Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,096 results · Clear filters · Feed

High

ELSA-2016-0204 1 CVE

Important: 389-ds-base security and bug fix update (Oracle Linux 7)

[1.3.4.0-26] - release 1.3.4.0-26 - Resolves: bug 1299346 - deadlock on connection mutex (DS 48341) [1.3.4.0-25] - release 1.3.4.0-25 - Resolves: bug 1299757 - CVE-2016-0741 389-ds-base: Worker threads do not detect abnormally closed connections causing DoS […

Feb 16, 2016
High

ELSA-2016-0185 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

- [3.10.0-327.10.1.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.10.1] - [of] return NUMA_NO_NODE from fallback of_node_to_nid() (Thadeu Lima de Souza Cascardo) [1300614 1294398] - [net] openvswitch: do not allocate memory from offline numa n…

Feb 16, 2016
High

ELSA-2015-1066 28 CVEs

Important: php54 security and bug fix update (Oracle Linux 7)

php54 [2.0-1] - fix incorrect selinux contexts #1194332 php54-php [5.4.40-1] - rebase to PHP 5.4.40 for various security fix #1209887 [5.4.37-1] - rebase to PHP 5.4.37 [5.4.36-1] - rebase to PHP 5.4.36 #1168193 - fix package name in description - php-fpm own …

Feb 4, 2016
High

ELSA-2015-1186 18 CVEs

Important: php55-php security update (Oracle Linux 7)

[5.5.21-4] - fix more functions accept paths with NUL character #1213407 [5.5.21-3] - core: fix multipart/form-data request can use excessive amount of CPU usage CVE-2015-4024 - fix various functions accept paths with NUL character CVE-2015-4025, CVE-2015-402…

Feb 4, 2016
High

ELSA-2016-0083 1 CVE

Important: qemu-kvm security and bug fix update (Oracle Linux 7)

[1.5.3-105.el7_2.3] - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298047] - Resolves: bz#1298047 (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-7.2.z]) [1.5.3-105.el7_2.2] - kvm-raw-pos…

Jan 28, 2016
High

ELSA-2016-0067 5 CVEs

Important: java-1.6.0-openjdk security update (Oracle Linux 7)

[1.6.0.38-1.13.10.0.0.1] - Add oracle-enterprise.patch [1:1.6.0.38-1.13.10.0] - Add patch to replace -fno-strict-overflow with -fwrapv on older RHEL 5.11 GCC. - Resolves: rhbz#1295772 [1:1.6.0.38-1.13.10.0] - Update to IcedTea 1.13.10 & OpenJDK 6 b38. - Resol…

Jan 26, 2016
High

ELSA-2016-0063 1 CVE

Important: ntp security update (Oracle Linux 7)

[4.2.6p5-5.el6_7.4] - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)

Jan 25, 2016
High

ELSA-2016-0064 1 CVE

Important: kernel security update (Oracle Linux 7)

[3.10.0-327.4.5.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.4.5] - [security] keys: Fix keyring ref leak in join_session_keyring() (David Howells) [1298931 1298036] {CVE-2016-0728}

Jan 25, 2016
High

ELSA-2016-0054 7 CVEs

Important: java-1.7.0-openjdk security update (Oracle Linux 7)

[1.7.0.95-2.6.4.0.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.95-2.6.4.0] - Bump to 2.6.4 and u95b00. - Backport tarball creation script from OpenJDK 8 RPMs and update fsg.sh to work with it. - Drop 8072932or8074489 patch as applied upstream in u91b01. - A…

Jan 21, 2016
High

ELSA-2016-3509 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.2.5] - KEYS: Fix keyring ref leak in join_session_keyring() (Yevgeny Pats) [Orabug: 22563965] {CVE-2016-0728}

Jan 20, 2016
High

ELSA-2016-3510 1 CVE

Important: kernel-uek security update (Oracle Linux 7)

kernel-uek [4.1.12-32.1.2] - KEYS: Fix keyring ref leak in join_session_keyring() (Yevgeny Pats) [Orabug: 22563965] {CVE-2016-0728} [4.1.12-32.1.1] - ocfs2: return non-zero st_blocks for inline data (John Haxby) [Orabug: 22218243] - xen/events/fifo: Consume u…

Jan 20, 2016
High

ELSA-2016-3501 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.2.4] - KEYS: Don't permit request_key() to construct a new keyring (David Howells) [Orabug: 22373442] {CVE-2015-7872} [3.8.13-118.2.3] - dcache: Handle escaped paths in prepend_path (Eric W. Biederman) [Orabug: 22373283] - vfs: Test for…

Jan 8, 2016
High

ELSA-2016-0001 5 CVEs

Important: thunderbird security update (Oracle Linux 7)

