Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,088 results · Clear filters · Feed

High max 8.3

ELSA-2026-20596 2 CVEs

Important: ruby:4.0 security update (Oracle Linux 9)

ruby [4.0.3-32] - Upgrade to Ruby 4.0.3. Resolves: RHEL-171933 - Fix ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) Resolves: RHEL-171258 - Fix JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-…

Jun 24, 2026
High max 8.8

ELSA-2026-28143 2 CVEs

Important: postgresql:16 security update (Oracle Linux 8)

pgaudit [16.0-1] - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3636 pg_repack [1.5.1-1] - Update to 1.5.1 postgres-decoderbufs [2.4.0-1.Final] - Initial import for postgresql 16 stream - Related: RHEL-3636 postgre…

Jun 23, 2026
High max 7.1

ELSA-2026-27811 1 CVE

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.137.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Jun 23, 2026
High max 8.2

ELSA-2026-50337 2 CVEs

Important: virt:kvm_utils3 security update (Oracle Linux 8)

hivex [1.3.18-23] - Limit recursion in ri-records (CVE-2021-3622) resolves: rhbz#1976194 [1.3.18-22.el8] - Resolves: bz#2000225 (Rebase virt:rhel module:stream based on AV-8.6) [1.3.18-21] - Bounds check for block exceeding page length (CVE-2021-3504) resolve…

Jun 23, 2026
High max 8.5

ELSA-2026-19342 5 CVEs

Important: tigervnc security update (Oracle Linux 9)

[1.15.0-7.1] - Fix CVE-2026-33999, CVE-2026-34000, CVE-2026-34001, CVE-2026-34002, CVE-2026-34003 xorg-x11-server: various XKB and XSYNC vulnerabilities Resolves: RHEL-163213 Resolves: RHEL-163281 Resolves: RHEL-163267 - Fix CVE-2026-34352 Resolves: RHEL-1679…

Jun 23, 2026
High max 7.5

ELSA-2026-19350 4 CVEs

Important: git-lfs security update (Oracle Linux 9)

[3.7.1-4] - Rebuild with new Golang - Resolves: RHEL-158765, RHEL-166675, RHEL-167677, RHEL-170838

Jun 23, 2026
High max 7.5

ELSA-2026-19351 2 CVEs

Important: grafana-pcp security update (Oracle Linux 9)

[5.1.1-15] - Resolves RHEL-166679: CVE-2026-32282 - Resolves RHEL-167679: CVE-2026-32283

Jun 23, 2026
High max 7.5

ELSA-2026-19352 3 CVEs

Important: grafana security update (Oracle Linux 9)

[10.2.6-22] - Resolves RHEL-161803: CVE-2026-27877 - Resolves RHEL-166678: CVE-2026-32282 - Resolves RHEL-167678: CVE-2026-32283

Jun 23, 2026
High max 7.8

ELSA-2026-19362 6 CVEs

Important: gimp security update (Oracle Linux 9)

[2:3.0.4-4.4] - fix CVE-2026-4150 - align with Y-stream - fix CVE-2026-4151 - fix CVE-2026-4152 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887 [2:3.0.4-4.3] - fix CVE-2026-4150 - Resolves: RHEL-167738

Jun 23, 2026
High max 7.8

ELSA-2026-19363 1 CVE

Important: libtiff security update (Oracle Linux 9)

[4.4.0-18] - rebuild [4.4.0-15.3] - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159331)

Jun 23, 2026
High max 8.2

ELSA-2026-20568 2 CVEs

Important: jmc security update (Oracle Linux 9)

[8.2.0-5] - Remove the websocket plugin. Related: RHEL-168615 [8.2.0-4] - Bump LZ4 Version to 1.10.2. Related: RHEL-135478

Jun 23, 2026
High max 8.4

ELSA-2026-19373 5 CVEs

Important: dnsmasq security update (Oracle Linux 9)

[2.85-18.1] - Prevent overflow in extract_name function (CVE-2026-2291) - Prevent DoS in DNSSEC validation (CVE-2026-4890) - Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891) - Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892) - Preve…

