Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,088 results · Clear filters · Feed

  • High max 7.5
    ELSA-2026-55841 2 CVEs

    Important: unbound security update (Oracle Linux 9)

    [1.24.2-3.4] - Fix CVE-2026-55973 (RHEL-212809)

  • High max 7.6
    ELSA-2026-55865 2 CVEs

    Important: gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update (Oracle Linux 9)

    gstreamer1-plugins-bad-free [1.22.12-7.4] - Fix ADPCM decoder negotiation and input size check (CVE-2026-19387) Resolves: RHEL-235496 gstreamer1-plugins-ugly-free [1.22.12-6.2] - Fix integer overflows during bounds checks in asfdemux - Resolves: RHEL-235519

  • High max 8.1
    ELSA-2026-55439 4 CVEs

    Important: curl security update (Oracle Linux 9)

    [7.76.1-40.el9_8.5] - fix missing %patch macros for Patch46 and Patch47 [7.76.1-40.el9_8.4] - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 120…

  • High max 8.6
    ELSA-2026-55442 6 CVEs

    Important: bind9.18 security update (Oracle Linux 9)

    [32:9.18.29-14.8] - Fix NSEC3 signer validation (CVE-2026-10723, RHEL-215704) [32:9.18.29-14.7] - Reject out-of-zone NSEC next owner names (CVE-2026-13321, RHEL-213314) [32:9.18.29-14.6] - Fix cache exhaustion via dns_slabheaders (CVE-2026-11622, RHEL-213389)…

  • High max 7.5
    ELSA-2026-55424 3 CVEs

    Important: 389-ds-base security update (Oracle Linux 10)

    [3.2.0-9] - Bump version to 3.2.0-9 - Resolves: RHEL-183075 - CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [rhel-10.2.z] - Resolves: RHEL-190776 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer der…

  • High max 9.1
    ELSA-2026-55432 1 CVE

    Important: curl security update (Oracle Linux 10)

    [8.12.1-4.4] - fix proxy environment variable change detection (CVE-2026-8927) [8.12.1-4.el10_2.3] - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - fix proxy connection r…

  • High max 7.6
    ELSA-2026-55433 1 CVE

    Important: gstreamer1-plugins-bad-free security update (Oracle Linux 10)

    [1.26.7-2.7] - Fix ADPCM decoder input validation (CVE-2026-19387) Resolves: RHEL-235500 [1.26.7-2.5] - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats (CVE-2026-59691) Resolves: RHEL-193550 [1.26.7-2.4] - Fix bytes/bits confusion in AV…

  • High max 7.1
    ELSA-2026-55435 1 CVE

    Important: gstreamer1-plugins-ugly-free security update (Oracle Linux 10)

    [1.26.7-2.2] - Fix CVE-2026-19389: integer overflow vulnerabilities in asfdemux Resolves: RHEL-235515

  • High max 8.6
    ELSA-2026-55437 6 CVEs

    Important: bind security update (Oracle Linux 10)

    [9.18.33-15.0.1.el10_2.10] - Hard require needed openssl-libs [Orabug: 38742109] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.18.33-15.10] - Validate NSEC3 signer matches owning zone (CVE-2026-10723) [32:9.18.33-15.9] - Reject …

  • High max 9.0
    ELSA-2026-55448 2 CVEs

    Important: libXfont2 security update (Oracle Linux 10)

    [2.0.6-5.3] - CVE fix for: CVE-2026-59679 Resolves: https://redhat.atlassian.net/browse/RHEL-221949 [2.0.6-5.2] - CVE fix for: CVE-2026-44950 Resolves: https://redhat.atlassian.net/browse/RHEL-222024

  • High max 7.7
    ELSA-2026-55541 3 CVEs

    Important: nodejs22 security update (Oracle Linux 10)

    [1:22.23.1-4.0.1] - Add c-ares as dependency [orabug 39781219] [1:22.23.1-6] - Fix for CVE-2026-69152 [1:22.23.1-5] - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address [1:22.23.1-4] - Fix CVE-2026-13149 (npm/brace-expansion) [1:22.23.1-3] - Fix for CVE-202…

  • High max 7.5
    ELSA-2026-55679 2 CVEs

    Important: haproxy security update (Oracle Linux 10)

    [3.0.5-6.2] - Fix uint16_t overflow in FCGI demux record length (CVE-2026-55203) Resolves: RHEL-211068 - Fix NULL pointer dereference in hpack_dht_insert() (CVE-2026-55204) Resolves: RHEL-211081

