Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,096 results · Clear filters · Feed

High

ELSA-2016-1602 16 CVEs

Important: mariadb security update (Oracle Linux 7)

[1:5.5.50-1] - Rebase to 5.5.50 Resolves: #1359628

Aug 11, 2016
High

ELSA-2016-3591 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.9.2] - KEYS: potential uninitialized variable (Dan Carpenter) [Orabug: 24393864] {CVE-2016-4470}

Aug 4, 2016
High

ELSA-2016-3593 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-37.6.2] - KEYS: potential uninitialized variable (Dan Carpenter) [Orabug: 24393865] {CVE-2016-4470} - ovl: fix permission checking for setattr (Miklos Szeredi) [Orabug: 24393742] {CVE-2015-8660}

Aug 4, 2016
High

ELSA-2016-1539 3 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-327.28.2.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.28.2] - [net] bridge: include in6.h in if_bridge.h for struct in6_addr (Jiri Benc) [1331285 1268057] - [net] inet: defines IPPROTO_* needed for module alias generation (Jiri Benc)…

Aug 2, 2016
High

ELSA-2016-1546 19 CVEs

Important: libtiff security update (Oracle Linux 7)

[4.0.3-25] - Add patches for CVEs: CVE-2015-7554, CVE-2015-8683, CVE-2015-8665, CVE-2015-8781, CVE-2015-8782, CVE-2015-8783, CVE-2015-8784 - Related: #1299920 [4.0.3-24] - Update patches for CVEs: CVE-2014-8127, CVE-2014-8130 - Related: #1299920 [4.0.3-23] - …

Aug 2, 2016
High

ELSA-2016-3587 3 CVEs

Important: kernel-uek security update (Oracle Linux 7)

kernel-uek [4.1.12-37.6.1] - vfs: rename: check backing inode being equal (Miklos Szeredi) [Orabug: 24010060] {CVE-2016-6198} {CVE-2016-6197} - vfs: add vfs_select_inode() helper (Miklos Szeredi) [Orabug: 24010060] {CVE-2016-6198} {CVE-2016-6197} - ovl: verif…

Jul 29, 2016
High

ELSA-2016-3588 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.9.1] - mlx4: Increase SYNC_TPT command timeout (Mukesh Kacker) [Orabug: 22895790] - neigh: do not modify unlinked entries (Julian Anastasov) [Orabug: 23072705] - mm/slab: Improve performance of slabinfo stats gathering (Aruna Ramakrishn…

Jul 29, 2016
High

ELSA-2016-1504 7 CVEs

Important: java-1.7.0-openjdk security update (Oracle Linux 7)

[1:1.7.0.111-2.6.7.1.0.1] - Add oracle-enterprise.patch - Fix DISTRO_NAME to 'Oracle Linux' [1:1.7.0.111-2.6.7.1] - Bump to jdk7u111 b01 to fix TCK regressions (7081817 & 8162344) - Resolves: rhbz#1350038 [1:1.7.0.111-2.6.7.0] - Bump to 2.6.7 and u111b00. - U…

Jul 27, 2016
High

ELSA-2016-1422 1 CVE

Important: httpd security and bug fix update (Oracle Linux 7)

[2.4.6-40.0.1.4] - replace index.html with Oracle's index page oracle_index.html [2.4.6-40.4] - add security fix for CVE-2016-5387 [2.4.6-40.3] - add 451 (Unavailable For Legal Reasons) response status-code (#1353269) [2.4.6-40.2] - mod_cache: treat cache as …

Jul 18, 2016
High

ELSA-2016-1392 1 CVE

Important: thunderbird security update (Oracle Linux 7)

[45.2-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [45.2-1] - Update to 45.2 [45.1.1-1] - Update to 45.1.1 [45.1.0-5] - Do not add symlinks to some langpacks [45.1.0-4] - Update to 45.1.0 [45.0-5] - Update to …

Jul 11, 2016
High max 8.1

ELSA-2016-1292 14 CVEs

Important: libxml2 security update (Oracle Linux 7)

[2.9.1-6.0.1.3] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [libxml2-2.9.1-6.3] - Heap-based buffer overread in xmlNextChar (CVE-2016-1762) - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugz…

Jun 23, 2016
High

ELSA-2016-1293 3 CVEs

Important: setroubleshoot and setroubleshoot-plugins security update (Oracle Linux 7)

setroubleshoot [3.2.24-4.0.1] - Add setroubleshoot-oracle-enterprise.patch to change bug reporting URL to linux.oracle.com [3.2.24-4] - Catch all subprocess module exceptions [3.2.24-3] - Use subprocess.check_output() with a sequence of program arguments [3.2…

