Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,096 results · Clear filters · Feed

High max 7.0

ELSA-2019-4520 4 CVEs

Important: qemu security update (Oracle Linux 7)

[12:2.9.0-19.el7] - lsi53c895a: convert to trace-events (Mark Cave-Ayland) [Orabug: 28205376] - lsi: Reselection needed to remove pending commands from queue (George Kennedy) [Orabug: 28626490] - lsi53c895a: check message length value is valid (Prasad J Pandi…

Jan 28, 2019
High

ELSA-2019-0160 6 CVEs

Important: thunderbird security update (Oracle Linux 7)

[60.4.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [60.4.0-1] - Update to 60.4.0

Jan 25, 2019
High max 5.0

ELSA-2019-4518 6 CVEs

Important: qemu security update (Oracle Linux 7)

[15:3.0.0-4.el7] - usb-mtp: use O_NOFOLLOW and O_CLOEXEC. (Gerd Hoffmann) [Orabug: 29056673] {CVE-2018-16872} - pvrdma: add uar_read routine (Prasad J Pandit) {CVE-2018-20191} - pvrdma: release ring object in case of an error (Prasad J Pandit) [Orabug: 291718…

Jan 25, 2019
High

ELSA-2019-0109 1 CVE

Important: perl security update (Oracle Linux 7)

[4:5.16.3-294] - Fix CVE-2018-18311 Integer overflow leading to buffer overflow (bug #1661064)

Jan 21, 2019
High

ELSA-2019-4509 6 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1844.1.3] - net: rds: fix rds_ib_sysctl_max_recv_allocation error (Zhu Yanjun) [Orabug: 29003422] - nfs: dont dirty kernel pages read by direct-io (Dave Kleikamp) [Orabug: 29122062] - KVM: X86: Fix scan ioapic use-before-initialization (Wanpeng Li) […

Jan 15, 2019
High

ELSA-2019-0059 1 CVE

Important: libvncserver security update (Oracle Linux 7)

[0.9.9-13] - Fix CVE-2018-15127 (Heap out-of-bounds write in rfbserver.c:rfbProcessFileTransferReadBuffer()) (bug #1662995)

Jan 15, 2019
High

ELSA-2019-4510 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.24.3] - ext4: update i_disksize when new eof exceeds it (Shan Hai) [Orabug: 28940828] - ext4: update i_disksize if direct write past ondisk size (Eryu Guan) [Orabug: 28940828] - ext4: protect i_disksize update by i_data_sem in direct write path (E…

Jan 15, 2019
High max 8.8

ELSA-2019-0049 3 CVEs

Important: systemd security update (Oracle Linux 7)

[219-62.0.4] - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896] - OL7 udev rule for virtio net standby interface [Orabug: 28826743] - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com) …

Jan 14, 2019
High

ELSA-2019-0022 1 CVE

Important: keepalived security update (Oracle Linux 7)

[1.3.5-8] - Fixed patch that was incorrectly removed (#1652694) [1.3.5-7] - Fix buffer overflow when parsing HTTP status codes (#1652694)

Jan 4, 2019
High max 7.8

ELSA-2019-4316 22 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.29.1] - Copy secure_boot flag in boot params across kexec reboot (Dave Young) [Orabug: 22066352] {CVE-2015-7837} - ipv6: tcp: add rcu locking in tcp_v6_send_synack() (Eric Dumazet) [Orabug: 25059183] {CVE-2016-3841} - ipv6: add complete…

Jan 4, 2019
High

ELSA-2019-4315 9 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.24.1] - pinctrl: amd: Use devm_pinctrl_register() for pinctrl registration (Laxman Dewangan) [Orabug: 27539246] {CVE-2017-18174} - mlock: fix mlock count can not decrease in race condition (Yisheng Xie) [Orabug: 27677611] {CVE-2017-18221} - perf/c…

Jan 3, 2019
High max 7.0

ELSA-2018-4312 1 CVE

Important: qemu security update (Oracle Linux 7)

[15:3.0.0-3.el7] - monitor: guard iothread access by mon->use_io_thread (Wolfgang Bumiller) [Orabug: 29046045] - monitor: delay monitor iothread creation (Wolfgang Bumiller) [Orabug: 29010480] - Revert 'qmp: isolate responses into io thread' (Marc-Andre Lurea…

Dec 21, 2018
High max 7.0

ELSA-2018-4313 1 CVE

Important: qemu security update (Oracle Linux 7)

[15:3.0.0-3.el7] - monitor: guard iothread access by mon->use_io_thread (Wolfgang Bumiller) [Orabug: 29046045] - monitor: delay monitor iothread creation (Wolfgang Bumiller) [Orabug: 29010480] - Revert 'qmp: isolate responses into io thread' (Marc-Andre Lurea…

Dec 21, 2018
High

ELSA-2018-3834 9 CVEs

Important: ghostscript security and bug fix update (Oracle Linux 7)

[9.07-31.el7_6.6] - Resolves: #1657822 - ghostscript: Regression: Warning: Dropping incorrect smooth shading object (Error: /rangecheck in --run--) [9.07-31.el7_6.5] - Resolves: #1654621 - CVE-2018-16541 ghostscript: incorrect free logic in pagedevice replace…

Dec 18, 2018
High

ELSA-2018-4304 5 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1818.5.4] - RDS: null pointer dereference in rds_atomic_free_op (Mohamed Ghannam) [Orabug: 28020694] {CVE-2018-5333} - x86/speculation: Make enhanced IBRS the default spectre v2 mitigation (Alejandro Jimenez) [Orabug: 28474853] - x86/speculation: Ena…

Dec 11, 2018
High

ELSA-2018-4307 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.23.2] - n_tty: fix EXTPROC vs ICANON interaction with TIOCINQ (aka FIONREAD) (Linus Torvalds) [Orabug: 28855335] {CVE-2018-18386} - nfs: Don't take a reference on fl->fl_file for LOCK operation (Benjamin Coddington) [Orabug: 28887442] - x86/topolo…

Dec 11, 2018
High max 9.8

ELSA-2018-4303 1 CVE

Important: kubernetes security update (Oracle Linux 7)

[1.9.11-2.1.1] - Fix kubeadm-registry.sh - Use golang 1.9.3 - [CVE-2018-1002105] Handle error responses from backends - Bump to v1.9.11

Dec 11, 2018
High max 7.8

ELSA-2018-4299 6 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.23.1] - xfs: don't call xfs_da_shrink_inode with NULL bp (Eric Sandeen) [Orabug: 28898616] {CVE-2018-13094} - ALSA: rawmidi: Change resized buffers atomically (Takashi Iwai) [Orabug: 28898636] {CVE-2018-10902} - md/raid5: fix a race condition in s…

Dec 6, 2018
High max 7.8

ELSA-2018-4300 10 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.28.1] - udf: Check component length before reading it (Jan Kara) [Orabug: 21193696] {CVE-2014-9728} - udf: Verify i_size when loading inode (Shan Hai) [Orabug: 21193696] {CVE-2014-9728} - intel_pstate: Fix overflow in busy_scaled due to…

Dec 6, 2018
High max 7.3

ELSA-2018-3761 1 CVE

Important: ghostscript security and bug fix update (Oracle Linux 7)

[9.07-31.el7_6.3] - Resolves: #1654290 ghostscript update breaks xdvi (gs: Error: /undefined in flushpage) [9.07-31.el7_6.2] - Resolves: #1652901 - CVE-2018-16863 ghostscript: incomplete fix for CVE-2018-16509

Dec 3, 2018
High max 9.8

ELSA-2018-3738 1 CVE

Important: ruby security update (Oracle Linux 7)

[2.0.0.648-34] - CVE-2018-16395: Fix OpenSSL::X509::Name equality check does not work. Resolves: CVE-2018-16395

Nov 29, 2018
High max 5.8

ELSA-2018-4289 34 CVEs

Important: qemu security update (Oracle Linux 7)

[15:3.0.0-1.el7] - net: ignore packet size greater than INT_MAX (Jason Wang) [Orabug: 28763782] {CVE-2018-17963} - pcnet: fix possible buffer overflow (Jason Wang) [Orabug: 28763774] {CVE-2018-17962} - rtl8139: fix possible out of bound access (Jason Wang) [O…

Nov 28, 2018
High

ELSA-2018-4288 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.22.4] - Revert commit 8bd274934987 ('block: fix bdi vs gendisk lifetime mismatch') (Ashish Samant) [Orabug: 28968102] - KVM/x86: Add IBPB support (Ashok Raj) [Orabug: 28703712] - x86/intel/spectre_v2: Remove unnecessary retp_compiler() test (Boris…

Nov 28, 2018
High max 8.8

ELSA-2018-3665 1 CVE

Important: NetworkManager security update (Oracle Linux 7)

[1:1.12.0-8] - dhcp: fix out-of-bounds heap write for DHCPv6 with internal plugin (CVE-2018-15688)

Nov 27, 2018
High

ELSA-2018-3650 4 CVEs

Important: ghostscript security update (Oracle Linux 7)

[9.07-31.el7_6.1] - Remove as many non-standard operators as possible to make the codebase closer to upstream for later CVEs - Resolves: #1621383 - CVE-2018-16511 ghostscript: missing type check in type checker (699659) - Resolves: #1621159 - CVE-2018-15908 g…

Nov 26, 2018
High max 7.5

ELSA-2018-4285 39 CVEs

Important: qemu security update (Oracle Linux 7)

[15:3.0.0-1.el7] - net: ignore packet size greater than INT_MAX (Jason Wang) [Orabug: 28763782] {CVE-2018-17963} - pcnet: fix possible buffer overflow (Jason Wang) [Orabug: 28763774] {CVE-2018-17962} - rtl8139: fix possible out of bound access (Jason Wang) [O…

Nov 20, 2018
High

ELSA-2018-3408 1 CVE

Important: git security update (Oracle Linux 7)

