Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,089 results · Clear filters · Feed

  • High max 7.1
    ELSA-2026-23258 1 CVE

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.129.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 7.5
    ELSA-2026-23360 2 CVEs

    Important: bind9.16 security update (Oracle Linux 8)

    [32:9.16.23-0.22.6] - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946)

  • High max 7.3
    ELSA-2026-22305 4 CVEs

    Important: php:8.2 security update (Oracle Linux 8)

    libzip php [8.2.31-1] - rebase to 8.2.31 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip

  • High max 2.9
    ELSA-2026-22721 1 CVE

    Important: expat security update (Oracle Linux 8)

    [2.5.0-2] - Fix CVE-2026-45186 - Resolves: RHEL-177979

  • High max 9.8
    ELSA-2026-22643 19 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [140.11.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.11.0] - Add OpenELA debranding [140.11.0-1] - Update to 140.11.0 ESR

  • High max 9.8
    ELSA-2026-50299 8 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.356.4.1] - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada) [Orabug: 39463669] [5.4.17-2136.356.4] - tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi) [Orabug: 39429147] - tap: free page on error…

  • High max 9.0
    ELSA-2026-22644 3 CVEs

    Important: samba security update (Oracle Linux 8)

    [4.19.4-16.0.1] - s3: winbindd: winbindd_pam: fix leak in extract_pac_vrfy_sigs [Orabug: 36518285] - s3:passdb: Do not leak memory in pdb_tdb [Orabug: 36371377] - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs in OL8 [Orabug: 3020…

  • High max 9.8
    ELSA-2026-50294 7 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-321.202.5] - Revert 'ip6_tunnel: Fix usage of skb_vlan_inet_prepare()' (Harshit Mogalapalli) [Orabug: 39476647] - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada) [Orabug: 39463672] [5.15.0-321.202.4] - tun: free page…

  • High max 7.5
    ELSA-2026-22112 11 CVEs

    Important: go-toolset:ol8 security update (Oracle Linux 8)

    delve [1.25.2-1.0.1] golang [1.25.9-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var - Backported from OL9u7 - Resolves: OLDIS-53586

  • High max 9.8
    ELSA-2026-50293 13 CVEs 2 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-203.76.7.1] - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada) [Orabug: 39474418] [6.12.0-203.76.7] - tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi) [Orabug: 39456024] - tap: free page on error pat…

  • High max 9.8
    ELSA-2026-22140 6 CVEs

    Important: httpd:2.4 security update (Oracle Linux 8)

    httpd [2.4.37-65.0.1.7] - Replace index.html with Oracle's index page oracle_index.html mod_http2 [1.15.7-10.5] - Resolves: RHEL-166277 - httpd:2.4/httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) mod_md [1:2.0.8-8.2] - Resolves: RHEL…

  • High max 8.8
    ELSA-2026-7292 2 CVEs

    Important: freerdp security update (Oracle Linux 7)

    [2.1.1-5.0.5] - Fixed CVE-2026-26955 CVE-2026-26956 [Orabug: 39189643] [2:2.2.0-5.0.3] - Fixed CVE-2026-22855 CVE-2026-22858 CVE-2026-22859 [Orabug: 39075086] [2:2.2.0-5.0.1] - fixed CVE-2026-23530 CVE-2026-23531 CVE-2026-23532 CVE-2026-23533 CVE-2026-23884 […

  • High max 7.5
    ELSA-2026-21291 2 CVEs

    Important: .NET 8.0 security update (Oracle Linux 8)

    [8.0.127-1.0.1] - Add support for Oracle Linux [8.0.127-1] - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173920

  • High max 9.8
    ELSA-2026-21382 18 CVEs

    Important: firefox security update (Oracle Linux 8)

    [140.11.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.11.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.11.0-1] - …

  • High max 8.0
    ELSA-2026-21700 1 CVE

    Important: cockpit security update (Oracle Linux 8)

    [310.8-1.0.1] - Fixed cockpit_ws_t selinux issue for tmpfs [Orabug: 36013589] - Move update-motd out of cockpit_ws_t context [Orabug: 36013589] - Update documentation links [Orabug: 34706402] - Drop subscription-manager-cockpit requirement for ol [Orabug: 346…

  • High max 9.3
    ELSA-2026-21756 2 CVEs

    Important: flatpak security update (Oracle Linux 8)

    [1.12.9-4] - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165633 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170160

  • High max 9.4
    ELSA-2026-21706 18 CVEs

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.126.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 9.6
    ELSA-2026-20586 4 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [140.10.1-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.10.1] - Add OpenELA debranding [140.10.1-1] - Update to 140.10.1 ESR

  • High max 7.5
    ELSA-2026-21294 1 CVE

    Important: .NET 9.0 security update (Oracle Linux 8)

    [9.0.117-1.0.1] - Add support for Oracle Linux [9.0.117-1] - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173915

  • High max 7.5
    ELSA-2026-21295 1 CVE

    Important: .NET 10.0 security update (Oracle Linux 8)

