Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,096 results · Clear filters · Feed

High

ELSA-2016-2973 7 CVEs

Important: thunderbird security update (Oracle Linux 7)

[45.6.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [45.6.0-1] - Update to the latest upstream (45.6.0)

Dec 21, 2016
High

ELSA-2016-3651 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.15.1] - Revert 'i40e: Set defport behavior for the Main VSI when in promiscuous mode' (Jack Vogel) [Orabug: 22683573] - mlx4: avoid multiple free on id_map_ent (Wengang Wang) - xen-netfront: cast grant table reference first to type int …

Dec 9, 2016
High

ELSA-2016-3648 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.22] - ocfs2: fix trans extend while free cached blocks (Junxiao Bi) [Orabug: 25136991] - ocfs2: fix trans extend while flush truncate log (Junxiao Bi) [Orabug: 25136991] - ocfs2: extend enough credits for freeing one truncate record wh…

Dec 7, 2016
High max 7.5

ELSA-2016-2850 1 CVE 1 exploited

Important: thunderbird security update (Oracle Linux 7)

[45.5.1-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [45.5.1-1] - Update to 45.5.1

Dec 5, 2016
High

ELSA-2016-2825 1 CVE

Important: thunderbird security update (Oracle Linux 7)

[45.5.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [45.5.0-1] - Update to 45.5.0

Nov 29, 2016
High max 9.8

ELSA-2016-2819 3 CVEs

Important: memcached security update (Oracle Linux 7)

[0:1.4.15-10.el7_3.1] - fix vulnerabilities allowing remote code execution (CVE-2016-8704, CVE-2016-8705, CVE-2016-8706) [0:1.4.15-10] - fix binding to IPv6 address (#1298603) - enable SASL support (#1263696) - don't allow authentication with bad SASL credent…

Nov 23, 2016
High max 9.1

ELSA-2016-2809 1 CVE

Important: ipsilon security update (Oracle Linux 7)

[1.0.0-13] - Backport patch for CVE-2016-8638 RHBZ#1394116

Nov 21, 2016
High

ELSA-2016-3644 10 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.19] - acpi: Disable ACPI table override if securelevel is set (Linn Crosetto) [Orabug: 25058966] {CVE-2016-3699} - aacraid: Check size values after double-fetch from user (Dave Carroll) [Orabug: 25060060] {CVE-2016-6480} {CVE-2016-6480…

Nov 20, 2016
High

ELSA-2016-3645 9 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.14.2] - aacraid: Check size values after double-fetch from user (Dave Carroll) [Orabug: 25060050] {CVE-2016-6480} {CVE-2016-6480} - IB/srpt: Simplify srpt_handle_tsk_mgmt() (Bart Van Assche) [Orabug: 25060011] {CVE-2016-6327} - audit: f…

Nov 20, 2016
High

ELSA-2016-2702 1 CVE

Important: policycoreutils security update (Oracle Linux 7)

[2.0.83-30.1.0.1] - Lazy unmount private, shared entry(Joe Jin)[orabug 12560705] [2.0.83-30.1] - sandbox: create a new session for sandboxed processes Resolves: CVE-2016-7545

Nov 14, 2016
High

ELSA-2016-2595 9 CVEs

Important: mariadb security and bug fix update (Oracle Linux 7)

[5.5.52-1] - Rebase to 5.5.52, that also include fix for CVE-2016-6662 Resolves: #1377974 [1:5.5.50-2] - Rebuild Related: #1359629

Nov 9, 2016
High

ELSA-2016-2615 1 CVE

Important: bind security update (Oracle Linux 7)

[32:9.9.4-38] - Fix CVE-2016-8864 [32:9.9.4-37] - Fix CVE-2016-2776 [32:9.9.4-36] - Added automatic interface scan functionality (#1294506) - Removed NetworkManager dispatcher script since it is not needed any more (#1294506) [32:9.9.4-35] - Added GeoIP suppo…

Nov 9, 2016
High

ELSA-2016-2658 5 CVEs

Important: java-1.7.0-openjdk security update (Oracle Linux 7)

[1:1.7.0.121-2.6.8.0.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.121-2.6.8.0] - Turn off HotSpot bootstrap to see if it resolves build issues. - Resolves: rhbz#1381990 [1:1.7.0.121-2.6.8.0] - Bump to 2.6.8 and u121b00. - Drop patches (S7081817, S8140344, S…

Nov 9, 2016
High

ELSA-2016-2604 1 CVE

Important: resteasy-base security and bug fix update (Oracle Linux 7)

