Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,081 results · Clear filters · Feed

High max 9.8

ELSA-2026-94405 145 CVEs

Important: firefox security update (Oracle Linux 8)

[153.6.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [153.6.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [153.6.0-1] - Upd…

Nov 3, 2026
High max 7.5

ELSA-2026-94749 1 CVE

Important: python-dns security update (Oracle Linux 8)

[1.15.0-13] - CVE-2026-114605 python-dns: dnspython: Denial of Service via excessive DNS compression pointer traversal Resolves: RHEL-290592

Nov 3, 2026
High max 7.4

ELSA-2026-94510 3 CVEs

Important: freerdp security update (Oracle Linux 8)

[2:2.11.7-15] - Backport several CVE fixes (CVE-2026-109242, CVE-2026-110837, CVE-2026-111880) Resolves: RHEL-282289, RHEL-283715, RHEL-286595

Nov 3, 2026
High max 7.1

ELSA-2026-94519 1 CVE

Important: raptor2 security update (Oracle Linux 8)

[2.0.15-18] - CVE-2025-71436 raptor2: raptor2: arbitrary code execution via heap-based buffer overflow in language tag handling heap-based buffer overflow in language tag handling - Resolves: RHEL-287843

Nov 3, 2026
High max 7.8

ELSA-2026-92431 1 CVE

Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 8)

[10.0.114-1.0.2] - Add support for Oracle Linux - build dotnet-host [10.0.114-1] - Update to .NET SDK 10.0.114 and Runtime 10.0.14 - Resolves: RHEL-291741 [10.0.113-2] - Update to .NET SDK 10.0.113 and Runtime 10.0.13 - Resolves: RHEL-277805

Nov 3, 2026
High max 7.8

ELSA-2026-93975 5 CVEs

Important: gimp security update (Oracle Linux 9)

[2:3.0.4-4.15] - fix CVE-2026-106062 - fix CVE-2026-112257 - fix CVE-2026-112258 - fix CVE-2026-112260 - fix CVE-2026-112261

Nov 3, 2026
High max 9.8

ELSA-2026-93957 145 CVEs

Important: firefox security update (Oracle Linux 9)

[153.6.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [153.6.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Ab…

Nov 3, 2026
High max 7.5

ELSA-2026-94533 3 CVEs

Important: cockpit security update (Oracle Linux 9)

[356.4-1.0.1] - Apply the patch for duplicate reference [Orabug: 39250109] - Storage: Enable btrfs support [Orabug: 37464632] - Replaced upstream urls in documentation with oracle links [Orabug: 36528753] - Drop subscription-manager-cockpit requirement for ol…

Nov 3, 2026
High max 7.3

ELSA-2026-88421 1 CVE

Important: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 9)

[10.1.0-17.el9_8.9] - kvm-qcow2-Add-keep_data_file-command-line-option.patch [RHEL-164549] - kvm-qcow2-Simplify-size-round-up-in-co_create_opts.patch [RHEL-164549] - kvm-iotests-common.filter-Sort-keep_data_file.patch [RHEL-164549] - kvm-iotests-244-Add-test-…

Nov 3, 2026
High max 8.8

ELSA-2026-94629 14 CVEs

Important: dpdk security update (Oracle Linux 9)

[25.11-2] - Backport fixes for CVE-2026-86846 CVE-2026-86848 CVE-2026-86561 CVE-2026-86562 CVE-2026-86563 CVE-2026-86567 CVE-2026-86566 CVE-2026-86849 CVE-2026-86845 CVE-2026-86847 CVE-2026-86856 CVE-2026-86565 CVE-2026-93683 CVE-2026-100236

Nov 3, 2026
High max 8.8

ELSA-2026-94630 14 CVEs

Important: dpdk security update (Oracle Linux 10)

[25.11-2] - Backport fixes for CVE-2026-86846 CVE-2026-86848 CVE-2026-86561 CVE-2026-86562 CVE-2026-86563 CVE-2026-86567 CVE-2026-86566 CVE-2026-86849 CVE-2026-86845 CVE-2026-86847 CVE-2026-86856 CVE-2026-86565 CVE-2026-93683 CVE-2026-100236

Nov 3, 2026
High max 8.8

ELSA-2026-94514 13 CVEs

Important: freerdp security, bug fix, and enhancement update (Oracle Linux 10)

[2:3.32.2-1] - Update to 3.32.2 - Backport gateway freeze and busy-loop fixes, including partial-header handling - Reset completed RDG header state before control-packet dispatch - Keep WebSocket and chunked-transfer decoder state separate Resolves: RHEL-2774…

