Oracle Linux Security Advisories (ELSA)

5,088 results · Clear filters · Feed

• High max 7.3
  ELSA-2026-30859 1 CVE

  Important: perl-IO-Compress security update (Oracle Linux 9)

  [2.102-4.1] - Fix CVE-2026-48962: remove use of eval in File::GlobMapper - Resolves: RHEL-180418

  Jun 29, 2026
• High max 9.8
  ELSA-2026-19568 17 CVEs 1 exploited

  Important: kernel security update (Oracle Linux 9)

  [5.14.0-687.17.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  Jun 29, 2026
• High max 9.8
  ELSA-2026-21556 20 CVEs

  Important: kernel security update (Oracle Linux 9)

  [5.14.0-687.17.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  Jun 29, 2026
• High max 8.8
  ELSA-2026-27741 4 CVEs

  Important: postgresql security update (Oracle Linux 9)

  [13.23-3] - Backport fix for CVE-2026-6478 from PostgreSQL 14.23 - Backport fixes for CVE-2026-6637, CVE-2026-6477, CVE-2026-6475, CVE-2026-6473 - Resolves: RHEL-179799 - Resolves: RHEL-181866 - Resolves: RHEL-181950 - Resolves: RHEL-181964

  Jun 29, 2026
• High max 8.1
  ELSA-2026-28973 1 CVE

  Important: nginx security update (Oracle Linux 9)

  [2:1.20.1-28.0.1.el9_8.3] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] - Update upstream references [Orabug: 36579090] [2:1.20.1-28.3] - Resolves: RHEL-178684 - nginx: code execution and denial…

  Jun 29, 2026
• High max 7.8
  ELSA-2026-50353 1 CVE

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

  [5.4.17-2136.356.4.3] - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug: 39639989] {CVE-2026-52943} Credit Statement: The following people reported security vulnerabilities addressed by this ELSA to Oracle: Minh Nguyen …

  Jun 28, 2026
• High max 7.8
  ELSA-2026-50352 1 CVE

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

  [5.15.0-321.202.5.3] - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug: 39639981] {CVE-2026-52943} Credit Statement: The following people reported security vulnerabilities addressed by this ELSA to Oracle: Minh Nguyen <…

  Jun 28, 2026
• High max 7.8
  ELSA-2026-50351 1 CVE

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

  [6.12.0-203.76.7.6] - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug: 39639984] {CVE-2026-52943} Credit Statement: The following people reported security vulnerabilities addressed by this ELSA to Oracle: Minh Nguyen <m…

  Jun 28, 2026
• High max 8.1
  ELSA-2026-18722 1 CVE

  Important: podman security update (Oracle Linux 9)

  [5.8.2-3.0.1] - Rework CNI/Netavark detection logic [JIRA: EVG-3769] - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.8.2-3] - Rebuild for CVE-2026-3…

  Jun 26, 2026
• High max 7.8
  ELSA-2026-19343 3 CVEs

  Important: xorg-x11-server security update (Oracle Linux 9)

  [1.20.11-34.2] - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184288 [1.20.11-34.1] - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-5026…

  Jun 26, 2026
• High max 7.8
  ELSA-2026-19344 3 CVEs

  Important: xorg-x11-server-Xwayland security update (Oracle Linux 9)

  [24.1.9-4.2] - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184292 [24.1.9-4.1] - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263 Re…

  Jun 26, 2026
• High max 9.8
  ELSA-2026-19348 29 CVEs

  Important: thunderbird security update (Oracle Linux 9)

  [140.11.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.11.0] - Add OpenELA debranding [140.11.0-1] - Update to 140.11.0 ESR [140.10.1-1] - Update to 140.10.1 ESR

  Jun 26, 2026
• High max 7.5
  ELSA-2026-19349 2 CVEs

  Important: freerdp security update (Oracle Linux 9)

  [2:2.11.7-7.3] - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159860 [2:2.11.7-7.2] - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix growth of preallocated buffers (CVE-2026-27951) - Fix heap-buffe…

  Jun 26, 2026
• High max 8.2
  ELSA-2026-19355 3 CVEs

  Important: fence-agents security update (Oracle Linux 9)

  [4.10.0-110.3] - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182313 [4.10.0-110.2] - bundled pyasn1: fix CVE-2026-30922 Resolves: RHEL-157202 [4.10.0-110.1] - bundled cryptography: replace with dependency to fix CVE-2026-26007 - bun…

  Jun 26, 2026
• High max 7.5
  ELSA-2026-21293 2 CVEs

  Important: .NET 8.0 security update (Oracle Linux 9)

