[5.0.0-4.el7] - logging: restrict sockets to mode 0600 (Daniel P. Berrange) [Orabug: 29861433] {CVE-2019-10132} - locking: restrict sockets to mode 0600 (Daniel P. Berrange) [Orabug: 29861433] {CVE-2019-10132} - admin: reject clients unless their UID matches …

Jun 17, 2019
High max 8.8

ELSA-2019-4687 1 CVE

Important: libvirt security update (Oracle Linux 7)

[5.0.0-4.el7] - logging: restrict sockets to mode 0600 (Daniel P. Berrange) [Orabug: 29861433] {CVE-2019-10132} - locking: restrict sockets to mode 0600 (Daniel P. Berrange) [Orabug: 29861433] {CVE-2019-10132} - admin: reject clients unless their UID matches …

Jun 17, 2019
High max 7.5

ELSA-2019-4684 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.28.3] - Add CVE numbers for CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 (Chuck Anderson) [Orabug: 29890820] {CVE-2019-11477} {CVE-2019-11478} {CVE-2019-11479} {CVE-2019-11477} {CVE-2019-11478} {CVE-2019-11479} - tcp: fix fack_count accounting on …

Jun 17, 2019
High max 7.5

ELSA-2019-4686 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.35.2] - tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Eric Dumazet) [Orabug: 29886600] {CVE-2019-11477} - tcp: add tcp_min_snd_mss sysctl (Eric Dumazet) [Orabug: 29884307] {CVE-2019-11479} - tcp: tcp_fragment() should apply sane me…

Jun 17, 2019
High max 7.5

ELSA-2019-4685 8 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.2.0] - mm: account managed pages to correct zone during deferred page init (Daniel Jordan) [Orabug: 29914836] [4.14.35-1902.1.5] - CVE numbers for build v4.14.35-1902.1.3 and fixup (Jack Vogel) [Orabug: 29890784] [Orabug: 29884301] [Orabug: 2988…

Jun 17, 2019
High max 5.9

ELSA-2019-4672 5 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.35.1] - Bluetooth: hidp: fix buffer overflow (Young Xiao) [Orabug: 29786787] {CVE-2011-1079} {CVE-2019-11884} - x86/speculation/mds: Fix verw usage to use memory operand (Patrick Colp) [Orabug: 29791038] {CVE-2018-12126} {CVE-2018-12130…

Jun 6, 2019
High max 5.6

ELSA-2019-4668 11 CVEs

Important: edk2 security update (Oracle Linux 7)

[1:1.2-5.el7] - Update spec file to remove 'modprobe kvm-intel' and remove --enable-kvm arg to ovmf_vars_generator so qemu will not require kvm kernel module. (Aaron Young) - Update spec file to modprobe kvm_intel module prior to running qemu to enroll defaul…

Jun 6, 2019
High max 7.0

ELSA-2019-4670 7 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.28.1] - hugetlbfs: don't retry when pool page allocations start to fail (Mike Kravetz) [Orabug: 29324267] - x86/speculation: RSB stuffing with retpoline on Skylake+ cpus (William Roche) [Orabug: 29660924] - x86/speculation: reformatting RSB overwr…

Jun 4, 2019
High max 5.3

ELSA-2019-1309 12 CVEs

Important: thunderbird security update (Oracle Linux 7)

[60.7.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [60.7.0-1] - Update to 60.7.0

Jun 3, 2019
High max 5.9

ELSA-2019-4669 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.27.2] - x86/speculation/mds: Check for the right microcode before setting mitigation (Kanth Ghatraju) [Orabug: 29797118] - vxlan: test dev->flags & IFF_UP before accessing vxlan->dev->dev_addr (Venkat Venkatsubra) [Orabug: 29710939] - vxlan: test …

May 31, 2019
High max 7.5

ELSA-2019-1294 1 CVE

Important: bind security update (Oracle Linux 7)

[32:9.9.4-74.1] - Remove again broken test (CVE-2018-5743) [32:9.9.4-74] - Fix CVE-2018-5743

May 30, 2019
High max 8.8

ELSA-2019-1264 1 CVE

Important: libvirt security and bug fix update (Oracle Linux 7)