Nov 3, 2026
High max 9.8

ELSA-2026-93956 145 CVEs

Important: firefox security update (Oracle Linux 10)

[153.6.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [153.6.0-1] - Update to 153.6.0 ESR

Nov 3, 2026
High max 8.1

ELSA-2026-93627 1 CVE

Important: wireshark security update (Oracle Linux 8)

[1:2.6.2-22] - DoS via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) - Resolves: RHEL-272318

Nov 2, 2026
High max 7.5

ELSA-2026-93438 2 CVEs

Important: libXi security update (Oracle Linux 8)

[1.7.10-4] - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow Resolves: RHEL-293443 [1.7.10-3] - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply Resolves: RHEL-293…

Nov 2, 2026
High max 7.3

ELSA-2026-93978 1 CVE

Important: ghostscript security update (Oracle Linux 8)

[9.27-20] - CVE-2026-112177 ghostscript: Reintroduction of .charkeys -dSAFER bypass in RHEL 8 -dSAFER bypass in RHEL 8

Nov 2, 2026
High max 7.1

ELSA-2026-93924 2 CVEs

Important: qt5-qtbase security update (Oracle Linux 8)

[5.15.3-10] - Fix CVE-2026-19248: unbounded recursion and O(N2) behavior in QDom Resolves: RHEL-261130 - Fix CVE-2026-11573: denial of services via uncontrolled recursion in XML serialization Resolves: RHEL-277662

Nov 2, 2026
High max 8.1

ELSA-2026-94011 5 CVEs

Important: bind9.16 security update (Oracle Linux 8)

[32:9.16.23-0.22.21] - CVE-2026-94300 bind9.16: bind: Arbitrary code execution via GSS-TSIG UDP message replay [32:9.16.23-0.22.20] - CVE-2026-97313 bind9.16: bind: Denial of service via assertion failure in RPZ query processing [32:9.16.23-0.22.19] - CVE-202…

Nov 2, 2026
High max 9.8

ELSA-2026-500573 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.361.4] - vhost-scsi: zero misaligned I/O bounce pages (Shubham Antil) [Orabug: 40193932] [5.4.17-2136.361.3] - KVM: x86: Use active memslots for the per-vCPU MMIO cache (Jinu Kim) [Orabug: 40180571] - drbd: fix 'LOGIC BUG' in drbd_al_begin_io_non…

Nov 2, 2026
High max 8.1

ELSA-2026-93925 3 CVEs

Important: bind security, bug fix, and enhancement update (Oracle Linux 8)

[32:9.11.36-18] - CVE-2026-94300 bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay [32:9.11.36-17] - CVE-2026-19630 bind: BIND: Denial of Service via unbounded processing of crafted DNS messages processing of crafted DNS messages [32:9.11.3…

Nov 2, 2026
High max 9.8

ELSA-2026-93436 6 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.182.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Nov 2, 2026
High max 7.5

ELSA-2026-93439 2 CVEs

Important: libXi security update (Oracle Linux 9)

[1.7.10-8.3] - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow Resolves: RHEL-293452 [1.7.10-8.2] - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply Resolves: RHEL…

Nov 2, 2026
High max 9.8

ELSA-2026-93469 7 CVEs

Important: tomcat security update (Oracle Linux 9)

[1:9.0.121-1] - Resolves: RHEL-255800 tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) - Resolves: tomcat: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183) - Resolves: RHEL-271827 tom…

Nov 2, 2026
High max 7.8

ELSA-2026-92432 1 CVE

Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 9)

[10.0.114-1.0.1] - Add support for Oracle Linux [10.0.114-1] - Update to .NET SDK 10.0.114 and Runtime 10.0.14 - Resolves: RHEL-291744

Nov 2, 2026
High max 9.6

ELSA-2026-93443 62 CVEs

Important: thunderbird security, bug fix, and enhancement update (Oracle Linux 9)

[153.5.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [153.5.0-1] - Update to 153.5.0 ESR [140.16.0-1] - Update to 140.16.0 ESR [140.15.0-1] - Update to 140.15.0 ESR [140.14.0-1] - Update to 140.14.0 ESR [140.13.0-1] - Update to 140.13…

Nov 2, 2026
High max 7.0

ELSA-2026-90500 36 CVEs

Important: java-17-openjdk security update for RHEL 9 (Oracle Linux 9)

[1:17.0.21.0.9-2.2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:17.0.21.0.9-2.2] - Set rpmrelease to 2 for PQC signing [1:17.0.21.0.9-2.1] - Set portablerelease to 2 for new final portable - Set rpmrelease to 1 - Update sources to new final tarball …