[38.5.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [38.5.0-1] - Update to 38.5.0

Jan 5, 2016
High

ELSA-2015-2655 1 CVE

Important: bind security update (Oracle Linux 7)

[32:9.8.2-0.44.rc1.5] - Fix CVE-2015-8000

Dec 16, 2015
High max 10.0

ELSA-2015-3107 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.2.2] - KVM: svm: unconditionally intercept #DB (Paolo Bonzini) [Orabug: 22333698] {CVE-2015-8104} - KVM: x86: work around infinite loop in microcode when #AC is delivered (Eric Northup) [Orabug: 22333689] {CVE-2015-5307} {CVE-2015-5307}…

Dec 10, 2015
High max 10.0

ELSA-2015-2552 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-327.3.1.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.3.1] - rebuild [3.10.0-327.2.1] - [netdrv] macvtap: unbreak receiving of gro skb with frag list (Jason Wang) [1279794 1273737] - [net] ipv6: drop frames with attached skb->sk in fo…

Dec 8, 2015
High max 9.8

ELSA-2015-2522 1 CVE 1 exploited

Important: apache-commons-collections security update (Oracle Linux 7)

[3.2.1-22] - Fix Java object de-serialization vulnerability - Resolves: CVE-2015-7501

Nov 30, 2015
High

ELSA-2015-3101 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.2.1] - ipc/sem.c: fully initialize sem_array before making it visible (Manfred Spraul) [Orabug: 22277382] {CVE-2015-7613} - ipc: fix msg newqueue add (Guru Anbalagane) [Orabug: 22277382] {CVE-2015-7613} [3.8.13-118.1.1] - sctp: fix race…

Nov 27, 2015
High

ELSA-2015-2519 7 CVEs

Important: thunderbird security update (Oracle Linux 7)

[38.4.0-1.0.1.el6_7] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [38.4.0-1] - Update to 38.4.0

Nov 27, 2015
High

ELSA-2015-2172 1 CVE

Important: glibc security update (Oracle Linux 7)

[2.17-106.0.1.1] - Remove strstr and strcasestr implementations using sse4.2 instructions. - Upstream commits 584b18eb4df61ccd447db2dfe8c8a7901f8c8598 and 1818483b15d22016b0eae41d37ee91cc87b37510 backported. [2.17-106.1] - Rebuild with corrected release. [2.1…

Nov 25, 2015
High

ELSA-2015-2152 15 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

[3.10.0-327.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327] - [mm] free compound page with correct order (Andrea Arcangeli) [1274867] - [netdrv] revert 'ixgbe: Refactor busy poll socket code to address multiple issues' (John Greene) [1261275] …

Nov 24, 2015
High

ELSA-2015-2086 16 CVEs

Important: java-1.6.0-openjdk security update (Oracle Linux 7)

[1:1.6.0.35-1.13.9.4.0.1.el5_11] - Add oracle-enterprise.patch [1:1.6.0.37-1.13.9.4] - Update with new IcedTea & b37 tarballs, including fix for appletviewer regression. - Resolves: rhbz#1271926 [1:1.6.0.37-1.13.9.3] - Update with new IcedTea & b37 tarballs, …

Nov 18, 2015
High

ELSA-2015-3098 3 CVEs

Important: Unbreakable Enterprise kernel security and bugfix update (Oracle Linux 7)

kernel-uek [3.8.13-118] - Update ql2400/ql2500 firmware version to 8.02.00 (Dan Duval) [Orabug: 22159505] - update qla2400/ql2500 firmware version to 8.02.00 (Dan Duval) [Orabug: 22159505] [3.8.13-117] - virtio-net: drop NETIF_F_FRAGLIST (Jason Wang) [Orabug:…

Nov 13, 2015
High

ELSA-2015-1930 2 CVEs

Important: ntp security update (Oracle Linux 7)

[4.2.6p5-5.el6_7.2] - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704) - allow only one step larger than panic threshold with -g (CVE-2015-5300)

Oct 26, 2015
High

ELSA-2015-1919 18 CVEs

Important: java-1.8.0-openjdk security update (Oracle Linux 7)

[1:1.8.0.65-0.b17] - October 2015 security update to u65b17. - Add script for generating OpenJDK tarballs from a local Mercurial tree. - Update RH1191652 patch to build against current AArch64 tree. - Use appropriate source ID to avoid unpacking both tarballs…

Oct 21, 2015
High

ELSA-2015-1917 4 CVEs

Important: libwmf security update (Oracle Linux 7)

[0.2.8.4-25] - Resolves: rhbz#1227428 - CVE-2015-0848 CVE-2015-4588 CVE-2015-4695 CVE-2015-4696 [0.2.8.4-24] - Resolves: rhbz#1227429 CVE-2015-0848 libwmf: heap overflow when decoding BMP images