  [8.0.128-1.0.1] - Add support for Oracle Linux [8.0.128-1] - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181055 [8.0.127-1] - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173923

  Jun 26, 2026
• High max 7.5
  ELSA-2026-21296 1 CVE

  Important: .NET 9.0 security update (Oracle Linux 9)

  [9.0.118-1.0.1] - Add support for Oracle Linux [9.0.118-1] - Update to .NET SDK 9.0.118 and Runtime 9.0.17 - Resolves: RHEL-181553 [9.0.117-1] - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173918

  Jun 26, 2026
• High max 7.5
  ELSA-2026-21297 1 CVE

  Important: .NET 10.0 security update (Oracle Linux 9)

  [10.0.109-1.0.1] - Add support for Oracle Linux [10.0.109-1] - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181558 [10.0.108-1] - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173910

  Jun 26, 2026
• High max 7.5
  ELSA-2026-26445 1 CVE

  Important: podman security update (Oracle Linux 9)

  [5.8.2-3.0.1] - Rework CNI/Netavark detection logic [JIRA: EVG-3769] - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.8.2-3] - Rebuild for CVE-2026-3…

  Jun 26, 2026
• High max 9.6
  ELSA-2026-29940 29 CVEs

  Important: thunderbird security update (Oracle Linux 9)

  [140.12.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.12.0] - Add OpenELA debranding [140.12.0-1] - Update to 140.12.0 ESR

  Jun 26, 2026
• High max 7.5
  ELSA-2026-50325 1 CVE

  Important: openssh security update (Oracle Linux 7)

  [7.4p1-23.0.5_fips] - Fix privilege escalation via scp legacy protocol when not in preserving file mode [CVE-2026-35385][Orabug: 39480251] [7.4p1-23.0.3_fips] - Change Epoch from 1 to 10 - Enable fips KDF POST [Orabug: 32461750] - Disable diffie-hellman-group…

  Jun 25, 2026
• High max 8.8
  ELSA-2026-28999 2 CVEs

  Important: postgresql:12 security update (Oracle Linux 8)

  [12.22-6.0.1] - Add backport of CVE-2025-8714 [Orabug: 38667546] [12.22-6] - Fix CVE-2026-2004 CVE-2026-2005 CVE-2026-2006 [12.22-5] - Fix previous Backport [12.22-4] - Backport CVE-2025-8715 [12.22-3] - Fix backport for CVE-2025-1094 [12.22-2] - Backport fix…

  Jun 25, 2026
• High max 8.1
  ELSA-2026-29151 1 CVE

  Important: nginx:1.26 security update (Oracle Linux 9)

  [1.26.3-9.0.1.1] - Require oracle-indexhtml [2:1.26.3-11] - nginx:1.26/nginx: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack [2:1.26.3-10] - nginx: code execution and denial of service (CVE-2026-9256) [2:1.26.3-9] - Resolves:…

  Jun 25, 2026
• High max 9.1
  ELSA-2026-29455 6 CVEs

  Important: buildah security update (Oracle Linux 9)

  [1.43.1-2.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [102:1.43.1-2] - Rebuild for CVE-2026-25679 - Resolves: RHEL-158759

  Jun 25, 2026
• High max 7.5
  ELSA-2026-29702 3 CVEs

  Important: runc security update (Oracle Linux 9)

  [4:1.4.2-2] - Rebuild for CVE-2026-25679 - Resolves: RHEL-158787

  Jun 25, 2026
• High max 7.5
  ELSA-2026-29703 4 CVEs

  Important: containernetworking-plugins security update (Oracle Linux 9)

  [1:1.9.0-3] - Rebuild for CVE-2026-25679 - Resolves: RHEL-158763

  Jun 25, 2026
• High max 7.8
  ELSA-2026-29844 9 CVEs

  Important: tigervnc security update (Oracle Linux 9)

  [1.15.0-7.2] - Rebuild for updated xorg-x11-server Resolves: RHEL-184003

  Jun 25, 2026
• High max 7.0
  ELSA-2026-28247 2 CVEs

  Important: python3.14 security, bug fix, and enhancement update (Oracle Linux 9)

  [3.14.5-1] - Update to 3.14.5 Resolves: RHEL-180642 [3.14.5~rc1-1] - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-180642 [3.14.4-3] - Depend on sqlite-libs with (de)…

  Jun 25, 2026
• High max 8.1
  ELSA-2026-28921 1 CVE

  Important: nginx:1.24 security update (Oracle Linux 8)

