Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,088 results · Clear filters · Feed

High max 7.4

ELSA-2026-25172 1 CVE

Important: rsync security update (Oracle Linux 7)

[3.1.2-12.0.5] - Backport fix for CVE-2026-41035 [Orabug: 39542074] [3.1.2-12.0.3] - Fix CVE-2024-12087 [Orabug: 38771262] [3.1.2-12.0.1] - Back port fix for CVE-2024-12085 [Orabug: 37524229]

Jul 30, 2026
High max 8.3

ELSA-2026-48021 2 CVEs

Important: python-pillow security update (Oracle Linux 8)

[5.1.1-23] - Security fix for CVE-2026-54058, CVE-2026-59197 Resolves: RHEL-211857, RHEL-211848

Jul 30, 2026
High max 8.4

ELSA-2026-48703 4 CVEs

Important: vim security update (Oracle Linux 8)

[8.0.1763-31.0.1] - Remove upstream references [Orabug: 31197557] - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984] [2:8.0.1763-31] - RHEL-203873 CVE-2026-59858 vim: arbitrary Ex command execution in C omni-completion [2:8.…

Jul 30, 2026
High max 9.8

ELSA-2026-47011 1 CVE

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.148.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Jul 30, 2026
High max 8.4

ELSA-2026-47982 5 CVEs

Important: vim security update (Oracle Linux 9)

[8.2.2637-26.0.1.el9_8.13] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-26.13] - RHEL-203985 CVE-2026-59858 vim: arbitrary Ex command execution in C omni-completion - RHEL-201197 CVE-2026-59856 vim: potential command execution in PHP omni-compl…

Jul 30, 2026
High max 8.8

ELSA-2026-47040 5 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.31.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Jul 30, 2026
High max 7.7

ELSA-2026-47757 5 CVEs

Important: openssh security update (Oracle Linux 10)

[9.9p1-25.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-25] - CVE-2026-59996: Fix remote glob result of '..' causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host …

Jul 30, 2026
High max 7.5

ELSA-2026-48585 1 CVE

Important: fence-agents security update (Oracle Linux 10)

[4.16.0-21.5] - bundled httplib2: upgrade to v0.32.0 to fix CVE-2026-59939 Resolves: RHEL-193812

Jul 30, 2026
High max 8.4

ELSA-2026-48650 5 CVEs

Important: vim security update (Oracle Linux 10)

[9.1.083-9.0.1.el10_2.12] - Remove upstream references [Orabug: 31197557] [2:9.1.083-9.12] - RHEL-201113 CVE-2026-59856 vim: potential command execution in PHP omni-completion [2:9.1.083-9.11] - RHEL-203857 CVE-2026-59858 vim: arbitrary Ex command execution d…

Jul 30, 2026
High max 9.8

ELSA-2026-47017 4 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.40.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jul 30, 2026
High max 9.8

ELSA-2026-45115 3 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.147.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Jul 29, 2026
High max 7.5

ELSA-2026-47731 2 CVEs

Important: gstreamer1-plugins-bad-free security update (Oracle Linux 8)

[1.16.1-9.0.1.el8_10.1] - Update origin URL [Orabug: 36209826] [1.16.1-9.1] - Fix buffer overflow in DTLS certificate subject DN handling (CVE-2026-59692) Resolves: RHEL-193570 [1.16.1-9] - Fix rfbsrc/librfb vulnerabilities in rfbdecoder.c (CVE-2026-59691) Re…

Jul 29, 2026
High max 7.5

ELSA-2026-47736 1 CVE

Important: fence-agents security update (Oracle Linux 8)

[4.2.1-129.27] - bundled httplib2: fix CVE-2026-59939 Resolves: RHEL-193803 [4.2.1-129.26] - fence_openstack: fix list-action to avoid timeout when there are 100+ VMs on the hypervisor Resolves: RHEL-186317

