Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,088 results · Clear filters · Feed

  • High max 9.8
    ELSA-2026-50318 5 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-321.202.5.2] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Muhammad Alifa Ramdhan) [Orabug: 39543209] {CVE-2026-31533} - net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich) [Orabug: 39543208] {CVE-2…

  • High max 7.5
    ELSA-2026-18786 1 CVE

    Important: bind security update (Oracle Linux 9)

    [9.16.23-40.0.1.el9_8.1] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-40.1] - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) [32:9.16.23-40] - Add forgotten _libdir/named into bind…

  • High max 8.8
    ELSA-2026-18868 5 CVEs

    Important: linux-sgx security update (Oracle Linux 9)

    [2.26-7] - Fix pccs npm security flaws [2.26-6] - Port to pycryptography and pyasn1 and make keyring optional [2.26-5] - Sync specfile changes from Fedora [2.26-4] - Drop sgx-mpa dep from sgx-pccs [2.26-3] - Add scriptlets for PCCS [2.26-2] - Enable pccsadmin…

  • High max 9.1
    ELSA-2026-18913 3 CVEs

    Important: containernetworking-plugins security update (Oracle Linux 9)

    [1:1.9.0-2] - Rebuild for new golang to address CVE-2025-61726 - Resolves: RHEL-146101 [1:1.9.0-1] - update to https://github.com/containernetworking/plugins/releases/tag/v1.9.0 - Related: RHEL-111919 [1:1.8.0-1] - update to https://github.com/containernetwor…

  • High max 7.5
    ELSA-2026-19173 1 CVE

    Important: podman security update (Oracle Linux 9)

    [5.8.2-1.0.2] - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.8.2-1] - update to https://github.com/containers/podman/releases/tag/v5.8.2 - fixes CV…

  • High max 9.1
    ELSA-2026-19175 3 CVEs

    Important: python3.11 security update (Oracle Linux 9)

    [3.11.13-9.0.1] - Remove upstream URL reference [Orabug: 36073032] [3.11.13-9] - Security fixes for CVE-2026-4786, CVE-2026-6100 Resolves: RHEL-168158, RHEL-167916 [3.11.13-8] - Security fix for CVE-2026-4519 Resolves: RHEL-158053 [3.11.13-7] - Rebuilding pre…

  • High max 9.1
    ELSA-2026-19176 9 CVEs

    Important: python3.14 security update (Oracle Linux 9)

    [3.14.4-2] - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-167918, RHEL-168160 [3.14.4-1] - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-16…

  • High max 9.1
    ELSA-2026-19177 12 CVEs

    Important: python3.12 security update (Oracle Linux 9)

    [3.12.13-2.0.1] - Remove upstream URL reference [3.12.13-2] - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-168159, RHEL-167917 [3.12.13-1] - Update to 3.12.13 - Security fixes for C…

  • High max 8.8
    ELSA-2026-19180 7 CVEs

    Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update (Oracle Linux 9)

    gstreamer1-plugins-bad-free [1.22.12-7] - Rebuild to fix missing binaries due to buildsystem oversight [1.22.12-6] - Rebuild for z-stream Resolves: RHEL-156256, RHEL-156259 gstreamer1-plugins-base [1.22.12-8] - Rebuild again -7 was build in wrong target [1.22…

  • High max 7.5
    ELSA-2026-19181 2 CVEs

    Important: golang security update (Oracle Linux 9)

    [1.26.2-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.2-1] - Update to Go 1.26.2 (fips-2) - Resolves: RHEL-169929 [1.26.1-1] - Update to Go 1.26.1 - Resolves: RHEL-153434 [1.25.7-1] - Update to Go 1.25.7 (fips-1) - Resolves: RHEL-146452 …

  • High max 7.5
    ELSA-2026-19184 1 CVE

    Important: grafana-pcp security update (Oracle Linux 9)

    [5.1.1-14] - Resolves RHEL-158769: CVE-2026-25679

  • High max 7.5
    ELSA-2026-19185 1 CVE

    Important: grafana security update (Oracle Linux 9)

    [10.2.6-21] - Resolves RHEL-158767: CVE-2026-25679

  • High max 7.5
    ELSA-2026-19186 1 CVE

    Important: buildah security update (Oracle Linux 9)

    [1.43.1-1.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.43.1-1] - update to https://github.com/containers/buildah/releases/tag/v1.43.1 - fixes CVE-2026-34986 - Resolves: RHEL-165035 [2:1.43.0-3] - update to the lat…

  • High max 9.8
    ELSA-2026-19201 25 CVEs

    Important: firefox security update (Oracle Linux 9)