[3.0.6-4] - Resolves: rhbz1378619 - disable SerializerProvider by default [3.0.6-3] - Resolves: rhbz1357624 - fail to build with java 8 [3.0.6-2] - Resolves: rhbz1280539 - fix pom version

Nov 9, 2016
High

ELSA-2016-2574 28 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

- [3.10.0-514.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-514] - [mm] remove gup_flags FOL…

Nov 9, 2016
High

ELSA-2016-3635 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.17] - sched: panic on corrupted stack end (Jann Horn) [Orabug: 24971921] {CVE-2016-1583} - ecryptfs: forbid opening files without mmap handler (Jann Horn) [Orabug: 24971921] {CVE-2016-1583} - proc: prevent stacking filesystems on top (…

Nov 3, 2016
High

ELSA-2016-3636 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.14.1] - ecryptfs: forbid opening files without mmap handler (Jann Horn) [Orabug: 24971919] {CVE-2016-1583} - RDS: IB: fix panic with handlers running post teardown (Santosh Shilimkar) [Orabug: 24395795]

Nov 3, 2016
High max 7.0

ELSA-2016-2098 1 CVE 1 exploited

Important: kernel security update (Oracle Linux 7)

- [3.10.0-327.36.3.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.36.3] - [mm] remove gup_flags FOLL_WRITE games from __get_user_pages() (Alexander Gordeev) [1385123 1385124] {CVE-2016-5195}

Oct 24, 2016
High max 7.0

ELSA-2016-3633 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.13.3] - mm, gup: close FOLL MAP_PRIVATE race (Linus Torvalds) [Orabug: 24928591] {CVE-2016-5195}

Oct 21, 2016
High max 7.0

ELSA-2016-3632 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.16] - mm: remove gup_flags FOLL_WRITE games from __get_user_pages() (Linus Torvalds) [Orabug: 24927306] {CVE-2016-5195} [4.1.12-61.1.15] - drivers/nvme: provide a module parameter for setting number of I/O queues (Shan Hai) [Orabug: 24…

Oct 21, 2016
High

ELSA-2016-3626 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.14] - net: add recursion limit to GRO (Sabrina Dubroca) [Orabug: 24829133] {CVE-2016-7039}

Oct 13, 2016
High

ELSA-2016-2047 1 CVE

Important: kernel security update (Oracle Linux 7)

- [3.10.0-327.36.2.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.36.2] - [net] add recursion limit to GRO (Sabrina Dubroca) [1378405 1374191] {CVE-2016-7039}

Oct 10, 2016
High max 8.1

ELSA-2016-2046 5 CVEs

Important: tomcat security update (Oracle Linux 7)

[0:7.0.54-8] - Resolves: rhbz#1368121 [0:7.0.54-7] - Resolves: rhbz#1362212 Tomcat: CGI sets environmental variable based on user supplied Proxy request header - Resolves: rhbz#1368121 [0:7.0.54-5] - Resolves: rhbz#1362567 [0:7.0.54-4] - Resolves: CVE-2015-53…

Oct 10, 2016
High

ELSA-2016-3625 2 CVEs

Important: Unbreakable Enterprise kernel security and bugfix update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.13] - HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Scott Bauer) [Orabug: 24803597] {CVE-2016-5829} [4.1.12-61.1.12] - ocfs2: Fix start offset to ocfs2_zero_range_for_truncate() (Ashish Samant) [Orabug: 24…

Oct 6, 2016
High

ELSA-2016-3623 2 CVEs

Important: Unbreakable Enterprise kernel security and bugfix update (Oracle Linux 7)

kernel-uek [3.8.13-118.13.2] - HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Scott Bauer) [Orabug: 24798695] {CVE-2016-5829} [3.8.13-118.13.1] - Revert 'rds: skip rx/tx work when destroying connection' (Brian Maly) [Orabug: 24790…

Oct 6, 2016
High

ELSA-2016-1985 1 CVE

Important: thunderbird security update (Oracle Linux 7)

[45.4.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [45.4.0-1] - Update to 45.4.0

Oct 3, 2016
High max 5.3

ELSA-2016-1978 1 CVE

Important: python-twisted-web security update (Oracle Linux 7)

[8.2.0-5] - Rebase HTTPoxy patch and bump release for rebuild Resolves: rhbz#1358789 [8.2.0-4] - Fix HTTPoxy CVE-2016-1000111 Resolves: rhbz#1358789

Sep 29, 2016
High

ELSA-2016-1944 1 CVE

Important: bind security update (Oracle Linux 7)