Jun 23, 2016
High

ELSA-2016-1277 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

- [3.10.0-327.22.2.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.22.2] - [infiniband] security: Restrict use of the write() interface (Don Dutile) [1332553 1316685] {CVE-2016-4565} [3.10.0-327.22.1] - [mm] mmu_notifier: fix memory corruption …

Jun 23, 2016
High

ELSA-2016-1237 7 CVEs

Important: ImageMagick security update (Oracle Linux 7)

[6.7.2.7-5] - Add fix for CVE-2016-3714, CVE-2016-3715, CVE-2016-3716 and CVE-2016-3717

Jun 16, 2016
High

ELSA-2016-3570 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-37.5.1] - sched/core: Clear the root_domain cpumasks in init_rootdomain() (Xunlei Pang) [Orabug: 23520741] - ocfs2: bump up o2cb network protocol version (Junxiao Bi) [Orabug: 23515810] - IB/security: Restrict use of the write() interface (…

Jun 13, 2016
High

ELSA-2016-3573 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.7.1] - megaraid_sas : Update threshold based reply post host index register (Sumit.Saxena@avagotech.com) [Orabug: 23562756] - xen/events: Don't move disabled irqs (Ross Lagerwall) [Orabug: 23055234] - xen/events: Mask a moving irq (Bori…

Jun 13, 2016
High

ELSA-2016-1205 2 CVEs

Important: spice security update (Oracle Linux 7)

[0.12.4-15.1] - Fix heap-based memory corruption within smartcard handling Resolves: CVE-2016-0749 - Fix host memory access from guest with invalid primary surface parameters Resolves: CVE-2016-2150

Jun 6, 2016
High max 7.8

ELSA-2016-3568 1 CVE

Important: docker-engine security update (Oracle Linux 7)

[1.10.3-1.0.3] - CVE-2016-3697: docker: Potential privilege escalation via confusion of usernames and UIDs [orabug 23279003]

May 20, 2016
High

ELSA-2016-3565 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.6.2] - KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. (David Howells) [Orabug: 23279020] {CVE-2016-0758} - net: add validation for the socket syscall protocol argument (Hannes Frederic Sowa) [Orabug: 23267997…

May 20, 2016
High

ELSA-2016-3559 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-37.3.1] - KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. (David Howells) [Orabug: 23279022] {CVE-2016-0758} - uek-rpm: ol6: revert DRM for experimental or OL6-incompatible drivers (Todd Vierling) [Orabug: 2327082…

May 16, 2016
High

ELSA-2016-1041 2 CVEs

Important: thunderbird security update (Oracle Linux 7)

[38.8.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [38.8.0-2] - Update to 38.8.0

May 12, 2016
High

ELSA-2016-1033 1 CVE

Important: kernel security and bug fix update (Oracle Linux 7)

- [3.10.0-327.18.2.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.18.2] - [lib] keys: Fix ASN.1 indefinite length object parsing (David Howells) [1308814 1308815] {CVE-2016-0758} [3.10.0-327.18.1] - [scsi] bnx2fc: Fix FCP RSP residual parsing …

May 12, 2016
High

ELSA-2016-1025 8 CVEs

Important: pcre security update (Oracle Linux 7)

[8.32-15.1] - Fix CVE-2015-2328 (infinite recursion compiling pattern with recursive reference in a group with indefinite repeat) (bug #1330508) - Fix CVE-2015-8385 (buffer overflow caused by named forward reference to duplicate group number) (bug #1330508) -…

May 11, 2016
High max 8.4

ELSA-2016-0726 5 CVEs 3 exploited

Important: ImageMagick security update (Oracle Linux 7)

[6.7.2.7-4] - Add fix for CVE-2016-3714, CVE-2016-3715, CVE-2016-3716 and CVE-2016-3717

May 9, 2016
High

ELSA-2016-0722 7 CVEs

Important: openssl security update (Oracle Linux 7)

[1.0.1e-51.5] - fix CVE-2016-2105 - possible overflow in base64 encoding - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate() - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC - fix CVE-2016-2108 - memory corruption in ASN.1 encoder - …

May 9, 2016
High

ELSA-2016-0724 1 CVE

Important: qemu-kvm security update (Oracle Linux 7)

[1.5.3-105.el7_2.4] - kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patch [bz#1331412] - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.patch [bz#1331412] - kvm-vga-add-vbe_enabled-helper.patch [bz#1331412] - kvm-vga-factor-out-vga-register-set…

May 9, 2016
High max 8.8

ELSA-2016-0706 2 CVEs

Important: mercurial security update (Oracle Linux 7)

