Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,088 results · Clear filters · Feed

  • High max 7.3
    ELSA-2026-50978 1 CVE

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-553.153.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 8.8
    ELSA-2026-51105 1 CVE

    Important: LibRaw security update (Oracle Linux 9)

    [0.21.1-2.1] - Fix CVE-2026-51235 Resolves: RHEL-219221

  • High max 7.7
    ELSA-2026-47756 5 CVEs

    Important: openssh security update (Oracle Linux 9)

    [9.9p1-9.0.1] - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM/NIST backport [Orabug: 39423076] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] [9.9p1-9] - CVE-2026-59996: Fix remote glob result of '..' ca…

  • High max 8.8
    ELSA-2026-500137 4 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [5.15.0-322.203.3.4.5] - KVM: x86/mmu: Stop needlessly making MMU pages available for TDP MMU faults (David Matlack) [Orabug: 39832946] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson) [Orabug: 39832946] {CV…

  • High max 9.8
    ELSA-2026-30129 8 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 7.8
    ELSA-2026-51075 1 CVE

    Important: gpsd security update (Oracle Linux 10)

    [3.26.1-3.0.1.el10_2.1] - Replace upstream reference [Orabug: 37033219] [1:3.26.1-3.el10_2.1] - fix command injection in gpsprof (CVE-2026-58459)

  • High max 8.8
    ELSA-2026-500135 4 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-204.92.4.4.3] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson) [Orabug: 39832878] {CVE-2026-64561} - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD)) [Orabug: 398328…

  • High max 8.8
    ELSA-2026-500136 3 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.358.2.0.1] - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD)) [Orabug: 39832992] {CVE-2026-68480} - x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug: 39832992]…

  • High max 9.1
    ELSA-2026-22714 11 CVEs

    Important: osbuild-composer security update (Oracle Linux 9)

    [175-1.0.1] - Track github upstream

  • High max 7.8
    ELSA-2026-50817 3 CVEs

    Important: gimp security update (Oracle Linux 9)

    [2:3.0.4-4.9] - fix CVE-2026-42169 [2:3.0.4-4.8] - fix CVE-2026-66758 - fix CVE-2026-66759

  • High max 9.8
    ELSA-2026-27288 15 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 7.5
    ELSA-2026-50747 1 CVE

    Important: freerdp security update (Oracle Linux 10)

    [2:3.10.3-12.7] - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327

  • High max 7.5
    ELSA-2026-49512 8 CVEs

    Important: mingw-glib2 security update (Oracle Linux 8)

    [2.70.1-9] - Fix CVE-2026-58010: off-by-one error in gvs_tuple_is_normal() Resolves: RHEL-212164 [2.70.1-8] - Fix CVE-2026-58011: g_date_time_add_full() range validation Resolves: RHEL-212184 [2.70.1-7] - Fix CVE-2026-58013: memcmp buffer over-read in giochan…

  • High max 8.2
    ELSA-2026-49520 1 CVE

    Important: ldns security update (Oracle Linux 8)

    [1.7.0-23] - Fix CVE-2026-10846: validate DNS response source address, transaction ID, and query section matching - Resolves: RHEL-210700

  • High max 9.8
    ELSA-2026-49922 33 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [140.13.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.13.0] - Add OpenELA debranding [140.13.0-1] - Update to 140.13.0 ESR

  • High max 9.8
    ELSA-2026-49212 3 CVEs

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-687.33.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 7.5
    ELSA-2026-49838 2 CVEs

    Important: osbuild-composer security, bug fix, and enhancement update (Oracle Linux 9)

    [175-1.0.1] - Track github upstream

  • High max 9.8
    ELSA-2026-49921 33 CVEs

    Important: thunderbird security update (Oracle Linux 9)

    [140.13.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.13.0] - Add OpenELA debranding [140.13.0-1] - Update to 140.13.0 ESR

  • High max 9.2
    ELSA-2026-48034 3 CVEs

    Important: nodejs24 security update (Oracle Linux 10)

    [1:24.18.0-3.0.1] - Update upstream references [1:24.18.0-3] - Fix CVE-2026-13149 (brace-expansion) [1:24.18.0-2] - Fix CVE-2026-59873 and CVE-2026-59874 (nodejs-tar)

  • High max 9.8
    ELSA-2026-49211 3 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.42.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 7.5
    ELSA-2026-49526 2 CVEs

    Important: osbuild-composer security update (Oracle Linux 10)

    [176-1.0.1] - Track github upstream

  • High max 7.5
    ELSA-2026-49511 1 CVE

    Important: frr security update (Oracle Linux 8)

    [7.5.1-25.0.1] - Fix POSTIN scriptlet [Orabug: 34712485] [7.5.1-25] - Fix EVPN and ENCAP/VNC packet parsing validation (CVE-2026-37460) - Resolves: RHEL-193233

  • High max 7.5
    ELSA-2026-49524 1 CVE

    Important: perl-Archive-Tar security update (Oracle Linux 8)

    [2.30-3] - Fix CVE-2026-9538: cap per-entry declared size during tar read to defend against attacker-controlled size-field memory DoS - Resolves: RHEL-191913

  • High max 9.8
    ELSA-2026-49214 4 CVEs

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.150.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 9.8
    ELSA-2026-500121 5 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.358.2] - xfs: resample the data fork mapping after cycling ILOCK (Darrick J. Wong) [Orabug: 39776792] {CVE-2026-64600} - net: Work around Marvell NIC TX stalls (Venkat Venkatsubra) [Orabug: 39765820] [5.4.17-2136.358.1] - KVM: x86: Fix shadow pag…

