Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,088 results · Clear filters · Feed

  • High max 6.9
    ELSA-2026-36777 4 CVEs

    Important: unbound security update (Oracle Linux 9)

    [1.24.2-3.2] - Fix CVE-2026-40622 (RHEL-184840) Fix CVE-2026-44390 (RHEL-186688) Fix CVE-2026-41292 (RHEL-187352) Fix CVE-2026-42534 (RHEL-187095)

  • High max 7.6
    ELSA-2026-37129 1 CVE

    Important: gstreamer1-plugins-good security update (Oracle Linux 9)

    [1.22.12-7.1] - Rebase rhel-9.8.0 from 1.18.4 to 1.22.12 to resync with rhel-9.7.0/c9s (this branch had regressed to a stale pre-1.22.12 base) Resolves: RHEL-156269, RHEL-156270 - Fix CVE-2026-53705: integer overflow in wavpack decoder, re-applied on top of t…

  • High max 7.8
    ELSA-2026-20590 5 CVEs

    Important: xorg-x11-server security update (Oracle Linux 7)

    * Tue Jun 09 2026 Ronan Pigott 1.20.4-29.0.7 - Security update for CVE-2026-33999 CVE-2026-34000 CVE-2026-34001 CVE-2026-34002 CVE-2026-34003 [Orabug: 39440282] [1.20.4-29.0.5] - Security update for CVE-2025-62229 CVE-2025-62230 CVE-2025-62231 [Orabug: 386911…

  • High max 8.8
    ELSA-2026-36201 2 CVEs

    Important: 389-ds:1.4 security update (Oracle Linux 8)

    [1.4.3.39-25] - Bump version to 1.4.3.39-25 - Resolves: RHEL-182162 - EMBARGOED CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-8.10.z] - Resolves: RHEL-183102 - CVE-2026-11774 389-ds-base: 389-ds-b…

  • High max 7.6
    ELSA-2026-36774 1 CVE

    Important: gstreamer1-plugins-good security update (Oracle Linux 8)

    [1.16.1-7] - Fix integer overflow vulnerabilities in wavpackdec (CVE-2026-53705) Resolves: RHEL-184473

  • High max 9.8
    ELSA-2026-33285 2 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.20.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 7.7
    ELSA-2026-35892 13 CVEs

    Important: nodejs:22 security, bug fix, and enhancement update (Oracle Linux 9)

    nodejs [1:22.23.1-1] - Update to version 22.23.1 Resolves: RHEL-186622 RHEL-185998 RHEL-183669 Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619 CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-202…

  • High max 7.5
    ELSA-2026-36617 1 CVE

    Important: oci-seccomp-bpf-hook security update (Oracle Linux 9)

    [1.2.11-2] - rebuild for CVE-2026-33811 Resolves: RHEL-187325

  • High max 9.3
    ELSA-2026-36018 11 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.22.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 7.5
    ELSA-2026-36879 2 CVEs 1 exploited

    Important: tomcat security, bug fix, and enhancement update (Oracle Linux 9)

    [1:9.0.117-2] - Resolves: RHEL-183992 Remove tomcat clustering JAR from RPM builds - Exclude i686 architecture from build

  • High max 8.8
    ELSA-2026-36834 4 CVEs

    Important: gstreamer1-plugins-bad-free security update (Oracle Linux 9)

    [1.22.12-7.1] - Sync with c9s release -5..-7: fix for CVE-2026-2923, CVE-2026-3082 in dvbsuboverlay and jpegparser Resolves: RHEL-156242, RHEL-156255 [1.22.12-4.4] - Fix bytes/bits confusion in AV1 tile data size parsing (CVE-2026-52718) Resolves: RHEL-184388…

  • High max 8.4
    ELSA-2026-18465 1 CVE

    Important: edk2 security update (Oracle Linux 10)

    [20251114-5.0.1] - Replace upstream references [Orabug:36569119] [20251114-5] - edk2-add-uefi-vars-firmware-json-files.patch [RHEL-150696] - Resolves: RHEL-150696 (edk2: Add JSON descriptors for uefi-vars builds) [20251114-4] - edk2-OvmfPkg-X86QemuLoadImageLi…