    [10.0.108-1.0.1] - Add support for Oracle Linux [10.0.108-1] - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173906

  • High max 8.2
    ELSA-2026-20611 11 CVEs

    Important: gnutls security update (Oracle Linux 8)

    [3.6.16-8.6] - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite) - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour) - Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread) - Fix CVE-2026-42010 (PSK authen…

  • High max 7.8
    ELSA-2026-20585 1 CVE

    Important: compat-libtiff3 security update (Oracle Linux 8)

    [3.9.4-15] - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159315)

  • High max 8.4
    ELSA-2026-20589 5 CVEs

    Important: dnsmasq security update (Oracle Linux 8)

    [2.79-36] - Prevent overflow in extract_name function (CVE-2026-2291) - Prevent DoS in DNSSEC validation (CVE-2026-4890) - Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891) - Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892) - Prevent…

  • High max 9.8
    ELSA-2026-20566 3 CVEs

    Important: firefox security update (Oracle Linux 8)

    [140.10.2-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.10.2] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.10.2-1] - …

  • High max 8.1
    ELSA-2026-20614 1 CVE

    Important: ruby:3.3 security update (Oracle Linux 8)

    ruby [3.3.10-6] - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316) Resolves: RHEL-171247 rubygem-abrt [0.4.0-1] - Update to abrt 0.4.0. Resolves: rhbz#1842476 rubygem-mysql2 [0.5.5-1] - Upgrade to mysql2 0.5.5. Related: RHEL-17…

  • High max 7.8
    ELSA-2026-50288 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel security update: Fragnesia (Oracle Linux 7)

    [5.4.17-2136.355.3.4] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug: 39420568] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39420568]

  • High max 7.8
    ELSA-2026-50287 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel security update: Fragnesia (Oracle Linux 8)

    [5.15.0-320.202.8.5] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug: 39420565] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39420565]

  • High max 7.8
    ELSA-2026-50286 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel security update: Fragnesia (Oracle Linux 9)

    [6.12.0-202.76.4.4] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug: 39420559] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39420559]

  • High max 9.6
    ELSA-2026-19588 4 CVEs

    Important: firefox security update (Oracle Linux 8)

    [140.10.1-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.10.1] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.10.1-1] - …

  • High max 7.5
    ELSA-2026-12114 1 CVE

    Important: gdk-pixbuf2 security update (Oracle Linux 7)

    [2.36.12-3.0.3] - Backport fixes for CVE-2026-5201 [Orabug: 39288631] [2.36.12-3.0.1] - jpeg: Be more careful with chunked icc data [Orabug: 38359772][CVE-2025-7345]

  • High max 7.5
    ELSA-2026-19559 1 CVE

    Important: libsndfile security update (Oracle Linux 8)

    [1.0.28-17] - apply patch for CVE-2026-37555 Resolves: ?RHEL-174533

  • High max 7.8
    ELSA-2026-19666 2 CVEs 1 exploited

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.125.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High
    ELSA-2026-65763 0 CVEs

    Important: oci-utils security update (Oracle Linux 8)

    [-- 0.14.0-22] - Rework systemd service file creation. [Orabug: 39316494]

  • High max 7.1
    ELSA-2026-50281 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.355.3.3] - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) [Orabug: 39391459] {CVE-2026-46333} [5.4.17-2136.355.3.2] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 3936877…

  • High max 7.1
    ELSA-2026-50280 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-320.202.8.4] - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) [Orabug: 39391447] {CVE-2026-46333} [5.15.0-320.202.8.3] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton) [Orabug: 39362036] {CVE-2026-31402} - net/sched…

  • High max 7.1
    ELSA-2026-50279 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-202.76.4.3] - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) [Orabug: 39391434] {CVE-2026-46333}

  • High max 9.2
    ELSA-2026-8880 2 CVEs

    Important: squid security update (Oracle Linux 7)

    [7:3.5.20-17.0.11.13] - Security update for CVE-2026-32748 CVE-2026-33526 [Orabug: 39230173] [7:3.5.20-17.0.9.13] - Fixes CVE-2025-62168, squid: Squid vulnerable to information disclosure via - authentication credential leakage in error handling [Orabug: 3858…

  • High max 8.1
    ELSA-2026-18030 1 CVE

    Important: ruby:3.3 security update (Oracle Linux 9)

    ruby [3.3.10-6] - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316) Resolves: RHEL-171255 [3.3.10-5] - Upgrade to Ruby 3.3.10. Resolves: RHEL-127912 - Fix possible denial of service in resolv gem (CVE-2025-24294) - Fix URI Crede…

  • High max 8.1
    ELSA-2026-18039 1 CVE

    Important: ruby security update (Oracle Linux 9)

    [3.0.7-166] - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316) Resolves: RHEL-171254

  • High max 8.8
    ELSA-2026-50275 5 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-318.199.3.6] - xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman) [Orabug: 39368252] {CVE-2026-43284} - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) [Orabug: 39368252] {CVE-2026-43284} - x86/CPU/AMD: Add a fix for AMD…