  • High max 7.5
    ELSA-2026-49525 1 CVE

    Important: perl-Archive-Tar security update (Oracle Linux 9)

    [2.38-6.2] - Fix CVE-2026-9538: add cap for tar entry size during read to prevent memory allocation DoS - Resolves: RHEL-191917

  • High max 7.5
    ELSA-2026-49527 1 CVE

    Important: frr security, bug fix, and enhancement update (Oracle Linux 9)

    [8.5.3-15.1] - Resolves: RHEL-193234 - input validation fixes for EVPN NLRI and ENCAP/VNC packet parsing [8.5.3-15] - Resolves: RHEL-176258 - AVC when reading user's site-packages [8.5.3-14] - Resolves: RHEL-152300 - ignored route in the kernel after flapping…

  • High max 9.8
    ELSA-2026-49612 2 CVEs

    Important: perl-DBI security update (Oracle Linux 9)

    [1.643-9.3] - Fix unsafe string eval in DBI::Profile (CVE-2026-14380) - Resolves: RHEL-211149 [1.643-9.2] - Set a hard limit of 99999 on '?' placeholders (CVE-2026-14739) - Resolves: RHEL-193306

  • High max 7.5
    ELSA-2026-49607 1 CVE

    Important: frr10 security, bug fix, and enhancement update (Oracle Linux 9)

    [10.4.3-3.2] - Resolves: RHEL-222338 - AVC when reading user's site-packages [10.4.3-3.1] - Fix CVE-2026-37460: improve packet parsing for EVPN and ENCAP/VNC - Resolves: RHEL-193232

  • High max 7.8
    ELSA-2026-49508 1 CVE

    Important: gstreamer1-plugins-good security update (Oracle Linux 10)

    [1.26.7-2.2] - Fix integer overflow and bounds check vulnerabilities in uncompressed video handling (CVE-2026-5056) Resolves: RHEL-222333

  • High max 9.8
    ELSA-2026-49514 2 CVEs

    Important: perl-DBI security update (Oracle Linux 10)

    [1.643-26.3] - Fix CVE-2026-14380: unsafe string eval in DBI::Profile - Resolves: RHEL-211146 [1.643-26.2] - Fix CVE-2026-14739: set a hard limit of 99999 on '?' placeholders - Resolves: RHEL-193293

  • High max 7.5
    ELSA-2026-49523 1 CVE

    Important: perl-Archive-Tar security update (Oracle Linux 10)

    [3.02-512.2] - Fix CVE-2026-9538: cap per-entry declared size during archive reading to prevent memory DoS - Resolves: RHEL-191918

  • High max 9.8
    ELSA-2026-49621 33 CVEs

    Important: thunderbird security update (Oracle Linux 10)

    [140.13.0-1.0.1] - Add Oracle prefs [140.13.0-1] - Update to 140.13.0 ESR

  • High max 8.2
    ELSA-2026-49836 1 CVE

    Important: ldns security update (Oracle Linux 10)

    [1.8.3-18.1] - Fix CVE-2026-10846: Off-path poisoning attacks due to insufficient query-response matching (RHEL-210690)

  • High max 7.5
    ELSA-2026-48225 1 CVE

    Important: perl:5.32 security update (Oracle Linux 8)

    perl [4:5.32.1-474] - Resolves: RHEL-153834 - Fix CVE-2025-40909 - Clone dirhandles without fchdir perl-Algorithm-Diff [1.1903-10] - Rebuild with enable hardening (bug #1636329) perl-Archive-Tar [2.38-5] - Fix CVE-2026-9538: Denial of Service via crafted tar …

  • High max 8.8
    ELSA-2026-41948 1 CVE

    Important: javapackages-tools:201801 security update (Oracle Linux 8)

    ant-contrib [1.0-0.32.b3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [1.0-0.31.b3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild [1.0-0.30.b3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild […

  • High max 9.2
    ELSA-2026-47057 3 CVEs

    Important: nodejs:24 security update (Oracle Linux 9)

    nodejs [1:24.18.0-3] - Fix CVE-2026-59873, CVE-2026-59874 (node-tar) in npm's bundled tar [1:24.18.0-2] - Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion [1:24.18.0-1] - Update to version 24.18.0 [1:24.14.1-2] - Update bundled nghttp2 to…

  • High max 8.8
    ELSA-2026-22146 1 CVE

    Important: PackageKit security update (Oracle Linux 7)

    [1.1.10-2.0.3] - Backport fix for CVE-2026-41651 [Orabug: 39467887]

  • High max 7.8
    ELSA-2026-26168 4 CVEs

    Important: gimp security update (Oracle Linux 7)

    [2:2.8.22-1.0.9] - Fixes CVE-2026-4150, CVE-2026-4153, CVE-2026-4154, and CVE-2026-4887 [Orabug: 39564202] [2:2.8.22-1.0.7] - Fixes CVE-2025-14422 [Orabug: 38904303] [2:2.22-1.0.5] - Fixes CVE-2025-10922 and CVE-2025-10934 [Orabug: 38739185] [2:2.8.22-1.0.3] …

  • High max 7.8
    ELSA-2026-24992 1 CVE

    Important: compat-libtiff3 security update (Oracle Linux 7)

    [3.9.4-12.0.3] - Backport fix for CVE-2026-4775 [Orabug: 39535879] [3.9.4-12.0.1] - Fixes CVE-2025-9900 buffer underflow [Orabug: 38523840]