  • High max 8.8
    ELSA-2026-18479 6 CVEs

    Important: qemu-kvm security update (Oracle Linux 10)

    [10.1.0-16] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-158224] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-158224] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-158224] - kvm-io-uring-Resubmit…

  • High max 8.8
    ELSA-2026-18480 5 CVEs

    Important: linux-sgx security update (Oracle Linux 10)

    [2.26-7] - Fix pccs npm security flaws [2.26-6] - Port to pycryptography and pyasn1 and make keyring optional [2.26-5] - Sync specfile changes from Fedora [2.26-4] - Drop sgx-mpa dep from sgx-pccs [2.26-3] - Add scriptlets for PCCS [2.26-2] - Enable pccsadmin…

  • High max 8.8
    ELSA-2026-19009 5 CVEs

    Important: postgresql18 security update (Oracle Linux 10)

    [18.3-1.0.1] - Replace upstream reference [18.3-1] - Update to 18.3 - Enable pltcl - Update gating configuration - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code - Fix CVE-2026-2005:…

  • High max 8.8
    ELSA-2026-19010 4 CVEs

    Important: postgresql16 security update (Oracle Linux 10)

    [16.13-1.0.1] - Replace upstream reference [Orabug: 37044148]

  • High max 7.5
    ELSA-2026-19017 2 CVEs

    Important: podman security update (Oracle Linux 10)

    [5.8.2-1.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-1] - update to https://github.com/containers/podman/releases/tag/v5.8.2 - fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE - Resolve…

  • High max 9.1
    ELSA-2026-19019 9 CVEs

    Important: python3.14 security update (Oracle Linux 10)

    [3.14.4-2] - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 [3.14.4-1] - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-16…

  • High max 7.5
    ELSA-2026-19022 2 CVEs

    Important: golang security update (Oracle Linux 10)

    [1.26.2-2.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.2-2] - Do not ignore any tests in check [1.26.2-1] - Update to Go 1.26.2 (fips-2) [1.26.1-1] - Update to Go 1.26.1 [1.25.7-1] - Update to Go 1.25.7 (fips-1) [1.25.5-1] - Update to Go …

  • High max 8.8
    ELSA-2026-19024 7 CVEs

    Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update (Oracle Linux 10)

    gstreamer1-plugins-bad-free [1.26.7-2] - Add patches for CVE-2026-2923 and CVE-2026-3082 Resolves: RHEL-156114, RHEL-156172 [1.26.7-1] - Update to 1.26.7 Resolves: RHEL-126057 [1.26.2-1] - Update to 1.26.2 Resolves: DESKTOP-1858 gstreamer1-plugins-base [1.26.…

  • High max 7.5
    ELSA-2026-19026 1 CVE

    Important: grafana-pcp security update (Oracle Linux 10)

    [5.3.0-4] - Resolves RHEL-158485: CVE-2026-25679

  • High max 7.5
    ELSA-2026-19027 1 CVE

    Important: grafana security update (Oracle Linux 10)

    [10.2.6-25] - Resolves RHEL-158484: CVE-2026-25679

  • High max 7.5
    ELSA-2026-19031 1 CVE

    Important: skopeo security update (Oracle Linux 10)

    [2:1.22.2-1] - update to https://github.com/containers/skopeo/releases/tag/v1.22.2 - fixes signature verification of images which only sign the per-platform manifest in skopeo proxy - Resolves: RHEL-168168 [1:1.22.0-3] - enable sequoia - Resolves: RHEL-56364 …

  • High max 7.5
    ELSA-2026-19032 1 CVE

    Important: buildah security update (Oracle Linux 10)

    [1.43.1-1.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.43.1-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.43 (https://github.com/containers/buildah/commit/c6eb14c) - fix…

  • High max 9.3
    ELSA-2026-19033 23 CVEs

    Important: freerdp security update (Oracle Linux 10)

    [2:3.10.3-12.2] - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 [2:3.10.3-12.1] - Rebuilt for errata Resolves: RHEL-155980 [2:3.10.3-12] - Fix u…

  • High max 9.8
    ELSA-2026-19041 25 CVEs

    Important: firefox security update (Oracle Linux 10)