  [1.24.0-3.0.1.2] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-3.2] - Resolves: RHEL-178676 - nginx:1.24/nginx: code execution and denial of service (CVE-2026-9256) - Resolves: RHEL-182543 - nginx: HTTP/2: Remote Denial of Service via compression b…

  Jun 24, 2026
• High max 7.8
  ELSA-2026-28923 9 CVEs

  Important: tigervnc security update (Oracle Linux 8)

  [1.15.0-10] - Rebuild for updated xorg-x11-server Resolves: RHEL-183998

  Jun 24, 2026
• High max 8.4
  ELSA-2026-28998 1 CVE

  Important: evince security update (Oracle Linux 8)

  [3.28.4-17] - Fix CVE-2026-46529: quote string arguments passed to ev_spawn - Resolves: RHEL-184039

  Jun 24, 2026
• High max 6.5
  ELSA-2026-28208 1 CVE

  Important: postgresql:13 security update (Oracle Linux 8)

  pgaudit [1.5.0-1] - Update to version 1.5.0 Related: #1855776 [1.4.0-4] - Bump release for rebuild against libpq-12.1-3 [1.4.0-3] - BuildRequires libpq-devel [1.4.0-2] - BuildRequires postgresql-server-devel [1.4.0-1] - Update to 1.4.0 [1.3.1-1] - Update to 1…

  Jun 24, 2026
• High max 8.9
  ELSA-2026-28158 2 CVEs

  Important: python-urllib3 security update (Oracle Linux 9)

  [1.26.5-8] - Security fix for CVE-2026-44431 and CVE-2026-44432 Resolves: RHEL-184816, RHEL-185123 [1.26.5-7] - Security fix for CVE-2025-66471 - Security fix for CVE-2025-66418 - Security fix for CVE-2026-21441 Resolves: RHEL-142750, RHEL-139398, RHEL-142767

  Jun 24, 2026
• High max 7.7
  ELSA-2026-25925 3 CVEs

  Important: valkey security update (Oracle Linux 9)

  [8.0.9-1] - Rebase to 8.0.9 for CVE-2026-23479 CVE-2026-25243 CVE-2026-23631

  Jun 24, 2026
• High max 8.8
  ELSA-2026-28037 4 CVEs

  Important: postgresql:15 security update (Oracle Linux 9)

  pgaudit [1.7.0-1] - Initial import for postgresql 15 module - Update to 1.7.0 - Support postgresql 15 - Related: #2128410 pg_repack [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47350 [1.4.8-1] - Update to version 1.4.8 …

  Jun 24, 2026
• High max 8.8
  ELSA-2026-26203 4 CVEs

  Important: postgresql:16 security update (Oracle Linux 9)

  pgaudit [16.0-1] - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3635 pg_repack [1.5.1-1] - Update to v1.5.1 [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604 [1.4.8-1] - Res…

  Jun 24, 2026
• High max 7.7
  ELSA-2026-23229 1 CVE

  Important: redis security update (Oracle Linux 9)

  [6.2.22-1] - rebase to 6.2.22 for CVE-2026-25243

  Jun 24, 2026
• High max 7.5
  ELSA-2026-24370 2 CVEs

  Important: frr10 security update (Oracle Linux 9)

  [10.4.3-3] - Resolves: RHEL-174696 - denial of service via crafted BGP UPDATE message [10.4.3-2] - Resolves: RHEL-174678 - denial of service via crafted FlowSpec component

  Jun 24, 2026
• High max 7.5
  ELSA-2026-26533 1 CVE

  Important: dracut security update (Oracle Linux 9)

  [057-115.git20260527.0.1] - Skip the default FIPS logic on special UEK kernels where the FIPS module is linked directly into the kernel. [Orabug: 38705580] - Ship Oracle IMA certificate [Orabug: 35992862] - Ship 98-integrity.conf, populating initramfs with Or…

  Jun 24, 2026
• High max 8.2
  ELSA-2026-20612 13 CVEs

  Important: gnutls security update (Oracle Linux 9)

  [3.8.10-4] - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite) - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour) - Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread) - Fix CVE-2026-42010 (PSK authenti…

  Jun 24, 2026
• High max 8.2
  ELSA-2026-50346 13 CVEs

  Important: gnutls security fix update (Oracle Linux 9)

  [3.8.10-4_fips] - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35925409] - Update FIPS module name for Oracle Linux [Orabug: 35925409] [3.8.10-4] - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite) - Fix C…

  Jun 24, 2026