Jun 23, 2026
High max 7.5

ELSA-2026-19610 1 CVE

Important: libsndfile security update (Oracle Linux 9)

[1.0.32-9.1] - apply patch for CVE-2026-37555 Resolves: ?RHEL-174543

Jun 23, 2026
High max 8.1

ELSA-2026-19167 1 CVE

Important: pcs security update (Oracle Linux 9)

[0.11.11-2.el9_8.1] - Fixed CVE-2026-4800 by updating pcs-web-ui to 0.1.24.3 Resolves: RHEL-164206

Jun 23, 2026
High max 8.6

ELSA-2026-19359 1 CVE

Important: openexr security update (Oracle Linux 9)

[3.1.1-3.2] - fix CVE-2026-34588

Jun 23, 2026
High max 7.5

ELSA-2026-19364 3 CVEs

Important: dovecot security update (Oracle Linux 9)

[1:2.3.16-18] - rebuild [1:2.3.16-17] - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161640) - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162288) …

Jun 23, 2026
High max 7.5

ELSA-2026-19365 2 CVEs

Important: jq security update (Oracle Linux 9)

[1.6-19.2] - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions - Resolves: RHEL-168185 [1.6-19.1] - Fix CVE-2026-39979 out-of-bounds read in jv_parse_sized() - Resolves: RHEL-168202

Jun 23, 2026
High max 7.5

ELSA-2026-19366 1 CVE

Important: python-markdown security update (Oracle Linux 9)

[3.3.4-4.2] - Fix CVE-2025-69534 (RHEL-153747)

Jun 23, 2026
High max 9.8

ELSA-2026-21381 19 CVEs

Important: thunderbird security update (Oracle Linux 9)

[140.11.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.11.0] - Add OpenELA debranding [140.11.0-1] - Update to 140.11.0 ESR [140.10.1-1] - Update to 140.10.1 ESR

Jun 23, 2026
High max 9.8

ELSA-2026-21391 5 CVEs

Important: httpd security update (Oracle Linux 9)

[2.4.62-13.0.1.el9_8.1] - Replace index.html with Oracle's index page oracle_index.html. [2.4.62-13.1] - Resolves: RHEL-173555 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) - Resolves: RHEL…

Jun 23, 2026
High max 8.0

ELSA-2026-21468 1 CVE

Important: cockpit security update (Oracle Linux 9)

[356.2-1.0.1] - Apply the patch for duplicate reference [Orabug: 39250109] - Storage: Enable btrfs support [Orabug: 37464632] - Replaced upstream urls in documentation with oracle links [Orabug: 36528753] - Drop subscription-manager-cockpit requirement for ol…

Jun 23, 2026
High max 9.3

ELSA-2026-21755 2 CVEs

Important: flatpak security update (Oracle Linux 9)

[1.12.9-4.1] - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165643 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170171

Jun 23, 2026
High max 7.5

ELSA-2026-24368 2 CVEs

Important: bind9.18 security update (Oracle Linux 9)

[32:9.18.29-14.2] - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946)

Jun 23, 2026
High max 9.1

ELSA-2026-24369 3 CVEs

Important: unbound security update (Oracle Linux 9)

[1.24.2-3.1] - Fix CVE-2026-33278 (RHEL-177822) Fix CVE-2026-42944 (RHEL-177936) Fix CVE-2026-42959 (RHEL-177797) [1.24.2-3] - Install correct trust anchor source in Image Mode (RHEL-127540)

Jun 23, 2026
High max 7.5

ELSA-2026-22121 11 CVEs

Important: golang security update (Oracle Linux 9)

[1.26.3-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.3-1] - Update to Go 1.26.3 (fips-1) - Resolves: RHEL-175607

Jun 23, 2026
High max 7.3

ELSA-2026-22143 4 CVEs

Important: php:8.2 security update (Oracle Linux 9)

php [8.2.31-1] - rebase to 8.2.31 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd [2.0.3-4] - build for PHP 8.1 #2070040 [2.0.3-3] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 [2.0.3-2] - Rebuilt for …

Jun 23, 2026
High max 2.9

ELSA-2026-23230 1 CVE

Important: expat security update (Oracle Linux 9)

[2.5.0-6.1] - Fix CVE-2026-45186 - Resolves: RHEL-177988

Jun 23, 2026
High max 7.5

ELSA-2026-25057 1 CVE

Important: mod_http2 security update (Oracle Linux 9)

[2.0.26-6.1] - Resolves: RHEL-182417 - mod_http2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) [2.0.26-6] - Resolves: RHEL-166293 - httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)

Jun 23, 2026
High max 7.8

ELSA-2026-25058 1 CVE

Important: poppler security update (Oracle Linux 9)

[21.01.0-24.el9_8.1] - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Resolves: RHEL-180580

Jun 23, 2026
High max 7.7

ELSA-2026-25219 3 CVEs

Important: redis:7 security update (Oracle Linux 9)

[7.2.14-1.0.1] - Build with 64k pages to support redis on UEK on aarch64 [7.2.14-1] - rebase to 7.2.14 for CVE-2026-23479 CVE-2026-25243 CVE-2026-23631

Jun 23, 2026
High max 7.5

ELSA-2026-25220 2 CVEs

Important: .NET 8.0 security update (Oracle Linux 9)

[8.0.128-1.0.1] - Add support for Oracle Linux [8.0.128-1] - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181055 [8.0.127-1] - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173923

Jun 23, 2026
High max 7.5

ELSA-2026-25221 2 CVEs

Important: .NET 9.0 security update (Oracle Linux 9)

[9.0.118-1.0.1] - Add support for Oracle Linux [9.0.118-1] - Update to .NET SDK 9.0.118 and Runtime 9.0.17 - Resolves: RHEL-181553 [9.0.117-1] - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173918

Jun 23, 2026
High max 7.5

ELSA-2026-25222 2 CVEs

Important: .NET 10.0 security update (Oracle Linux 9)

[10.0.109-1.0.1] - Add support for Oracle Linux [10.0.109-1] - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181558 [10.0.108-1] - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173910

Jun 23, 2026
High max 8.8

ELSA-2026-25927 16 CVEs

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.52.4-1] - Update to 2.52.4

Jun 23, 2026
High max 3.7

ELSA-2026-26205 1 CVE

Important: postfix security update (Oracle Linux 9)

[2:3.5.25-3] - Fix for CVE-2026-43964: buffer over-read via malformed enhanced status code. Resolves: RHEL-176550

Jun 23, 2026
High max 7.4

ELSA-2026-26206 1 CVE

Important: fence-agents security update (Oracle Linux 9)

[4.10.0-110.3] - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182313 [4.10.0-110.2] - bundled pyasn1: fix CVE-2026-30922 Resolves: RHEL-157202 [4.10.0-110.1] - bundled cryptography: replace with dependency to fix CVE-2026-26007 - bun…

Jun 23, 2026
High max 5.1

ELSA-2026-19367 1 CVE

Important: giflib update (Oracle Linux 9)

[5.2.1-10.1] - rebuild [5.2.1-10] - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154864)

Jun 23, 2026
High max 7.5

ELSA-2026-22304 1 CVE

Important: postgresql-jdbc security update (Oracle Linux 9)

[42.2.28-2.2] - Add tests for CVE-2026-42198 [42.2.28-2.1] - Fix CVE-2026-42198: limit SCRAM PBKDF2 iterations to prevent DoS - Resolves: RHEL-173489

Jun 23, 2026
High max 9.3

ELSA-2026-26297 2 CVEs

Important: hplip security update (Oracle Linux 9)

[3.21.2-6.4] - Fix more leaks in hpcups [3.21.2-6.3] - OSH fixes after CVE-2026-8631 [3.21.2-6.2] - CVE-2026-8631 hplip: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups [3.21.2-6.1] - CVE-2026-8632 hplip: Privilege esca…

Jun 23, 2026
High max 7.4

ELSA-2026-26323 1 CVE

Important: tomcat security update (Oracle Linux 9)

[1:9.0.117-1] - Resolves: RHEL-150714 Certificate revocation bypass due to improper OCSP response validation - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVE-2026-34500) - Resolves: Tomcat: Cloud membership for…

Jun 23, 2026