    [140.10.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

  • High max 7.5
    ELSA-2026-19049 2 CVEs

    Important: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

    [0.9.27-6] - rebuilt to fix CVE-2026-27137, CVE-2026-25679 - fixed rebuild problem with redundant condition check in quirks.empty()

  • High max 7.4
    ELSA-2026-19054 1 CVE

    Important: tomcat security update (Oracle Linux 10)

    [1:10.1.36-3.el10_1.1] - Resolves: RHEL-150719 Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) [1:10.1.49-1] - Resolves: RHEL-150099 Rebase tomcat package to enable PQC features [1:10.1.36-4] - Resolves: RHEL-124493 tom…

  • High max 9.1
    ELSA-2026-19064 12 CVEs

    Important: python3.12 security update (Oracle Linux 10)

    [3.12.13-2.0.1] - Remove upstream URL reference [3.12.13-2] - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 [3.12.13-1] - Update to 3.12.13 - Security fixes for C…

  • High max 7.4
    ELSA-2026-19067 1 CVE

    Important: sudo security update (Oracle Linux 10)

    [1.9.17-4.p2] - Bump release number - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation due to failure in privilege drop calls [1.9.17-3.p2] - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation due to failure in priv…

  • High max 7.5
    ELSA-2026-19069 5 CVEs

    Important: openssh security update (Oracle Linux 10)

    [9.9p1-23.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-23] - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164739 - CVE-2026-35388: Add connection multiplexing …

  • High max 8.2
    ELSA-2026-19073 1 CVE

    Important: vim security update (Oracle Linux 10)

    [9.1.083-9.0.1.el10_2.2] - Remove upstream references [Orabug: 31197557] [2:9.1.083-9.2] - Resolves: RHEL-164952 vim: arbitrary command execution via modeline sandbox bypass [2:9.1.083-9.1] - RHEL-159616 CVE-2026-33412 vim: Vim: Arbitrary code execution via c…

  • High max 8.8
    ELSA-2026-19074 4 CVEs 1 exploited

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-211.7.3.el10_2.OL10] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK…

  • High max 9.6
    ELSA-2026-35831 1 CVE

    Important: grafana-pcp security update (Oracle Linux 8)

    [5.1.1-16] - Resolves RHEL-183733: CVE-2026-39821 [5.1.1-15] - Resolves RHEL-183733: CVE-2026-39821

  • High max 8.8
    ELSA-2026-36215 1 CVE

    Important: compat-openssl10 security update (Oracle Linux 8)

    [1.1.0-2o-4.3] - Fix CVE-2026-45447: Fix double-free of caller-owned BIO in PKCS7_verify

  • High max 9.1
    ELSA-2026-35833 5 CVEs

    Important: container-tools:ol8 security update (Oracle Linux 8)

    aardvark-dns [2:1.10.1-2] - build off the RHEL maintenance branch - Resolves: RHEL-59129 [2:1.10.0-1] - update to https://github.com/containers/aardvark-dns/releases/tag/v1.10.0 - Related: Jira:RHEL-2110 [2:1.9.0-1] - update to https://github.com/containers/a…

  • High max 9.1
    ELSA-2026-36188 1 CVE

    Important: perl-HTTP-Daemon security update (Oracle Linux 8)

    [6.01-24] - Fix CVE-2026-8450: send_file() shell-magic injection via 2-arg open() - Resolves: RHEL-184825

  • High max 9.6
    ELSA-2026-35828 1 CVE

    Important: grafana security update (Oracle Linux 9)

    [10.2.6-23] - Resolves RHEL-183803: CVE-2026-39821 - Resolves RHEL-188280

  • High max 9.6
    ELSA-2026-35829 1 CVE

    Important: grafana-pcp security update (Oracle Linux 9)

    [5.1.1-17] - Resolves RHEL-183820: CVE-2026-39821 - Resolves RHEL-188285 [5.1.1-16] - Resolves RHEL-183820: CVE-2026-39821

  • High max 9.1
    ELSA-2026-36187 1 CVE

    Important: perl-HTTP-Daemon security update (Oracle Linux 9)

    [6.12-6.1] - Fix CVE-2026-8450: send_file() shell-magic injection via 2-arg open() - Resolves: RHEL-184829