[2.6.2-6] - fix previous patch for CVE-2016-3069 [2.6.2-5] - Fix CVE-2016-3068 and CVE-2016-3069

May 2, 2016
High

ELSA-2016-0594 4 CVEs

Important: graphite2 security, bug fix, and enhancement update (Oracle Linux 7)

[1.3.6-1] - Related: rhbz#1309052 CVE-2016-1521 CVE-2016-1522 CVE-2016-1523 CVE-2016-1526 [1.3.5-1] - Resolves: rhbz#1309052 CVE-2016-1521 CVE-2016-1522 CVE-2016-1523 CVE-2016-1526 [1.2.4-6] - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild …

Apr 5, 2016
High

ELSA-2016-3529 2 CVEs

Important: kernel-uek security update (Oracle Linux 7)

kernel-uek [4.1.12-32.2.3] - rebuild bumping release [4.1.12-32.2.2] - x86/iopl/64: properly context-switch IOPL on Xen PV (Andy Lutomirski) [Orabug: 22997978] {CVE-2016-3157} - fs/hugetlbfs/inode.c: fix bugs in hugetlb_vmtruncate_list() (Mike Kravetz) [Orabu…

Mar 28, 2016
High

ELSA-2016-0512 1 CVE

Important: java-1.7.0-openjdk security update (Oracle Linux 7)

[1:1.7.0.99-2.6.5.0.0.1] - Add oracle-enterprise.patch - Fix DISTRO_NAME to 'Oracle Linux' [1:1.7.0.99-2.6.5.0] - Explictly required libXcomposite-devel for PR2867 as nothing else pulls it in - Resolves: rhbz#1320655

Mar 24, 2016
High

ELSA-2016-3528 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.4.2] - pipe: Fix buffer offset after partially failed read (Ben Hutchings) [Orabug: 22985903] {CVE-2016-0774} {CVE-2015-1805} {CVE-2016-0774}

Mar 23, 2016
High

ELSA-2016-0496 2 CVEs

Important: git security update (Oracle Linux 7)

[1.7.1-4.1] - fix heap overflow CVE-2016-2315 CVE-2016-2324 Resolves: #1318252 [1.7.1-4] - fix CVE-2013-0308

Mar 23, 2016
High

ELSA-2016-0459 2 CVEs

Important: bind security update (Oracle Linux 7)

[30:9.3.6-25.P1.8] - Fix issue with patch for CVE-2016-1285 and CVE-2016-1286 found by test suite [30:9.3.6-25.P1.7] - Fix CVE-2016-1285 and CVE-2016-1286

Mar 16, 2016
High

ELSA-2016-0460 22 CVEs

Important: thunderbird security update (Oracle Linux 7)

[38.7.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [38.7.0-1] - Update to 38.7.0

Mar 16, 2016
High

ELSA-2016-0430 1 CVE

Important: xerces-c security update (Oracle Linux 7)

[3.1.1-8] Resolves: CVE-2016-0729

Mar 10, 2016
High

ELSA-2016-0372 5 CVEs

Important: openssl098e security update (Oracle Linux 7)

[0.9.8e-20.0.1.1] - Updated the description [0.9.8e-20.1] - fix CVE-2015-0293 - triggerable assert in SSLv2 server - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement - disable SSLv2 in the generic TLS method [0.9.8e-20] - fix for CVE-2014-0224 - SSL/TLS MITM…

Mar 9, 2016
High

ELSA-2016-0346 1 CVE

Important: postgresql security update (Oracle Linux 7)

[9.2.15-1] - update to 9.2.15 per release notes http://www.postgresql.org/docs/9.2/static/release-9-2-15.html

Mar 2, 2016
High

ELSA-2016-0301 5 CVEs

Important: openssl security update (Oracle Linux 7)

[1.0.1e-42.4] - fix CVE-2016-0702 - side channel attack on modular exponentiation - fix CVE-2016-0705 - double-free in DSA private key parsing - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn [1.0.1e-42.3] - fix CVE-2015-3197 - SSLv2 ciphersui…

Mar 1, 2016
High

ELSA-2016-3519 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.3.2] - x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection (Andy Lutomirski) [Orabug: 22742507] {CVE-2015-5157} - x86/nmi/64: Reorder nested NMI checks (Andy Lutomirski) [Orabug: 22742507] {CVE-2015-5157} - x86/nmi/…

Feb 18, 2016
High

ELSA-2016-0258 2 CVEs

Important: thunderbird security update (Oracle Linux 7)

[38.6.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [38.6.0-1] - Update to 38.6.0

Feb 18, 2016