  • High max 8.8
    ELSA-2026-55855 11 CVEs

    Important: libssh security update (Oracle Linux 10)

    [0.12.0-3] - Backport CVE fixes from 0.12.2 Resolves: RHEL-213004 Resolves: RHEL-213029 Resolves: RHEL-213032 Resolves: RHEL-213039 Resolves: RHEL-213046 Resolves: RHEL-213079 Resolves: RHEL-213112 Resolves: RHEL-213117 Resolves: RHEL-213148 Resolves: RHEL-21…

  • High max 7.5
    ELSA-2026-55892 2 CVEs

    Important: unbound security update (Oracle Linux 10)

    [1.24.2-18] - Add unit tests for CVE-2026-{44690,55973} [1.24.2-17] - Fix CVE-2026-55973: dns-error-reporting stack buffer overflow [1.24.2-16] - Fix CVE-2026-44690 - Cross-zone wildcard cache poisoning

  • High max 8.1
    ELSA-2026-55450 7 CVEs

    Important: curl security update (Oracle Linux 10)

    [8.12.1-4.4] - fix proxy environment variable change detection (CVE-2026-8927) [8.12.1-4.el10_2.3] - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - fix proxy connection r…

  • High max 7.8
    ELSA-2026-38492 3 CVEs

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 7.8
    ELSA-2026-54371 6 CVEs

    Important: nodejs:24 security update (Oracle Linux 8)

    nodejs [1:24.18.0-3] - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 5.9.0 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 Resolves: RHEL-223388 RHEL-223907 RHEL-223792 [1:24.18.0-3] - Backport patch update sqlite to 3.53.4 F…

  • High max 7.8
    ELSA-2026-54530 5 CVEs

    Important: nodejs:22 security update (Oracle Linux 8)

    nodejs [1:22.23.1-3] - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 2.1.4 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 [1:22.23.1-3] - Backport patch: update sqlite to 3.53.4 Fix: CVE-2026-11824, CVE-2026-11822 Resolves: …

  • High max 7.8
    ELSA-2026-54550 4 CVEs

    Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [9.0.120-1.0.1] - Add support for Oracle Linux [9.0.120-1] - Update to .NET SDK 9.0.120 and Runtime 9.0.19 - Resolves: RHEL-235473

  • High max 7.5
    ELSA-2026-54184 1 CVE

    Important: grafana security update (Oracle Linux 9)

    [10.2.6-23.1] - fix CVE-2026-42127: cap request body size and validate public dashboard access - Resolves RHEL-219382

  • High max 6.0
    ELSA-2026-50773 6 CVEs

    Important: ruby4.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [4.0.6-36] - Upgrade to Ruby 4.0.6. Resolves: RHEL-211310 Resolves: RHEL-193660

  • High max 6.0
    ELSA-2026-50778 6 CVEs

    Important: ruby security, bug fix, and enhancement update (Oracle Linux 10)

    [3.3.12-14] - Upgrade to Ruby 3.3.12. Resolves: RHEL-211300 Resolves: RHEL-193659

  • High max 7.8
    ELSA-2026-36083 9 CVEs

    Important: xorg-x11-server security update (Oracle Linux 7)

    [1.20.4-29.0.9] - Security update for CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264 [Orabug: 39695293] * Tue Jun 09 2026 Ronan Pigott 1.20.4-29.0.7 - Security update for …

  • High max 7.5
    ELSA-2026-54243 2 CVEs

    Important: grafana security update (Oracle Linux 8)

    [9.2.10-32.0.1.el8_10.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-32.1] - Resolves RHEL-219393: CVE-2026-42127 - Resolves RHEL-211017: CVE-2026-33377

  • High max 9.8
    ELSA-2026-54485 4 CVEs

    Important: freerdp security update (Oracle Linux 8)

    [2:2.11.7-11] - Backport several CVE fixes (CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-213173, RHEL-222796, RHEL-222972, RHEL-223606

  • High max 8.6
    ELSA-2026-54509 6 CVEs

    Important: bind9.16 security update (Oracle Linux 8)

    [32:9.16.23-0.22.12] - Fix NSEC3 signer validation (CVE-2026-10723) - Resolves: RHEL-213499 [32:9.16.23-0.22.11] - Reject out-of-zone NSEC next owner names (CVE-2026-13321) - Resolves: RHEL-213313 [32:9.16.23-0.22.10] - Fix CVE-2026-11622: reference-counted D…

