Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,088 results · Clear filters · Feed

  • High max 8.8
    ELSA-2026-36195 2 CVEs

    Important: 389-ds-base security update (Oracle Linux 9)

    [2.8.0-8] - Resolves: RHEL-182159 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-9.8.z] - Resolves: RHEL-183103 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length b…

  • High max 8.8
    ELSA-2026-26204 4 CVEs

    Important: postgresql:18 security update (Oracle Linux 9)

    pgaudit [18.0-1] - Update to 18.0 - Initial import for postgresql18 pg_repack [1.5.3-1] - Update to 1.5.3 - Initial import for postgresql18 [1.5.1-1] - Update to v1.5.1 [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604…

  • High max 9.8
    ELSA-2026-30848 8 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.19.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 4.1
    ELSA-2026-36315 1 CVE

    Important: python3.14-pip security update (Oracle Linux 9)

    [25.2-5] - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pip_install_upgrade to run pip-3.14 - fix bash completion + remove unused metadata file [25.2-4] - Security fix for CVE-2026-8643: path traversal in wheel ent…

  • High max 7.5
    ELSA-2026-36317 2 CVEs

    Important: skopeo security update (Oracle Linux 9)

    [1:1.22.2-7] - Rebuild for golang >= 1.26.4 to fix CVE-2026-27145 - Resolves: RHEL-189898

  • High max 7.7
    ELSA-2026-35891 15 CVEs

    Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 9)

    nodejs [1:24.18.0-1] - Update to version 24.18.0 nodejs-nodemon [3.0.3-3] - Keep BR on just npm [3.0.3-2] - Fix BR for nodejs-npm nodejs-packaging [2021.06-6] - Properly handle @group/package deps in nodejs-symlink-deps Resolves: RHEL-121569 [2021.06-5] - nod…

  • High max 9.8
    ELSA-2026-50374 8 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.357.3.1] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug: 39673892] - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson) [Orabug: 39673892] - KVM: x86/MMU: Recursivel…

  • High max 9.8
    ELSA-2026-50373 6 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-322.203.3.2] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Sean Christopherson) [Orabug: 39673886] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug: 39673886] - KVM: x86: Fi…

  • High max 7.6
    ELSA-2026-33514 2 CVEs

    Important: ruby:2.5 security update (Oracle Linux 8)

    ruby [2.5.9-114] - Fix integer overflow in search_in_range function in regexec.c (CVE-2019-19012). Resolves: RHEL-87505 rubygem-abrt [0.3.0-4] - Execute test suite unconditionally. - Upload correct sources. rubygem-bson [4.3.0-2] - Rebuilt for https://fedorap…

  • High max 9.5
    ELSA-2026-34354 6 CVEs

    Important: php:7.4 security update (Oracle Linux 8)

    libzip [1.6.1-1] - update to 1.6.1 - enable lzma support php [7.4.33-4] - Fix XSS within status endpoint CVE-2026-6735 - Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map CVE-2026-6722 - Fix Use-after-free after header parsing failure with SOAP_PERSISTEN…

  • High max 9.5
    ELSA-2026-33449 7 CVEs

    Important: php security update (Oracle Linux 9)

    [8.0.30-6] - Fix XSS within status endpoint CVE-2026-6735 - Fix Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() CVE-2026-7259 - Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map CVE-2026-6722 - Fix Use-after-free after heade…

  • High max 10.0
    ELSA-2026-33482 1 CVE

    Important: mariadb:10.11 security, bug fix, and enhancement update (Oracle Linux 9)

    galera [26.4.20-1.0.1] - Drop nmap-ncat requirement. [Orabug: 34116228] - Requirement to delete garbd-wrapper script and lp1184034 test case without using patches. [Orabug: 34116228] [26.4.20-1] - Rebase to 26.4.20 [26.4.19-1] - Rebase to 26.4.19 [26.4.18-1] …

  • High max 7.6
    ELSA-2026-33576 3 CVEs

    Important: ruby:3.3 security update (Oracle Linux 9)

    ruby [3.3.10-7] - Fix DoS via crafted IMAP responses in net-imap. (CVE-2026-42245) Resolves: RHEL-181693 - Fix information disclosure via MITM attack bypassing TLS in net-imap. (CVE-2026-42246) Resolves: RHEL-181779 - Fix command injection via Symbol argument…