[30:9.3.6-25.P1.9] - Fix CVE-2016-2776 [30:9.3.6-25.P1.8] - Fix issue with patch for CVE-2016-1285 and CVE-2016-1286 found by test suite [30:9.3.6-25.P1.7] - Fix CVE-2016-1285 and CVE-2016-1286 [30:9.3.6-25.P1.6] - Fix CVE-2015-8704 [30:9.3.6-25.P1.5] - Fix C…

Sep 28, 2016
High

ELSA-2016-1940 9 CVEs

Important: openssl security update (Oracle Linux 7)

[1.0.1e-48.3] - fix CVE-2016-2177 - possible integer overflow - fix CVE-2016-2178 - non-constant time DSA operations - fix CVE-2016-2179 - further DoS issues in DTLS - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio() - fix CVE-2016-2181 - DTLS1 replay prote…

Sep 27, 2016
High

ELSA-2016-3617 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.11.2] - Btrfs: fix truncation of compressed and inlined extents (Ashish Samant) [Orabug: 22307285] {CVE-2015-8374} - Btrfs: fix file corruption and data loss after cloning inline extents (Divya Indi) [Orabug: 22307285] {CVE-2015-8374} -…

Sep 22, 2016
High

ELSA-2016-3619 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.10] - netfilter: x_tables: make sure e->next_offset covers remaining blob size (Florian Westphal) [Orabug: 24682076] {CVE-2016-4997} {CVE-2016-4998} - netfilter: x_tables: validate e->target_offset early (Florian Westphal) [Orabug: 246…

Sep 22, 2016
High

ELSA-2016-1847 3 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

- [3.10.0-327.36.1.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.36.1] - [x86] Use pte_none() to test for empty PTE (Larry Woodman) [1363860 1347159] - [x86] Disallow running with 32-bit PTEs to work around erratum (Larry Woodman) [1363860 13…

Sep 14, 2016
High

ELSA-2016-1844 23 CVEs

Important: libarchive security update (Oracle Linux 7)

[3.1.2-10] - Fixes variation of CVE-2016-5418: Hard links could include '..' in their path. [3.1.2-9] - Fixes CVE-2016-5418: Archive Entry with type 1 (hardlink) causes file overwrite (#1365777) [3.1.2-8] - a bunch of security fixes (rhbz#1353065)

Sep 12, 2016
High

ELSA-2016-3612 1 CVE

Important: ntp security update (Oracle Linux 7)

[4.2.6p5-22.0.1.el7_2.2] - add disable monitor to default ntp.conf [CVE-2013-5211]

Sep 9, 2016
High

ELSA-2016-1809 1 CVE

Important: thunderbird security update (Oracle Linux 7)

[45.3.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [45.3.0-1] - Update to 45.3.0

Sep 5, 2016
High

ELSA-2016-3596 11 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.6] - blk-mq: avoid setting hctx->tags->cpumask before allocation (Akinobu Mita) [Orabug: 24464170] [4.1.12-61.1.3] - ocfs2: improve recovery performance (Junxiao Bi) [Orabug: 24395729] - qed: Utilize FW 8.10.3.0 (Yuval Mintz) [Orabug: …

Aug 26, 2016
High

ELSA-2016-1776 5 CVEs

Important: java-1.6.0-openjdk security update (Oracle Linux 7)

[1:1.6.0.40-1.13.12.4.0.1] - Add oracle-enterprise.patch [1:1.6.0.40-1.13.12.4] - Bump source tarballs to try and really fix TCK failures this time. - Resolves: rhbz#1350043 [1:1.6.0.40-1.13.12.3] - Bump source tarballs to missing -DNDEBUG on JDK native code.…

Aug 26, 2016
High

ELSA-2016-1633 1 CVE

Important: kernel security and bug fix update (Oracle Linux 7)

- [3.10.0-327.28.3.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.28.3] - [net] tcp: enable per-socket rate limiting of all 'challenge acks' (Florian Westphal) [1355603 1355605] {CVE-2016-5696} - [net] tcp: uninline tcp_oow_rate_limited() (Flo…

Aug 18, 2016
High

ELSA-2016-3594 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-37.6.3] - tcp: make challenge acks less predictable (Eric Dumazet) [Orabug: 24010103] [Orabug: 2401010] {CVE-2016-5696}

Aug 15, 2016
High

ELSA-2016-3595 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.10.2] - tcp: make challenge acks less predictable (Eric Dumazet) [Orabug: 24010012] [Orabug: 2401010] {CVE-2016-5696} [3.8.13-118.10.1] - ocfs2: call ocfs2_journal_access_di() before ocfs2_journal_dirty() in ocfs2_write_end_nolock() (ya…

Aug 15, 2016