Oct 20, 2015
High

ELSA-2015-3087 1 CVE

Important: lxc security update (Oracle Linux 7)

[1.0.7-2.0.12] - [Orabug 22011867] ol6 ct shutdown script remounts /dev/pts/* devices as ro on host system. [1.0.7-2.0.11] - [Orabug 21842483] failed to create directory '/RUN/LXC/LOCK//CONTAINER/OL7.1/SNAPS' - CVE-2015-1335: Protect container mounts against …

Oct 15, 2015
High

ELSA-2015-3085 2 CVEs

Important: docker-engine security update (Oracle Linux 7)

[1.8.3-1.0.1] - Enable configuration of Docker daemon via sysconfig [orabug 21804877] - Add documentation files to binary RPM [1.8.3] - Fix layer IDs lead to local graph poisoning (CVE-2014-8178) - Fix manifest validation and parsing logic errors allow pull-b…

Oct 14, 2015
High

ELSA-2015-1890 2 CVEs

Important: spice security update (Oracle Linux 7)

[0.12.4-9.3] - CVE-2015-5260 CVE-2015-5261 fixed various security flaws Resolves: rhbz#1262771 [0.12.4-9.2] - Validate surface_id Resolves: rhbz#1262771

Oct 12, 2015
High

ELSA-2015-1852 12 CVEs

Important: thunderbird security update (Oracle Linux 7)

[38.3.0-1.0.1.el6_7] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [38.3.0-1] - Update to 38.3.0

Oct 1, 2015
High

ELSA-2015-1840 1 CVE

Important: openldap security update (Oracle Linux 7)

[2.3.43-29] - CVE-2015-6908 openldap: ber_get_next denial of service vulnerability (#1263170)

Sep 29, 2015
High

ELSA-2015-3078 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-98.2.2] - sctp: fix ASCONF list handling (Marcelo Ricardo Leitner) [Orabug: 21842668] {CVE-2015-3212} - KEYS: ensure we free the assoc array edit if edit is valid (Colin Ian King) [Orabug: 21842655] {CVE-2015-1333}

Sep 16, 2015
High

ELSA-2015-1778 7 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-229.14.1.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-229.14.1] - [s390] zcrypt: Fixed reset and interrupt handling of AP queues (Hendrik Brueckner) [1248381 1238230] [3.10.0-229.13.1] - [dma] ioat: fix tasklet tear down (Herton R. Krzes…

Sep 15, 2015
High

ELSA-2015-1741 1 CVE

Important: haproxy security update (Oracle Linux 7)

[1.5.4-4.1] - Fix buffer_slow_realign() function to respect output data (CVE-2015-3281, #1241537)

Sep 8, 2015
High

ELSA-2015-1705 1 CVE

Important: bind security update (Oracle Linux 7)

[32:9.8.2-0.37.rc1.4] - Apply previously not applied patch for CVE-2015-5722 [32:9.8.2-0.37.rc1.3] - Fix CVE-2015-5722

Sep 3, 2015
High

ELSA-2015-1708 3 CVEs

Important: libXfont security update (Oracle Linux 7)

[1.4.5-5] - CVE-2015-1802: missing range check in bdfReadProperties (bug 1258892) - CVE-2015-1803: crash on invalid read in bdfReadCharacters (bug 1258892) - CVE-2015-1804: out-of-bounds memory access in bdfReadCharacters (bug 1258892)

Sep 3, 2015
High

ELSA-2015-1714 1 CVE

Important: spice security update (Oracle Linux 7)

[0.12.4-9.1] - Avoid race conditions reading monitor configs from guest. This race could trigger memory corruption host-side Resolves: rhbz#1239127

Sep 3, 2015
High

ELSA-2015-1695 1 CVE

Important: jakarta-taglibs-standard security update (Oracle Linux 7)

[0:1.1.1-11.7] - Gracefully handle parsers without FSP support (e.g. Java 5 GCJ) - Resolves: CVE-2015-0254 [0:1.1.1-11.6] - Prevent XXE and RCE in JSTL XML tags - Apply correction for previous CVE-2015-0254 patch (prevent XXE in <x:transform>) - Resolves: CVE…

Aug 31, 2015
High

ELSA-2015-1682 5 CVEs

Important: thunderbird security update (Oracle Linux 7)

[38.2.0-4.0.1.el6_7] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [38.2.0-4] - Update to 38.2.0 [38.1.0-4] - Update to 38.1.0

Aug 25, 2015
High

ELSA-2015-3071 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-98.1.2] - udp: fix behavior of wrong checksums (Eric Dumazet) [Orabug: 21628850] {CVE-2015-5364} {CVE-2015-5366}

Aug 14, 2015