  • High max 10.0
    ELSA-2026-33481 1 CVE

    Important: mariadb:11.8 security, bug fix, and enhancement update (Oracle Linux 9)

    galera [26.4.27-1.0.1] - Drop nmap-ncat requirement. [Orabug: 34116228] - Requirement to delete lp1184034 test case without using patches. [26.4.27-1] - Rebased to 26.4.27 [26.4.26-1] - Rebased to 26.4.26 mariadb [3:11.8.8-1] - Rebase to 11.8.8 [3:11.8.7-1] -…

  • High max 9.8
    ELSA-2026-50372 822 CVEs 2 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-204.92.4.2] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug: 39673880] - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) {CVE-2026-46331} - net_sched: act_pedit: use RCU in tc…

  • High max 7.6
    ELSA-2026-33515 3 CVEs

    Important: ruby:3.3 security update (Oracle Linux 8)

    ruby [3.3.10-7] - Fix DoS via crafted IMAP responses in net-imap. (CVE-2026-42245) Resolves: RHEL-181682 - Fix information disclosure via MITM attack bypassing TLS in net-imap. (CVE-2026-42246) Resolves: RHEL-181759 - Fix command injection via Symbol argument…

  • High max 7.5
    ELSA-2026-33722 5 CVEs

    Important: container-tools:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

    aardvark-dns [2:1.10.1-2] - build off the RHEL maintenance branch - Resolves: RHEL-59129 buildah [2:1.33.14-3] - rebuild for CVE-2025-68121 - Resolves: RHEL-149262 cockpit-podman [84.1-1] - update to https://github.com/cockpit-project/cockpit-podman/releases/…

  • High max 8.2
    ELSA-2026-33501 1 CVE

    Important: giflib security update (Oracle Linux 9)

    [5.2.1-10.2] - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157133)

  • High max 7.6
    ELSA-2026-33577 3 CVEs

    Important: ruby:4.0 security update (Oracle Linux 9)

    ruby [4.0.3-33] - Fix Net::IMAP ResponseReader quadratic complexity vulnerability. (CVE-2026-42245) Resolves: RHEL-181690 - Fix Net::IMAP STARTTLS stripping vulnerability. (CVE-2026-42246) Resolves: RHEL-181771 - Fix Net::IMAP command injection vulnerability …

  • High max 9.1
    ELSA-2026-30851 2 CVEs

    Important: perl:5.32 security update (Oracle Linux 8)

    perl [4:5.32.1-474] - Resolves: RHEL-153834 - Fix CVE-2025-40909 - Clone dirhandles without fchdir perl-Algorithm-Diff [1.1903-10] - Rebuild with enable hardening (bug #1636329) perl-Archive-Tar [2.38-4] - Fix CVE-2026-42496: validate symlink and hardlink tar…

  • High max 9.6
    ELSA-2026-33445 29 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [140.12.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.12.0] - Add OpenELA debranding [140.12.0-1] - Update to 140.12.0 ESR

  • High max 10.0
    ELSA-2026-33464 1 CVE

    Important: mariadb:10.11 security, bug fix, and enhancement update (Oracle Linux 8)

    galera [26.4.27-1] - Rebased to 26.4.27 [26.4.26-1] - Rebased to 26.4.26 [26.4.25-1] - Rebased to 26.4.25 [26.4.24-1] - Rebase to 26.4.24 Judy [1.0.5-18] - Remove README.Fedora; no longer needed since 1.0.5 version - Resolves: #1638717 [1.0.5-17] - ldconfig s…

  • High max 8.2
    ELSA-2026-33503 1 CVE

    Important: giflib security update (Oracle Linux 8)

    [5.1.4-5] - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157097)

  • High max 7.0
    ELSA-2026-19589 1 CVE

    Important: python security update (Oracle Linux 7)

    [2.7.5-94.0.9] - Fix for CVE-2026-4786 [Orabug: 39418723] [2.7.5-94.0.7] - Fix for CVE-2026-4519 [Orabug: 39243798] [2.7.5-94.0.5] - Fix for CVE-2025-15366 and CVE-2025-15367 [Orabug: 39114639] [2.7.5-94.0.3] - Fix for CVE-2025-12084 [Orabug: 38902314]

  • High max 9.8
    ELSA-2026-24983 3 CVEs

    Important: firefox security update (Oracle Linux 7)