Jul 29, 2026
High max 9.2

ELSA-2026-47059 3 CVEs

Important: nodejs:22 security update (Oracle Linux 8)

nodejs [1:22.23.1-2] - Backport patches for various CVEs Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149 Resolves: RHEL-193842 RHEL-193874 RHEL-208661 [1:22.23.1-1] - Update to version 22.23.1 Resolves: RHEL-176170 Fixes: CVE-2026-12151 CVE-2026-48618 CVE…

Jul 29, 2026
High max 9.2

ELSA-2026-47060 3 CVEs

Important: nodejs:24 security update (Oracle Linux 8)

nodejs [1:24.18.0-2] - Backport patches for various CVEs Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149 Resolves: RHEL-194176 RHEL-194179 RHEL-208658 [1:24.18.0-1] - Update to version 24.18.0 Resolves: RHEL-168744 [1:24.14.1-2] - Update bundled nghttp2 t…

Jul 29, 2026
High max 7.1

ELSA-2026-47178 1 CVE

Important: yelp security update (Oracle Linux 9)

[2:40.3-3.1] - Fix CVE-2026-13601 (RHEL-190224)

Jul 29, 2026
High max 7.5

ELSA-2026-47179 2 CVEs

Important: gstreamer1-plugins-bad-free security update (Oracle Linux 9)

[1.22.12-7.3] - Fix incorrect bytes-per-pixel handling in rfbsrc plugin (CVE-2026-59691) Resolves: RHEL-193557 [1.22.12-7.2] - Fix buffer overflow in DTLS connection peer certificate subject DN handling (CVE-2026-59692) Resolves: RHEL-193572

Jul 29, 2026
High max 9.8

ELSA-2026-45192 5 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.30.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Jul 29, 2026
High max 9.8

ELSA-2026-47104 33 CVEs

Important: firefox security update (Oracle Linux 9)

[140.13.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.13.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

Jul 29, 2026
High max 9.2

ELSA-2026-47058 3 CVEs

Important: nodejs:22 security update (Oracle Linux 9)

nodejs [1:22.23.1-2] - Fix CVE-2026-59873, CVE-2026-59874 (node-tar) by rebasing npm's bundled tar to 7.5.19 - Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149 Resolves: RHEL-212550 RHEL…

Jul 29, 2026
High max 8.1

ELSA-2026-45114 6 CVEs

Important: kernel security update (Oracle Linux 10)

[6.12.0-211.39.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jul 29, 2026
High max 8.8

ELSA-2026-23329 7 CVEs

Important: kernel security update (Oracle Linux 10)

[6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jul 29, 2026
High max 7.7

ELSA-2026-48032 1 CVE

Important: nodejs-nodemon security update (Oracle Linux 10)

[3.1.14-2] - Regenerete sources. [3.1.14-1] - Update to version 3.1.14 [3.0.3-7] - revert of ce0df1a [3.0.3-6] - deps: revert letting nodemon work with any node

Jul 29, 2026
High max 9.2

ELSA-2026-48033 3 CVEs

Important: nodejs22 security update (Oracle Linux 10)

[1:22.23.1-4] - Fix CVE-2026-13149 (npm/brace-expansion) [1:22.23.1-3] - Fix for CVE-2026-59873 and Fix for CVE-2026-59874 (node-tar) [1:22.23.1-2] - CVE-2026-42338 ip-address HTML escaping fix. [1:22.23.1-1] - Update to version 22.23.1 [1:22.22.2-2] - De-bun…

Jul 29, 2026
High max 4.3

ELSA-2026-46532 1 CVE

Important: dovecot security update (Oracle Linux 8)

[1:2.3.16-8] - fix CVE-2026-42006: fix IMAP parser list_count_limit to correctly limit open braces instead of close braces (RHEL-188480)

Jul 28, 2026
High max 8.5

ELSA-2026-47103 3 CVEs

Important: libXfont2 security update (Oracle Linux 8)

[2.0.3-2.1] - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003 Resolves: https://redhat.atlassian.net/browse/RHEL-191877 Resolves: https://redhat.atlassian.net/browse/RHEL-191928 Resolves: https://redhat.atlassian.net/browse/RHEL-191948

Jul 28, 2026
High max 9.8

ELSA-2026-47105 33 CVEs

Important: firefox security update (Oracle Linux 8)