[4.5.0-10.0.1] - added librbd1 as dependency (Keshav Sharma) [4.5.0-10.el7_6.10] - virnwfilterbindingobj: Introduce and use virNWFilterBindingObjStealDef (rhbz#1702173) - admin: reject clients unless their UID matches the current UID (CVE-2019-10132) - lockin…

May 23, 2019
High max 6.5

ELSA-2019-4652 11 CVEs

Important: curl security update (Oracle Linux 7)

[7.29.0-51.0.1] - Security Fixes [OraBug: 28939992] - CVE-2016-8615 cookie injection for other servers (https://curl.haxx.se/docs/CVE-2016-8615.html) - CVE-2016-8616 case insensitive password comparison (https://curl.haxx.se/docs/CVE-2016-8616.html) - CVE-201…

May 21, 2019
High max 8.8

ELSA-2019-1235 4 CVEs

Important: ruby security update (Oracle Linux 7)

[2.0.0.648-35] - Introduce method as precondition to fix CVE-2019-8321. * rubygems-2.3.0-refactor-checking-really_verbose.patch - Fix escape sequence injection vulnerability in verbose. - Fix escape sequence injection vulnerability in gem owner. - Fix escape …

May 16, 2019
High

ELSA-2019-4644 6 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.34.1] - Input: wacom - move the USB (now hid) Wacom driver in drivers/hid (Benjamin Tissoires) [Orabug: 25512494] {CVE-2016-3139} - net: qmi_wwan: fix divide by 0 on bad descriptors (Bjorn Mork) [Orabug: 27215229] {CVE-2017-16650} - USB…

May 16, 2019
High max 5.9

ELSA-2019-4643 6 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1844.5.3] - x86/mds: Add empty commit for CVE-2019-11091 (Konrad Rzeszutek Wilk) [Orabug: 29721848] {CVE-2019-11091} - x86/speculation/mds: Make mds_mitigation mutable after init (Konrad Rzeszutek Wilk) [Orabug: 29721835] {CVE-2018-12126} {CVE-2018-1…

May 16, 2019
High max 5.9

ELSA-2019-1178 4 CVEs

Important: qemu-kvm security update (Oracle Linux 7)

[1.5.3-160.el7_6.2] - kvm-target-i386-define-md-clear-bit-rhel.patch - Resolves: bz#1693216 (qemu-kvm: hardware: Microarchitectural Store Buffer Data Sampling)

May 15, 2019
High

ELSA-2019-1228 1 CVE

Important: wget security update (Oracle Linux 7)

[1.14-18.1] - Fix CVE-2019-5953 (#1696733)

May 15, 2019
High max 5.9

ELSA-2019-1168 4 CVEs

Important: kernel security update (Oracle Linux 7)

[3.10.0-957.12.2.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-957.12.2] - [x86] x86/specula…

May 15, 2019
High max 5.9

ELSA-2019-1177 4 CVEs

Important: libvirt security update (Oracle Linux 7)

[4.5.0-10.0.1] - bump the version [4.5.0-10.el7_6.9] - qemu: Don't cache microcode version (CVE-2018-12127, CVE-2018-12126, CVE-2018-12130) [4.5.0-10.el7_6.8] - cpu_x86: Do not cache microcode version (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130) - cputest…

May 15, 2019
High

ELSA-2019-4642 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.27.1] - scsi: libfc: sanitize E_D_TOV and R_A_TOV setting (Hannes Reinecke) [Orabug: 25933179] - scsi: libfc: use configured rport E_D_TOV (Hannes Reinecke) [Orabug: 25933179] - scsi: libfc: additional debugging messages (Hannes Reinecke) [Orabug:…

May 15, 2019
High max 5.9

ELSA-2019-4630 4 CVEs

Important: qemu security update (Oracle Linux 7)

[15:3.1.0-3.el7] - x86: Document CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 as fixed (Mark Kanda) [Orabug: 29744956] {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091} [15:3.1.0-2.el7] - x86: Add mds feature (Karl Heubaum) - …

May 14, 2019
High max 5.9

ELSA-2019-4629 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.26.12] - x86/mds: Add empty commit for CVE-2019-11091 (Konrad Rzeszutek Wilk) [Orabug: 29721935] {CVE-2019-11091} - x86/microcode: Add loader version file in debugfs (Boris Ostrovsky) [Orabug: 29754165] - x86/microcode: Fix CPU synchronization rou…