    [140.10.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

  • High max 7.5
    ELSA-2026-19206 18 CVEs

    Important: webkit2gtk3 security update (Oracle Linux 9)

    [2.52.3-1] - Update to 2.52.3 [2.50.4-1] - Update to 2.50.4 [2.50.3-1] - Update to 2.50.3 [2.50.1-1] - Update to 2.50.1 [2.50.0-1] - Update to 2.50.0 [2.48.5-1] - Update to 2.48.5 [2.48.3-1] - Update to 2.48.3 [2.48.2-1] - Update to 2.48.2 - Reenable JIT [2.4…

  • High max 7.5
    ELSA-2026-19210 1 CVE

    Important: gdk-pixbuf2 security update (Oracle Linux 9)

    * Tue Apr 21 2026 Benjamin Otte <botte@redhat.com - 2.42.6-6.1 - Backport fixes for CVE-2026-5201 - Related: RHEL-163069

  • High max 9.1
    ELSA-2026-19216 3 CVEs

    Important: python3.9 security update (Oracle Linux 9)

    [3.9.25-7.0.1] - Remove upstream URL reference [3.9.25-7] - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161 [3.9.25-6] - Security fix for CVE-2026-4519 Resolves: RHEL-158117 [3.9.25-5] - Rebuilding previous fixes for diff…

  • High max 7.5
    ELSA-2026-19219 5 CVEs

    Important: openssh security update (Oracle Linux 9)

    [9.9p1-7.0.2] - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM/NIST backport [Orabug: 39423076] [9.9p1-7.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] [9.9p1-7 + 0.10.4-9] - Version bump [9.9p1-5 + …

  • High max 7.4
    ELSA-2026-19220 1 CVE

    Important: sudo security update (Oracle Linux 9)

    [1.9.17p2-3] - CVE-2026-35535 sudo: Privilege escalation due to failure in privilege drop calls Resolves: RHEL-166069 [1.9.17p2-2] - Request to backport support for regex in sudo [rhel-9] Resolves: RHEL-1376 - Rebase of sudo to 1.9.17p2 [rhel-9] Resolves: RHE…

  • High max 8.2
    ELSA-2026-19224 1 CVE

    Important: vim security update (Oracle Linux 9)

    [2:8.2.2637-26.0.1.el9_8.4] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-26.4] - Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass [2:8.2.2637-26.3] - Related: RHEL-159630 rebuild to build with exception target …

  • High max 8.8
    ELSA-2026-19225 4 CVEs 1 exploited

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-687.5.3] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [O…

  • High max 9.8
    ELSA-2026-13977 5 CVEs

    Important: firefox security update (Oracle Linux 7)

    [140.9.1-1.0.1] - Update to 140.9.1 ESR [Orabug: 39324689][CVE-2026-5731][CVE-2026-5732] [CVE-2026-5734][CVE-2026-33416][CVE-2026-33636] [140.9.0-1.0.1] - Update to 140.9.0 ESR [Orabug: 39361657][CVE-2026-4684][CVE-2026-4685] [CVE-2026-4686][CVE-2026-4687][CV…

  • High max 10.0
    ELSA-2026-8427 37 CVEs

    Important: firefox security update (Oracle Linux 7)

    [140.9.0-1.0.1] - Update to 140.9.0 ESR [Orabug: 39361657][CVE-2026-4684][CVE-2026-4685] [CVE-2026-4686][CVE-2026-4687][CVE-2026-4688][CVE-2026-4689][CVE-2026-4690] [CVE-2026-4691][CVE-2026-4692][CVE-2026-4693][CVE-2026-4694][CVE-2026-4695] [CVE-2026-4696][CV…

  • High max 7.5
    ELSA-2026-25110 2 CVEs

    Important: .NET 8.0 security update (Oracle Linux 8)

    [8.0.128-1.0.1] - Add support for Oracle Linux [8.0.128-1] - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181052 [8.0.126-2] - Update to .NET SDK 8.0.126 and Runtime 8.0.26 - Resolves: RHEL-163413 [8.0.125-2] - Update to .NET SDK 8.0.125 and…

  • High max 7.5
    ELSA-2026-25113 2 CVEs

    Important: .NET 9.0 security update (Oracle Linux 8)

    [9.0.118-1.0.1] - Add support for Oracle Linux [9.0.118-1] - Update to .NET SDK 9.0.118 and Runtime 9.0.17 - Resolves: RHEL-181550 [9.0.116-2] - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163389 [9.0.115-2] - Update to .NET SDK 9.0.115 and…

  • High max 7.5
    ELSA-2026-25114 2 CVEs

    Important: .NET 10.0 security update (Oracle Linux 8)