[140.13.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.13.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.13.0-1] - …

Jul 28, 2026
High max 7.1

ELSA-2026-47177 1 CVE

Important: yelp security update (Oracle Linux 8)

[2:3.28.1-3.2] - Fix CVE-2026-13601 (RHEL-190226)

Jul 28, 2026
High max 7.3

ELSA-2026-47183 1 CVE

Important: compat-libtiff3 security update (Oracle Linux 8)

[3.9.4-16] - fix CVE-2026-12912: heap-buffer-overflow in PixarLog ABGR decoding (RHEL-189375)

Jul 28, 2026
High max 7.3

ELSA-2026-47184 1 CVE

Important: libtiff security update (Oracle Linux 8)

[4.0.9-38] - fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189371)

Jul 28, 2026
High max 8.8

ELSA-2026-46990 2 CVEs

Important: sssd security, bug fix, and enhancement update (Oracle Linux 8)

[2.9.4-5.0.2.el8_10.5] - Missing ntohs to service port [Orabug: 37389651] - Restore default debug level for sss_cache [Orabug: 32810448] [2.9.4-5.5] - Resolves: RHEL-168415 - [Addition] Crash in 'sss_client/autofs/sss_autofs.c' [rhel-8.10.z] - Resolves: RHEL-…

Jul 28, 2026
High max 8.5

ELSA-2026-47084 2 CVEs

Important: libXfont2 security update (Oracle Linux 9)

[2.0.3-12.1] - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003 Resolves: https://redhat.atlassian.net/browse/RHEL-191886 Resolves: https://redhat.atlassian.net/browse/RHEL-191933 Resolves: https://redhat.atlassian.net/browse/RHEL-191938

Jul 28, 2026
High max 9.8

ELSA-2026-21557 18 CVEs

Important: kernel security update (Oracle Linux 10)

[6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jul 28, 2026
High max 9.1

ELSA-2026-25237 15 CVEs

Important: openssl security update (Oracle Linux 10)

[3.5.5-5.0.1] - Replace upstream references [Orabug: 34340177] - Update FIPS provider name [Orabug: 35824276] [1:3.5.5-5] - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-169991 [1:3.5.5-4] Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-3…

Jul 28, 2026
High max 8.5

ELSA-2026-47079 2 CVEs

Important: libXfont2 security update (Oracle Linux 10)

[2.0.6-5.1] - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003 Resolves: https://redhat.atlassian.net/browse/RHEL-191882 Resolves: https://redhat.atlassian.net/browse/RHEL-191930 Resolves: https://redhat.atlassian.net/browse/RHEL-191949

Jul 28, 2026
High max 8.8

ELSA-2026-47083 1 CVE

Important: pipewire security update (Oracle Linux 10)

[1.4.11-1] - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164823 [1.4-6-1] - Update version to 1.4.6 Resolves: DESKTOP-1857 [1.2.7-1] - Update version to 1.2.7 - Resolves: RHEL-76017 [1.2.6-3] - Enable libcamera support in RHEL-10 - Resolves:…

Jul 28, 2026
High max 6.8

ELSA-2026-47085 1 CVE

Important: rest security update (Oracle Linux 10)

[0.9.1-11.1] - Add patch for CVE-2026-16615 (Weak random number generation in PKCE implementation) Resolves: RHEL-213749

Jul 28, 2026
High max 7.5

ELSA-2026-47180 2 CVEs

Important: gstreamer1-plugins-bad-free security update (Oracle Linux 10)

[1.26.7-2.5] - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats (CVE-2026-59691) Resolves: RHEL-193550

Jul 28, 2026
High max 9.8

ELSA-2026-47101 32 CVEs

Important: firefox security update (Oracle Linux 10)

[140.13.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.13.0-1] - Update to 140.13.0 ESR

Jul 28, 2026
High max 7.5

ELSA-2026-42899 9 CVEs

Important: java-25-openjdk security update (Oracle Linux 9)

[25.0.4.0.7-1.1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:25.0.4.0.7-1.0] - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-838490…

Jul 28, 2026