[1.8.3.1-20] - Fix CVE-2018-17456: arbitrary code execution via .gitmodules Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1

Nov 9, 2018
High

ELSA-2018-3532 4 CVEs

Important: thunderbird security update (Oracle Linux 7)

[60.3.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [60.3.0-1] - Update to 60.3.0 [60.2.1-6] - Fixed missing calendar langpacks [60.2.1-5] - Fixing minor issues

Nov 9, 2018
High

ELSA-2018-4268 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.26.1] - netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Eric Dumazet) [Orabug: 27896807] {CVE-2017-18017} - scsi: libsas: fix memory leak in sas_smp_get_phy_events() (Jason Yan) [Orabug: 27927692] {CVE-2018-7757}

Nov 8, 2018
High

ELSA-2018-4270 7 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1818.4.5] - x86/intel/spectre_v2: Remove unnecessary retp_compiler() test (Boris Ostrovsky) [Orabug: 28814574] - x86/intel/spectre_v4: Deprecate spec_store_bypass_disable=userspace (Boris Ostrovsky) [Orabug: 28814574] - x86/speculation: x86_spec_ctrl…

Nov 8, 2018
High

ELSA-2018-3350 6 CVEs

Important: java-1.7.0-openjdk security update (Oracle Linux 7)

[1:1.7.0.201-2.6.16.1.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.201-2.6.16.1] - Bump to 2.6.16 and u201b00. - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES) - Resolves: rhbz#1633817

Nov 7, 2018
High

ELSA-2018-3410 1 CVE

Important: xorg-x11-server security update (Oracle Linux 7)

[1.20.1-5.1] - CVE-2018-14665: Disable -logfile and -modulepath when running with elevated privileges [1.20.1-5] - Call LeaveVT from xf86CrtcCloseScreen [1.20.1-4] - Hide the modesetting driver's atomic ioctl support behind Option 'Atomic'

Nov 7, 2018
High

ELSA-2018-3458 7 CVEs

Important: thunderbird security update (Oracle Linux 7)

[60.2.1-4.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [60.2.1-4] - Fixing minor issues [60.2.1-3] - Reverting deleting of key3db [60.2.1-2] - Update to 60.2.1 - Added fix for rhbz#1546988 [60.0-1] - Rebase to v…

Nov 7, 2018
High

ELSA-2018-4265 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.21.1] - hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:447! (Mike Kravetz) [Orabug: 28839992] - scsi: libsas: fix memory leak in sas_smp_get_phy_events() (Jason Yan) [Orabug: 27927687] {CVE-2018-7757} - KVM: vmx: shadow more fields that are rea…

Nov 6, 2018
High max 7.8

ELSA-2018-3083 29 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

[3.10.0-957] - [mm] mlock: avoid increase mm->locked_vm on mlock() when already mlock2(, MLOCK_ONFAULT) (Rafael Aquini) [1633059] [3.10.0-956] - [block] blk-mq: fix hctx debugfs entry related race between update hw queues and cpu hotplug (Ming Lei) [1619988] …

Nov 5, 2018
High max 7.5

ELSA-2018-4262 10 CVEs

Important: qemu security update (Oracle Linux 7)

[12:2.9.0-17.el7] - i386: Remove generic SMT thread check (Babu Moger) [Orabug: 28676425] - pc: Fix typo on PC_COMPAT_2_12 (Eduardo Habkost) [Orabug: 28676425] - i386: Enable TOPOEXT feature on AMD EPYC CPU (Babu Moger) [Orabug: 28676425] - net: ignore packet…

Oct 29, 2018
High

ELSA-2018-4261 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.20.7] - Revert 'rds: RDS (tcp) hangs on sendto() to unresponding address' (Brian Maly) [Orabug: 28837953] [4.1.12-124.20.6] - x86/speculation: Retpoline should always be available on Skylake (Alexandre Chartre) [Orabug: 28801831] [4.1.12-124.20.5]…

Oct 24, 2018
High max 7.5

ELSA-2018-2921 1 CVE

Important: tomcat security update (Oracle Linux 7)

[0:7.0.76-8] - Resolves: rhbz#1608608 CVE-2018-1336 tomcat: A bug in the UTF 8 decoder can lead to DoS

Oct 16, 2018
High

ELSA-2018-2918 4 CVEs

Important: ghostscript security update (Oracle Linux 7)

[9.07-29.el7_5.2] - Fix MediaPosition, ManualFeed and MediaType with pxl devices (bug #1629842) [9.07-29.el7_5.1] - Added security fixes for: - CVE-2018-16509 (bug #1621156) - CVE-2018-15910 (bug #1621157) - CVE-2018-16542 (bug #1621380) [9.07-29] - Fix rare …

Oct 15, 2018
High

ELSA-2018-4249 2 CVEs

Important: openssl security update (Oracle Linux 7)

[1.0.2k-12.0.3] - Oracle bug 28672370: backport CVE-2018-0732 - Oracle bug 28672351: backport CVE-2018-0737

Oct 12, 2018