    [10.0.109-1.0.1] - Add support for Oracle Linux [10.0.109-1] - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181555 [10.0.106-2] - Update to .NET SDK 10.0.106 and Runtime 10.0.6 - Resolves: RHEL-163381 [10.0.104-2] - Update to .NET SDK 10.0.…

  • High max 10.0
    ELSA-2026-3984 38 CVEs

    Important: firefox security update (Oracle Linux 7)

    [140.8.0-2.0.1] - Update to 140.8.0 ESR [Orabug: 39361647][CVE-2026-2447][CVE-2026-2757] [CVE-2026-2758][CVE-2026-2759][CVE-2026-2760][CVE-2026-2761][CVE-2026-2762] [CVE-2026-2763][CVE-2026-2764][CVE-2026-2765][CVE-2026-2766][CVE-2026-2767] [CVE-2026-2768][CV…

  • High max 7.8
    ELSA-2026-24984 1 CVE

    Important: poppler security update (Oracle Linux 8)

    [20.11.0-14] - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Resolves: RHEL-180567

  • High max 7.5
    ELSA-2026-25030 1 CVE

    Important: postgresql-jdbc security update (Oracle Linux 8)

    [42.2.14-4] - Limit SCRAM PBKDF2 iterations to prevent DoS via malicious server - Resolves: CVE-2026-42198

  • High max 9.3
    ELSA-2026-11323 11 CVEs

    Important: freerdp security update (Oracle Linux 7)

    [2.1.1-5.0.7] - Fixed CVE-2026-22852 CVE-2026-22854 CVE-2026-22856 CVE-2026-23732 CVE-2026-23948 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24679 CVE-2026-24684 CVE-2026-31806 [Orabug: 39272429] [2.1.1-5.0.5] - Fixed CVE-2026-26955 CVE-2026-26956 […

  • High max 7.5
    ELSA-2026-9682 7 CVEs

    Important: java-1.8.0-openjdk security update (Oracle Linux 7)

    [1.8.0.492.b09-1.0.1] - Update to 8u492-b09 (GA) [Orabug: 39247147][CVE-2026-22007][CVE-2026-22013] [CVE-2026-22016][CVE-2026-22018][CVE-2026-22021][CVE-2026-23865][CVE-2026-34268] [1.8.0.482.b08-1.0.1] - Update to 8u482-b08 (GA). [Orabug: 38893614] - Update …

  • High max 7.5
    ELSA-2026-24545 1 CVE

    Important: libyang security update (Oracle Linux 8)

    [1.0.184-2] - DoS or arbitrary code execution via maliciously crafted LYB binary blob - Resolves: RHEL-177017 - CVE-2026-44673

  • High max 9.2
    ELSA-2026-7675 18 CVEs

    Important: nodejs24 security update (Oracle Linux 10)

    [1:24.14.1-2.0.2] - Rebuild to correct NVR [1:24.14.1-2.0.1] - Update upstream references

  • High max 7.5
    ELSA-2026-24339 2 CVEs

    Important: bind security update (Oracle Linux 8)

    [32:9.11.36-16.8] - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946)

  • High max 7.5
    ELSA-2026-24340 1 CVE

    Important: frr security update (Oracle Linux 8)

    [7.5.1-24.0.1] - Fix POSTIN scriptlet [Orabug: 34712485] [7.5.1-24] - Fix off-by-one error in FlowSpec operator array bounds checking (CVE-2026-37457) - Resolves: RHEL-174676

  • High max 8.7
    ELSA-2026-24365 2 CVEs

    Important: unbound security update (Oracle Linux 8)

    [1.16.2-5.11] - Fix CVE-2026-42944 (RHEL-177909) - Fix CVE-2026-42959 (RHEL-177809)

  • High max 9.1
    ELSA-2026-50306 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.356.4.2] - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland) [Orabug: 39017592] {CVE-2025-10263} - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland) [Orabug: 39017592] - ARM: uek: Disable CONFIG_QCOM_FALKOR_ERR…

  • High max 9.1
    ELSA-2026-50305 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-321.202.5.1] - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland) [Orabug: 39017590] {CVE-2025-10263} - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland) [Orabug: 39017590] - ARM: uek: Disable CONFIG_NVIDIA_CARMEL_CN…

  • High max 9.1
    ELSA-2026-50304 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-203.76.7.3] - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland) [Orabug: 39017589] {CVE-2025-10263} - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland) [Orabug: 39017589] - arm64: tlb: allow XZR argument to TLBI ops…

  • High max 7.1
    ELSA-2026-23258 1 CVE

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.129.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […