Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,082 results · Clear filters · Feed

  • High max 8.7
    ELSA-2026-92639 10 CVEs

    Important: python-pillow security update (Oracle Linux 8)

    [5.1.1-33] - CVE-2026-112892 python-pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder Resolves: RHEL-290437 [5.1.1-32] - CVE-2026-96640 python-pillow: pillow: Denial of Service via duplicate page references in PDF files Res…

  • High max 9.2
    ELSA-2026-92420 2 CVEs 1 exploited

    Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [8.0.133-1.0.1] - Add support for Oracle Linux [8.0.133-1] - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: -RHEL-291714

  • High max 9.2
    ELSA-2026-92376 13 CVEs 1 exploited

    Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 8)

    nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

  • High max 7.5
    ELSA-2026-90909 3 CVEs

    Important: pki-deps:10.6 security update (Oracle Linux 8)

    apache-commons-collections apache-commons-lang [2.6-21] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild apache-commons-net bea-stax [1.2.0-16] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild glassfish-fastinfoset [1.2.1…

  • High max 9.8
    ELSA-2026-92616 12 CVEs

    Important: httpd:2.4 security, bug fix, and enhancement update (Oracle Linux 8)

    httpd [2.4.37-65.0.1.8] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-65.8] - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) - Resol…

  • High max 5.9
    ELSA-2026-92458 1 CVE

    Important: aspell security update (Oracle Linux 9)

    [12:0.60.8-9] - Backport fix for CVE-2026-103658

  • High max 9.2
    ELSA-2026-92378 13 CVEs 1 exploited

    Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 9)

    nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

  • High max 9.2
    ELSA-2026-92492 2 CVEs 1 exploited

    Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [8.0.133-1.0.1] - Add support for Oracle Linux [8.0.133-1] - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: RHEL-291717

  • High max 7.8
    ELSA-2026-92429 1 CVE

    Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [9.0.123-1.0.1] - Add support for Oracle Linux [9.0.123-1] - Update to .NET SDK 9.0.123 and Runtime 9.0.22 - Resolves: RHEL-291727

  • High max 8.1
    ELSA-2026-93072 4 CVEs

    Important: bind9.18 security update (Oracle Linux 9)

    [32:9.18.29-14.12] - Prevent arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300) - Fix Denial of service via assertion failure in RPZ query processing (CVE-2026-97313) - Prevent Denial of Service via assertion failure during redirect pro…

  • High max 9.8
    ELSA-2026-92862 6 CVEs

    Important: tomcat security, bug fix, and enhancement update (Oracle Linux 10)

    [1:10.1.49-5] - Resolves: RHEL-264918 tomcat: Stalled TLS handshake when the server's first flight is too large - Resolves: RHEL-255786 tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) - Resolves: RHEL-271888 tomcat: Authenti…

  • High max 9.2
    ELSA-2026-92428 2 CVEs 1 exploited

    Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [8.0.133-1.0.1] - Add support for Oracle Linux [8.0.133-1] - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: RHEL-291718

  • High max 7.8
    ELSA-2026-92438 1 CVE

    Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [10.0.114-1.0.1] - Add support for Oracle Linux [10.0.114-1] - Update to .NET SDK 10.0.114 and Runtime 10.0.14 - Resolves: RHEL-291745

  • High max 7.0
    ELSA-2026-90504 38 CVEs

    Important: java-21-openjdk security update for RHEL 10 (Oracle Linux 10)

    [1:21.0.13.0.9-1.2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:21.0.13.0.9-1.2] - Bump release for PQC build [1:21.0.13.0.9-1.1] - Update to jdk-21.0.13+9 (GA) - ** This tarball is embargoed until 2026-10-20 @ 1pm PT. ** - Update release notes to O…

  • High max 7.8
    ELSA-2026-92430 1 CVE

    Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [9.0.123-1.0.1] - Add support for Oracle Linux [9.0.123-1] - Update to .NET SDK 9.0.123 and Runtime 9.0.22 - Resolves: RHEL-291728

  • High max 9.2
    ELSA-2026-88693 1 CVE 1 exploited

    Important: php security update (Oracle Linux 7)

    [5.4.16-48.0.1] - Backport fix for CVE-2026-109619 [Orabug: 40200805]

  • High max 8.2
    ELSA-2026-92323 2 CVEs

    Important: expat security update (Oracle Linux 8)

    [2.5.0-6] - CVE-2026-102633 expat: expat: Denial of Service via integer overflow in expat_realloc - Resolves: RHEL-272828 [2.5.0-5] - CVE-2026-77214 expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer over-read in XML_ParseBuffer…

  • High max 9.8
    ELSA-2026-92368 5 CVEs

    Important: curl security, bug fix, and enhancement update (Oracle Linux 8)

    [7.61.1-34.el8_10.18] - fix incomplete mTLS config in connection reuse (CVE-2026-8932) [7.61.1-34.el8_10.17] - fix cookie injection via trailing dot super cookies (CVE-2026-8924) - fix digest auth state leak on origin or credential change (CVE-2026-11856) [7.…

  • High max 8.9
    ELSA-2026-92474 2 CVEs

    Important: python3.12-urllib3 security update (Oracle Linux 8)

    [1.26.19-5] - CVE-2026-97689 Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282256 [1.26.19-4] - CVE-2026-97687 Traffic interception via HTTPS proxy TLS configuration override Resolves: RHEL-282315

  • High max 5.9
    ELSA-2026-92615 1 CVE

    Important: aspell security update (Oracle Linux 8)

    [12:0.60.6.1-23] - Backport fix for CVE-2026-103658

  • High max 9.3
    ELSA-2026-92209 4 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-553.180.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 9.8
    ELSA-2026-92869 6 CVEs

    Important: tomcat security update (Oracle Linux 8)

    [1:9.0.121-1] - Resolves: RHEL-255793 tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) - Resolves: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183) - Resolves: RHEL-271822 tomcat: Imp…

  • High max 6.8
    ELSA-2026-91719 1 CVE

    Important: ignition security update (Oracle Linux 9)

    [2.26.0-1.2] - Rebuild with updated golang [2.26.0-1.1] - Rebuild with updated golang - Resolves: RHEL-175424, RHEL-177307

  • High max 8.9
    ELSA-2026-91057 1 CVE

    Important: libXrender security update (Oracle Linux 9)

    [0.9.10-16.2] - CVE-2026-88807 libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats in RenderQueryPictFormats Resolves: https://redhat.atlassian.net/browse/RHEL-267120

  • High max 9.6
    ELSA-2026-91580 6 CVEs

    Important: webkit2gtk3 security update (Oracle Linux 9)

    [2.54.2-0.1] - Update to 2.54.2

  • High max 7.5
    ELSA-2026-91365 1 CVE

    Important: libX11 security update (Oracle Linux 9)

    [1.8.12-1.1] - CVE-2026-88806 libX11: libX11: Heap-based buffer overflow via malicious X server X server

  • High max 7.1
    ELSA-2026-91223 1 CVE

    Important: libXtst security update (Oracle Linux 9)

    [1.2.3-16.1] - CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser read in RECORD reply parser Resolves: RHEL-271689

  • High max 6.8
    ELSA-2026-91720 1 CVE

    Important: ignition security update (Oracle Linux 10)

    [2.26.0-3.0.1.4] - Drop RHCK specific module inclusion [Orabug: 39718726] - Remove sgdisk requirement and create symbolic link to sgdisk [Orabug: 37470782] [2.26.0-4] - Rebuild ignition against updated golang [2.26.0-3] - Rebuild ignition against updated gola…

  • High max 8.1
    ELSA-2026-92419 4 CVEs

    Important: bind security update (Oracle Linux 10)

    [9.18.33-15.0.1.el10_2.14] - Hard require needed openssl-libs [Orabug: 38742109] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.18.33-15.14] - Prevent arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300) - Fi…

  • High max 7.5
    ELSA-2026-92408 3 CVEs

    Important: dogtag-pki security update (Oracle Linux 10)

    [11.9.0-6.0.1.el10_2.1] - Treat Oracle Linux the same as RHEL when selecting the Tomcat app server version. [11.9.0-6.1] - Update jackson-core, jackson-databind and resteasy - Fix CVE-2026-89059: RESTEasy IIOImageProvider Unbounded Image Decode - Fix CVE-2026…

  • High max 9.8
    ELSA-2026-90913 43 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [140.17.0-1.0.1] - Add Oracle prefs file [140.17.0] - Add OpenELA debranding [140.17.0-1] - Update to 140.17.0 ESR

  • High max 9.6
    ELSA-2026-91636 6 CVEs

    Important: webkit2gtk3 security update (Oracle Linux 8)

    [2.54.2-1] - Update to 2.54.2

  • High max 8.2
    ELSA-2026-90812 1 CVE

    Important: cjose security update (Oracle Linux 9)

    [0.6.1-17.1] - CVE-2026-53938 cjose: heap buffer overflow in AES key unwrap Resolves: RHEL-256972

  • High max 7.1
    ELSA-2026-91612 1 CVE

    Important: libXtst security update (Oracle Linux 10)

    [1.2.4-8.1] - CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser out-of-bounds read in RECORD reply parser Resolves: RHEL-271682

  • High max 7.5
    ELSA-2026-91138 3 CVEs

    Important: yggdrasil security update (Oracle Linux 10)

    [0.4.9.2-4] - Rebuild yggdrasil against updated golang [0.4.9.2-3] - Rebuild yggdrasil against updated golang [0.4.9.2-2] - Rebuild yggdrasil against updated golang

  • High max 9.8
    ELSA-2026-91565 16 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.69.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 7.5
    ELSA-2026-90492 3 CVEs

    Important: libreswan security update (Oracle Linux 8)

    [4.12-2.0.1.el8_10.7] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.12-7] - Backport fixes for CVE-2026-94453, CVE-2026-77206 and CVE-2026-77207 (RHEL-281879, RHEL-282682, RHEL-282477) [4.12-2.6] - Backport fix for CVE-2026-14957 (RHEL-212498)…

  • High max 9.2
    ELSA-2026-90501 1 CVE 1 exploited

    Important: brotli security update (Oracle Linux 8)

    [1.0.6-5] - Resolves: RHEL-290271 - CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder

  • High max 7.8
    ELSA-2026-90800 1 CVE

    Important: emacs security update (Oracle Linux 8)

    [1:26.1-15.4] - Add missing untrusted-content variable definition (fixes CVE-2026-96442) - Related: RHEL-265099 [1:26.1-15.3] - Generalize trusted-content-p check to all Flymake backends (CVE-2026-96442) - Resolves: RHEL-265099

  • High max 8.9
    ELSA-2026-90759 1 CVE

    Important: python-urllib3 security update (Oracle Linux 8)

    [1.24.2-11] - CVE-2026-97689 python-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser memory allocation in chunk parser Resolves: RHEL-282251