May 14, 2019
High max 5.9

ELSA-2019-4640 13 CVEs

Important: qemu security update (Oracle Linux 7)

[15:3.1.0-3.el7] - x86: Document CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 as fixed (Mark Kanda) [Orabug: 29744956] {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091} [15:3.1.0-2.el7] - x86: Add mds feature (Karl Heubaum) - …

May 14, 2019
High max 5.9

ELSA-2019-4636 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.33.2] - x86/speculation/mds: Make cpu_matches() __cpuinit (Patrick Colp) [Orabug: 29751729] {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091} - x86/speculation/mds: Only worry about firmware loaded microcode (Patrick C…

May 14, 2019
High max 5.9

ELSA-2019-4628 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1844.4.5.2] - x86/mds: Add empty commit for CVE-2019-11091 (Konrad Rzeszutek Wilk) [Orabug: 29721848] {CVE-2019-11091} - x86/speculation/mds: Make mds_mitigation mutable after init (Konrad Rzeszutek Wilk) [Orabug: 29721835] {CVE-2018-12126} {CVE-2018…

May 14, 2019
High

ELSA-2019-4631 0 CVEs

Important: qemu security update (Oracle Linux 7)

[12:2.9.0-21.el7] - x86: Add mds feature (Karl Heubaum) - e1000: Never increment the RX undersize count register (Chris Kenna) - i386: Add some MSR based features on Cascadelake-Server CPU model (Tao Xu) [Orabug: 29643540] - i386: Update stepping of Cascadela…

May 14, 2019
High

ELSA-2019-1131 2 CVEs

Important: freeradius security update (Oracle Linux 7)

[3.0.13-10] - Fixes two EAP-PWD security issues Resolves: bz#1699413 authentication bypass with an invalid curve attack

May 9, 2019
High max 8.6

ELSA-2019-1022 1 CVE

Important: python-jinja2 security update (Oracle Linux 7)

[2.7.2-3] - Fix for CVE-2016-10745 Resolves: rhbz#1701308

May 8, 2019
High max 7.3

ELSA-2019-1017 1 CVE

Important: ghostscript security update (Oracle Linux 7)

[9.07-31.el7_6.11] - Resolves: #1673398 - CVE-2019-3839 ghostscript: missing attack vector protections for CVE-2019-6116 - fix for pdf2dsc regression added

May 7, 2019
High

ELSA-2019-1024 1 CVE

Important: flatpak security update (Oracle Linux 7)

[1.0.2-5] - Fix IOCSTI sandbox bypass (#1700651)

May 7, 2019
High

ELSA-2019-0818 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-957.12.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-957.12.1] - [kernel] locking/…

Apr 23, 2019
High

ELSA-2019-0809 1 CVE

Important: ovmf security update (Oracle Linux 7)

[20180508-3.gitee3198e672e2.el7_6.1] - ovmf-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch [bz#1684006] - ovmf-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch [bz#1684006] - Resolves: bz#1684006 (CVE-2018-12180 OVMF: edk2: Buffer Overfl…

Apr 23, 2019
High

ELSA-2019-0791 3 CVEs

Important: java-1.7.0-openjdk security update (Oracle Linux 7)

[1:1.7.0.221-2.6.18.0.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.221-2.6.18.0] - Bump to 2.6.18 and OpenJDK 7u221-b02. - Resolves: rhbz#1693468

Apr 22, 2019
High

ELSA-2019-4619 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.26.10] - x86/apic: Make arch_setup_hwirq NUMA node aware (Henry Willard) [Orabug: 29534769] [4.1.12-124.26.9] - KEYS: encrypted: fix buffer overread in valid_master_desc() (Eric Biggers) [Orabug: 29591025] {CVE-2017-13305} [4.1.12-124.26.8] - scsi…

Apr 20, 2019
High

ELSA-2019-0775 3 CVEs

Important: java-1.8.0-openjdk security update (Oracle Linux 7)

[1:1.8.0.212.b04-0] - Update to aarch64-shenandoah-jdk8u212-b04. - Resolves: rhbz#1693468 [1:1.8.0.212.b03-0] - Update to aarch64-shenandoah-jdk8u212-b03. - Resolves: rhbz#1693468 [1:1.8.0.212.b02-0] - Update to aarch64-shenandoah-jdk8u212-b02. - Remove patch…

Apr 17, 2019