Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,096 results · Clear filters · Feed

  • High
    ELSA-2017-2832 1 CVE

    Important: nss security update (Oracle Linux 7)

    [3.28.4-12] - Backport patch to simplify transcript calculation for CertificateVerify

  • High
    ELSA-2017-2788 1 CVE

    Important: augeas security update (Oracle Linux 7)

    [1.4.0-2.el7_4.1] - Fix CVE-2017-7555, improper handling of escaped strings (RHBZ#1481545)

  • High
    ELSA-2017-3621 3 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.19.7] - Bluetooth: Properly check L2CAP config option output buffer length (Ben Seri) [Orabug: 26796364] {CVE-2017-1000251} [3.8.13-118.19.6] - xen: fix bio vec merging (Roger Pau Monne) [Orabug: 26645550] {CVE-2017-12134} [3.8.13-118.1…

  • High
    ELSA-2017-3620 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-103.3.8.1] - Bluetooth: Properly check L2CAP config option output buffer length (Ben Seri) [Orabug: 26796363] {CVE-2017-1000251}

  • High
    ELSA-2017-2771 1 CVE

    Important: emacs security update (Oracle Linux 7)

    [1:24.3-20] - fix unsafe enriched mode translations (#1490452)

  • High
    ELSA-2017-2679 1 CVE

    Important: kernel security update (Oracle Linux 7)

    - [3.10.0-693.2.2.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-693.2.2] - [net] l2cap: prev…

  • High
    ELSA-2017-2534 14 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [52.3.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [52.3.0-1] - Update to 52.3.0 [52.2.1-1] - Update to 52.2.1

  • High
    ELSA-2017-3609 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-103.3.8] - fs/exec.c: account for argv/envp pointers (Kees Cook) [Orabug: 26638900] {CVE-2017-1000365} {CVE-2017-1000365} [4.1.12-103.3.7] - i40e/i40evf: check for stopped admin queue (Mitch Williams) [Orabug: 26654222] [4.1.12-103.3.6] - x…

  • High max 4.4
    ELSA-2017-3606 4 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.19.4] - l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() (Guillaume Nault) [Orabug: 26586047] {CVE-2016-10200} - xfs: fix two memory leaks in xfs_attr_list.c error paths (Mateusz Guzik) [Orabug: 26586022] {CVE-2016-9685} - KE…

  • High max 9.8
    ELSA-2017-2486 1 CVE

    Important: groovy security update (Oracle Linux 7)

    [1.8.9-8] - Fix Information disclosure vulnerability - Resolves: CVE-2016-6814

  • High max 9.8
    ELSA-2017-2489 2 CVEs

    Important: mercurial security update (Oracle Linux 7)

    [2.6.2-8] - Fix CVE-2017-1000115 and CVE-2017-1000116

  • High max 4.4
    ELSA-2017-3605 5 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-94.5.9] - dentry name snapshots (Al Viro) [Orabug: 26630936] {CVE-2017-7533} [4.1.12-94.5.8] - scsi: libiscsi: use kvzalloc for iscsi_pool_init (Kyle Fortin) [Orabug: 26621191] - mm: introduce kv[mz]alloc helpers (Kyle Fortin) [Orabug: 2662…

  • High
    ELSA-2017-2484 1 CVE

    Important: git security update (Oracle Linux 7)

    [1.8.3.1-12] - prevent command injection via malicious ssh URLs Resolves: CVE-2017-1000117

  • High
    ELSA-2017-2473 1 CVE

    Important: kernel security and bug fix update (Oracle Linux 7)

    - [3.10.0-693.1.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-693.1.1] - [fs] dentry name …

  • High
    ELSA-2017-2480 1 CVE

    Important: subversion security update (Oracle Linux 7)

    [1.7.14-11] - add security fix for CVE-2017-9800

  • High
    ELSA-2017-2471 1 CVE

    Important: spice security update (Oracle Linux 7)

    [0.12.8-2.1] - Redo build properly versioned as a zstream build Related: CVE-2017-7506 [0.12.8-3] - Prevent potential buffer/integer overflows with invalid MonitorsConfig messages sent from an authenticated client Resolves: CVE-2017-7506

  • High
    ELSA-2017-2479 5 CVEs

    Important: httpd security update (Oracle Linux 7)

    [2.4.6-67.0.1.el7_4.2] - replace index.html with Oracle's index page oracle_index.html [2.4.6-67.2] - Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw() authentication bypass - Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer deref…

  • High max 9.8
    ELSA-2017-2459 1 CVE

    Important: libsoup security update (Oracle Linux 7)

    [2.56.0-4] - Fix chunked decoding buffer overrun (CVE-2017-2885) (rh #1479322)

  • High
    ELSA-2017-2389 6 CVEs

    Important: freeradius security update (Oracle Linux 7)

    [3.0.13-8] - Avoid misinterpreting zero-size malloc in data2vp_extended() fix. - Related: Bug#1469414 CVE-2017-10984 freeradius: Out-of-bounds write in data2vp_wimax() [3.0.13-7] - Resolves: Bug#1469409 CVE-2017-10978 freeradius: Out-of-bounds read/write due …

  • High
    ELSA-2017-2388 1 CVE

    Important: evince security update (Oracle Linux 7)

    [3.22.1-5.2] - Related: #1469528 ensure .desktop file is still valid [3.22.1-5.1] + Fix arbitrary code execution via filename in tar-compressed comics archive - Resolves: #1469528