Nov 2, 2026
High max 7.4

ELSA-2026-93592 3 CVEs

Important: freerdp security update (Oracle Linux 9)

[2:2.11.7-7.9] - Backport several CVE fixes (CVE-2026-109242, CVE-2026-110837, CVE-2026-111880) Resolves: RHEL-282296, RHEL-283722, RHEL-286609

Nov 2, 2026
High max 9.8

ELSA-2026-93412 18 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.64.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Nov 2, 2026
High max 9.8

ELSA-2026-500574 289 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-326.222.4] - rtnetlink: advertise allmulti counter (Nicolas Dichtel) [Orabug: 40234417] [5.15.0-326.222.3] - vhost-scsi: fix page reference leak in misaligned I/O fallback (Jia Jia) [Orabug: 40193939] - vhost-scsi: zero misaligned I/O bounce pages (Sh…

Nov 2, 2026
High max 8.1

ELSA-2026-93610 4 CVEs

Important: bind security update (Oracle Linux 9)

[9.16.23-40.0.1.el9_8.13] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-40.13] - Fix CVE-2026-94300: Arbitrary code execution via GSS-TSIG UDP message replay. - Fix CVE-2026-97313: Denial of Service via assertion failure i…

Nov 2, 2026
High max 9.2

ELSA-2026-90495 1 CVE 1 exploited

Important: brotli security update (Oracle Linux 9)

[1.0.9-10.0.1] - Fix out-of-bounds write in the Brotli decoder [CVE-2026-111497]

Nov 2, 2026
High max 9.8

ELSA-2026-93413 16 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.72.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Nov 2, 2026
High max 8.0

ELSA-2026-93461 9 CVEs

Important: util-linux security update (Oracle Linux 10)

[2.40.2-18.0.1.el10_2.20] - fix -d -t output regression [OLDIS-51984] [2.40.2-20] - libblkid: validate EBR data [CVE-2026-53615] [2.40.2-19] - libmount and blkid security fixes - libblkid: fix use-after-free in nested partition probing [CVE-2026-13595] - nsen…

Nov 2, 2026
High max 7.5

ELSA-2026-89751 4 CVEs

Important: grafana security update (Oracle Linux 10)

[10.2.6-28.9] - Rebuild against updated golang - Resolves RHEL-290737 [10.2.6-28.9] - CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting in Unified Alerting - Resolves RHEL-290765 [10.2.6-28.8] - Rebuild against updated …

Nov 2, 2026
High max 7.5

ELSA-2026-93441 2 CVEs

Important: libXi security update (Oracle Linux 10)

[1.8.1-7.3] - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow Resolves: RHEL-293447 [1.8.1-7.2] - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply Resolves: RHEL-2…

Nov 2, 2026
High max 9.8

ELSA-2026-500572 308 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-208.112.5] - NFSD: Define actions for the new time_deleg FATTR4 attributes (Chuck Lever) [Orabug: 39004166] {CVE-2025-40326} - vhost-scsi: fix page reference leak in misaligned I/O fallback (Jia Jia) [Orabug: 40193938] - vhost-scsi: zero misaligned I/…

Nov 2, 2026
High max 7.5

ELSA-2026-93440 1 CVE

Important: python-jwt security update (Oracle Linux 8)

[1.6.1-2.1] - Fix CVE-2026-32597 Resolves: RHEL-271640

Nov 1, 2026
High max 7.5

ELSA-2026-59240 1 CVE

Important: python-pyasn1 security update (Oracle Linux 7)

[0.1.9-7.0.3] - Fix CVE-2026-59886 Real float conversion [Orabug: 39925524] [0.1.9-7.0.1] - Fixes CVE-2026-23490 fixes potential memory exhaustion [Orabug: 39060516]

Oct 30, 2026
High max 7.8

ELSA-2026-92427 1 CVE

Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 8)

[9.0.123-1.0.1] - Add support for Oracle Linux [9.0.123-1] - Update to .NET SDK 9.0.123 and Runtime 9.0.22 - Resolves: RHEL-291723

Oct 30, 2026
High max 8.7

ELSA-2026-92639 10 CVEs

Important: python-pillow security update (Oracle Linux 8)

[5.1.1-33] - CVE-2026-112892 python-pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder Resolves: RHEL-290437 [5.1.1-32] - CVE-2026-96640 python-pillow: pillow: Denial of Service via duplicate page references in PDF files Res…

Oct 30, 2026