    [140.10.2-1.0.1] - Update to 140.10.2 ESR [Orabug: 39534787][CVE-2026-8090][CVE-2026-8092] [CVE-2026-8094] [140.10.1-1.0.1] - Update to 140.10.1 ESR [Orabug: 39481850][CVE-2026-7320][CVE-2026-7321] [CVE-2026-7322][CVE-2026-7323] [140.10.0-1.0.1] - Update to 1…

  • High max 9.8
    ELSA-2026-26551 18 CVEs

    Important: firefox security update (Oracle Linux 7)

    [140.11.0-1.0.1] - Update to 140.11.0 ESR [Orabug: 39573358] [140.10.2-1.0.1] - Update to 140.10.2 ESR [Orabug: 39534787][CVE-2026-8090][CVE-2026-8092] [CVE-2026-8094] [140.10.1-1.0.1] - Update to 140.10.1 ESR [Orabug: 39481850][CVE-2026-7320][CVE-2026-7321] …

  • High max 9.1
    ELSA-2026-30852 1 CVE

    Important: perl-Archive-Tar security update (Oracle Linux 8)

    [2.30-2] - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode - Resolves: RHEL-181654 [2.30-1] - 2.30 bump [2.28-1] - 2.28 bump - Fixes CVE-2018-12015 (directory traversal) (bug #1588761) [2.26-6] - Do not run optional test on RH…

  • High max 9.6
    ELSA-2026-30853 1 CVE

    Important: git-lfs security update (Oracle Linux 8)

    [3.4.1-11] - Backport CVE-2026-39821 fix (vendored golang.org/x/net IDNA) - Resolves: RHEL-183731

  • High max 7.3
    ELSA-2026-30858 1 CVE

    Important: perl-IO-Compress security update (Oracle Linux 8)

    [2.081-2] - Remove use of eval in File::GlobMapper for safer string interpolation - Resolves: RHEL-180411

  • High max 8.9
    ELSA-2026-32992 2 CVEs

    Important: python3.12-urllib3 security update (Oracle Linux 8)

    [1.26.19-3] - Security fixes for CVE-2026-44431 and CVE-2026-44432 Resolves: RHEL-185125, RHEL-184900

  • High max 9.6
    ELSA-2026-18916 3 CVEs

    Important: tomcat security update (Oracle Linux 9)

    [1:9.0.117-1] - Resolves: RHEL-150714 Certificate revocation bypass due to improper OCSP response validation - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVE-2026-34500) - Resolves: Tomcat: Cloud membership for…

  • High max 7.4
    ELSA-2026-19368 2 CVEs

    Important: rsync security update (Oracle Linux 9)

    [3.2.5-7.2] - Fix integer overflow in compressed-token decoding (CVE-2026-43618) - Resolves: RHEL-174932 [3.2.5-7.1] - Fix TOCTOU symlink race in daemon no-chroot mode (CVE-2026-29518) - Resolves: RHEL-174952 [3.2.5-4] - Resolves: RHEL-104404 - Do not clear D…

  • High max 9.6
    ELSA-2026-19370 4 CVEs

    Important: firefox security update (Oracle Linux 9)

    [140.12.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.12.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

  • High max 9.8
    ELSA-2026-20574 3 CVEs

    Important: firefox security update (Oracle Linux 9)

    [140.12.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.12.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

  • High max 9.8
    ELSA-2026-21378 18 CVEs

    Important: firefox security update (Oracle Linux 9)

    [140.12.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.12.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

  • High max 8.1
    ELSA-2026-24381 3 CVEs

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-687.17.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 9.8
    ELSA-2026-25217 11 CVEs

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-687.17.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 8.1
    ELSA-2026-28212 1 CVE

    Important: nginx:1.24 security update (Oracle Linux 9)

    [1.24.0-7.0.1.2] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-7.2] - Resolves: RHEL-178681 - nginx:1.24/nginx: code execution and denial of service (CVE-2026-9256) - Resolves: RHEL-18…

  • High max 9.6
    ELSA-2026-30854 1 CVE

    Important: git-lfs security update (Oracle Linux 9)

    [3.7.1-4.1] - Fix CVE-2026-39821: vendored golang.org/x/net/idna ToUnicode incorrectly accepting all-ASCII xn-- labels - Resolves: RHEL-183797

  • High max 9.1
    ELSA-2026-30856 1 CVE

    Important: perl-Archive-Tar security update (Oracle Linux 9)

    [2.38-6.1] - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode - Resolves: RHEL-181662