  • High max 9.8
    ELSA-2017-2423 2 CVEs

    Important: log4j security update (Oracle Linux 7)

    [0:1.2.17-16] - Fix socket receiver deserialization vulnerability - Resolves: CVE-2017-5645

  • High max 4.4
    ELSA-2017-1842 32 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

  • High max 9.1
    ELSA-2017-1809 2 CVEs

    Important: tomcat security update (Oracle Linux 7)

    [0:7.0.69-12] - Resolves: rhbz#1441487 CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate facade object - Resolves: rhbz#1441480 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used - Resolves: r…

  • High
    ELSA-2017-3595 4 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-94.5.7] - Revert 'net/rds: Revert 'RDS: add reconnect retry scheme for stalled connections'' (Ajaykumar Hotchandani) [Orabug: 26444722] - Revert 'net/rds: use different workqueue for base_conn' (Ajaykumar Hotchandani) [Orabug: 26444722] - R…

  • High
    ELSA-2017-3596 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.19.3] - posix_acl: Clear SGID bit when setting file permissions (Jan Kara) [Orabug: 25507344] {CVE-2016-7097} {CVE-2016-7097}

  • High
    ELSA-2017-1793 8 CVEs

    Important: graphite2 security update (Oracle Linux 7)

    [1.3.10-1] - Resolves: rhbz#1472290 CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778

  • High max 7.5
    ELSA-2017-1680 2 CVEs

    Important: bind security and bug fix update (Oracle Linux 7)

    [32:9.9.4-50.1] - Bump again above RHEL-7.4 [32:9.9.4-38.5] - Fix CVE-2017-3142 and CVE-2017-3143 [32:9.9.4-38.4] - Update root servers and trust anchor (#1459649)

  • High
    ELSA-2017-1681 1 CVE

    Important: qemu-kvm security update (Oracle Linux 7)

    [1.5.3-126.el7_3.10] - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1460179] - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1460179] - Resolves: bz#1460179 (CVE-2017-9524 qemu-kvm: Qemu: nbd: segmentation fault due to clie…

  • High
    ELSA-2017-3589 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-94.3.8] - macsec: dynamically allocate space for sglist (Jason A. Donenfeld) [Orabug: 26368162] {CVE-2017-7477} - macsec: avoid heap overflow in skb_to_sgvec (Jason A. Donenfeld) [Orabug: 26368162] {CVE-2017-7477} - nfsd: check for oversize…

  • High
    ELSA-2017-3590 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.19.2] - nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields) [Orabug: 26366022] {CVE-2017-7645} [3.8.13-118.19.1] - selinux: quiet the filesystem labeling behavior message (Paul Moore) [Orabug: 25290650] - HID: hid-cypress: va…

  • High
    ELSA-2017-3587 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-94.3.7] - mm: fix new crash in unmapped_area_topdown() (Hugh Dickins) [Orabug: 26326143] {CVE-2017-1000364} - mm: larger stack guard gap, between vmas (Hugh Dickins) [Orabug: 26326143] {CVE-2017-1000364}

  • High
    ELSA-2017-1581 1 CVE

    Important: freeradius security update (Oracle Linux 7)

    [3.0.4-8] - Disable internal OpenSSL cache and fix session cache file permissions. Resolves: Bug#1459131 CVE-2017-9148 freeradius: TLS resumption authentication bypass

  • High
    ELSA-2017-1615 5 CVEs

    Important: kernel security and bug fix update (Oracle Linux 7)

    - [3.10.0-514.26.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-514.26.1] - [mm] enlarge st…

  • High max 8.8
    ELSA-2017-1576 1 CVE

    Important: mercurial security update (Oracle Linux 7)

    [1.4-5] - Fixes CVE-2017-9462

  • High
    ELSA-2017-1561 19 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [52.2.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [52.2.0-1] - Update to 52.2.0

  • High
    ELSA-2017-1484 1 CVE

    Important: kernel security update (Oracle Linux 7)

    - [3.10.0-514.21.2.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-514.21.2] - [mm] enlarge st…

  • High
    ELSA-2017-1481 1 CVE

    Important: glibc security update (Oracle Linux 7)

    [2.17-157.4] - Avoid large allocas in the dynamic linker (#1452720)

  • High
    ELSA-2017-1430 2 CVEs

    Important: qemu-kvm security and bug fix update (Oracle Linux 7)

    [1.5.3-126.el7_3.9] - kvm-spice-fix-spice_chr_add_watch-pre-condition.patch [bz#1452332] - Resolves: bz#1452332 (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop) [1.5.3-126.el7_3.8] - kvm-char-change-qe…

  • High
    ELSA-2017-3579 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-94.3.6] - net/packet: fix overflow in check for tp_reserve (Andrey Konovalov) [Orabug: 26143545] {CVE-2017-7308} - net/packet: fix overflow in check for tp_frame_nr (Andrey Konovalov) [Orabug: 26143545] {CVE-2017-7308} - net/packet: fix ove…

  • High
    ELSA-2017-3580 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.18.4] - net/packet: fix overflow in check for tp_reserve (Andrey Konovalov) [Orabug: 26143552] {CVE-2017-7308} - net/packet: fix overflow in check for tp_frame_nr (Andrey Konovalov) [Orabug: 26143552] {CVE-2017-7308} - net/packet: fix o…