  • High max 7.8
    ELSA-2026-54538 4 CVEs

    Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [8.0.130-1.0.1] - Add support for Oracle Linux [8.0.130-1] - Update to .NET SDK 8.0.130 and Runtime 8.0.30 - Resolves: RHEL-235468

  • High max 7.8
    ELSA-2026-54542 4 CVEs

    Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [10.0.111-1.0.1] - Add support for Oracle Linux [10.0.111-1] - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235478

  • High max 8.6
    ELSA-2026-54654 5 CVEs

    Important: bind security update (Oracle Linux 8)

    [32:9.11.36-16.14] - Validate NSEC3 signer matches owning zone (CVE-2026-10723) [32:9.11.36-16.12] - Prevent accepting unsigned NSEC/NSEC3 records (CVE-2026-13204) [32:9.11.36-16.11] - Reject out-of-zone NSEC entries in DNSSEC validation (CVE-2026-13321) [32:…

  • High max 7.5
    ELSA-2026-54575 1 CVE

    Important: dracut security update (Oracle Linux 8)

    [049-246.git20260728.0.1] - Refactor get_ucode_file [Orabug: 36989953] - Revert the fixes for bugs 33676753 and 33888951 due to regressions [Orabug: 35656614] - Fix typo in orabug33888951-dracut-Enable-the-code-to-create-ifcfg-file.patch [Orabug: 35268918] - …

  • High max 7.5
    ELSA-2026-42887 9 CVEs

    Important: java-17-openjdk security update (Oracle Linux 8)

    [1:17.0.20.0.8-1.1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:17.0.20.0.8-1.1] - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8 - Add .0 to prelease [1:17.0.20.0.8-1.1] - Sync NEWS from private-gnu_andrew-rhel-8.5-vanilla [1:1…

  • High max 9.8
    ELSA-2026-54487 4 CVEs

    Important: freerdp security update (Oracle Linux 9)

    [2:2.11.7-7.5] - Backport several CVE fixes (CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-213169, RHEL-222785, RHEL-222966, RHEL-223605

  • High max 8.6
    ELSA-2026-54510 6 CVEs

    Important: bind security update (Oracle Linux 9)

    [9.16.23-40.0.1.el9_8.8] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-40.8] - Fix NSEC3 signer validation (CVE-2026-10723) [32:9.16.23-40.7] - Fix CVE-2026-13321: reject out-of-zone NSEC next owner names [32:9.16.23-40.6]…

  • High max 7.8
    ELSA-2026-54574 4 CVEs

    Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [8.0.130-1.0.1] - Add support for Oracle Linux [8.0.130-1] - Update to .NET SDK 8.0.130 and Runtime 8.0.30 - Resolves: RHEL-235471

  • High max 8.5
    ELSA-2026-53844 2 CVEs

    Important: iscsi-initiator-utils security, bug fix, and enhancement update (Oracle Linux 9)

    [6.2.1.11-1.git4b3e853.0.1.el9_8.2] - iscsi validate interface IP against target address family [Orabug: 39491394] - iscsi delay reconnect until interface has valid IP [Orabug: 38441836] - Correct the typos in email addresses in changelog in OL9.5 [Orabug: 37…

  • High max 7.8
    ELSA-2026-54443 2 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.39.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 7.5
    ELSA-2026-54571 1 CVE

    Important: dracut security update (Oracle Linux 9)

    [057-120.git20260728.0.1] - Skip the default FIPS logic on special UEK kernels where the FIPS module is linked directly into the kernel. [Orabug: 38705580] - Ship Oracle IMA certificate [Orabug: 35992862] - Ship 98-integrity.conf, populating initramfs with Or…

  • High max 9.8
    ELSA-2026-54486 6 CVEs

    Important: freerdp security update (Oracle Linux 10)

    [2:3.10.3-12.8] - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604

  • High max 7.8
    ELSA-2026-54541 4 CVEs

    Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [8.0.130-1.0.1] - Add support for Oracle Linux [8.0.130-1] - Update to .NET SDK 8.0.130 and Runtime 8.0.30 - Resolves: RHEL-235472

  • High max 7.8
    ELSA-2026-54590 4 CVEs

    Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [9.0.120-1.0.1] - Add support for Oracle Linux [9.0.120-1] - Update to .NET SDK 9.0.120 and Runtime 9.0.19 - Resolves: RHEL-235477