Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,089 results · Clear filters · Feed

  • High max 8.5
    ELSA-2026-13414 4 CVEs

    Important: tigervnc security update (Oracle Linux 8)

    [1.15.0-9] - Fix CVE-2026-33999, CVE-2026-34000, CVE-2026-34001, CVE-2026-34002, CVE-2026-34003 xorg-x11-server: various XKB and XSYNC vulnerabilities Resolves: RHEL-163203 Resolves: RHEL-163271 Resolves: RHEL-163257 - Fix CVE-2026-34352 Resolves: RHEL-167760

  • High max 9.8
    ELSA-2026-13284 3 CVEs

    Important: LibRaw security update (Oracle Linux 8)

    [0.19.5-6] - Backport fix for CVE-2026-24660 from upstream Resolves: RHEL-165412 [0.19.5-5] - Backport fixes for CVE-2026-20889 and CVE-2026-21413 from upstream - Migrate to SPDX license Resolves: RHEL-165404, RHEL-165408

  • High max 6.7
    ELSA-2026-13285 1 CVE

    Important: libcap security update (Oracle Linux 8)

    [2.48-6.1] - Fix TOCTOU race condition in cap_set_file() (CVE-2026-4878) Resolves: RHEL-169304

  • High max 7.5
    ELSA-2026-13383 5 CVEs

    Important: openssh security update (Oracle Linux 8)

    [8.0p1-29.0.1] - Update upstream references [Orabug: 36587718] [8.0p1-29] - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164743 - CVE-2026-35388: Add connection multiplexing confirmation for …

  • High max 9.8
    ELSA-2026-13577 6 CVEs 1 exploited

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.123.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 9.8
    ELSA-2026-13537 26 CVEs 1 exploited

    Important: thunderbird security update (Oracle Linux 8)

    [140.10.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.10.0] - Add OpenELA debranding [140.10.0-1] - Update to 140.10.0 ESR

  • High max 7.5
    ELSA-2026-13381 5 CVEs

    Important: openssh security update (Oracle Linux 9)

    [8.7p1-49.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626] [8.7p1-49] - CVE-2026-35385: Fix privileg…

  • High max 9.8
    ELSA-2026-13565 4 CVEs 1 exploited

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-611.54.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 7.5
    ELSA-2026-13380 5 CVEs

    Important: openssh security update (Oracle Linux 10)

    [9.9p1-14.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-14] - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164738 - CVE-2026-35388: Add connection multiplexing …

  • High max 7.5
    ELSA-2026-13498 3 CVEs

    Important: dovecot security update (Oracle Linux 10)

    [1:2.3.21-16.1] - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161625) - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162273) - fix CVE-2026-27857: …

  • High max 7.5
    ELSA-2026-13643 1 CVE

    Important: osbuild-composer security update (Oracle Linux 10)

    [149-6.0.1] - Add missing dependency over dracut-config-rescue for image-installer [Orabug: 38587453] - Add OL10 support - Update repository URLs for baseos, appstream and UERK - Fix the label for UEKR repository - Simplify repository names [JIRA: OLDIS-35893…

  • High max 9.8
    ELSA-2026-13566 4 CVEs 1 exploited

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-124.55.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 7.0
    ELSA-2026-9614 1 CVE

    Important: python security update (Oracle Linux 7)

    [2.7.5-94.0.7] - Fix for CVE-2026-4519 [Orabug: 39243798]

  • High max 7.0
    ELSA-2026-9745 1 CVE

    Important: python3 security update (Oracle Linux 7)

    [3.6.8-21.0.11] - Security update CVE-2026-4519 [Orabug: 39246828]

  • High max 7.8
    ELSA-2026-50255 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel security update: Copy Fail (Oracle Linux 7)

    [5.4.17-2136.354.4.2] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [Orabug: 39292250] - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39292250] - crypto: authencesn - Fix src offset w…

  • High max 7.8
    ELSA-2026-50253 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel security update: Copy Fail (Oracle Linux 8)

    [5.15.0-319.201.4.4] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [Orabug: 39291961] - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39291961] - crypto: authencesn - Fix src offset wh…

  • High max 7.8
    ELSA-2026-50254 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel security update: Copy Fail (Oracle Linux 9)

    [6.12.0-201.74.2.2] - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39292190] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39292190] - crypto: authencesn - Do not place hiseq …

  • High max 7.8
    ELSA-2026-11656 3 CVEs

    Important: xorg-x11-server-Xwayland security update (Oracle Linux 8)

    [21.1.3-20] - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001 CVE-2026-34002, CVE-2026-34003 Resolves: https://redhat.atlassian.net/browse/RHEL-163191 Resolves: https://redhat.atlassian.net/browse/RHEL-163287 Resolves: https://redhat.atlassian.net…

  • High max 8.2
    ELSA-2026-12176 3 CVEs

    Important: fence-agents security update (Oracle Linux 8)

    [4.2.1-129.25] - bundled cryptography: replace with dependency to fix CVE-2026-26007 - bundled PyJWT: replace with dependency to fix CVE-2026-32597 - bundled pyasn1: fix CVE-2026-30922 Resolves: RHEL-148431, RHEL-155670, RHEL-157189

  • High max 7.8
    ELSA-2026-12271 1 CVE

    Important: libtiff security update (Oracle Linux 9)

    [4.4.0-15.3] - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159330)

  • High max 7.4
    ELSA-2026-12310 1 CVE

    Important: sudo security update (Oracle Linux 9)

    [1.9.5p2-15] RHEL 9.7.0 ERRATUM - CVE-2026-35535 - Privilege escalation due to failure in privilege drop calls Resolves: RHEL-166065

  • High max 6.7
    ELSA-2026-12441 1 CVE

    Important: libcap security update (Oracle Linux 9)

    [2.48-10.1] - Fix TOCTOU race condition in cap_set_file() (CVE-2026-4878) Resolves: RHEL-169311

  • High max 7.5
    ELSA-2026-11881 1 CVE

    Important: grafana-pcp security update (Oracle Linux 10)

    [5.3.0-4] - Resolves RHEL-166433: CVE-2026-32282 - Resolves RHEL-167474: CVE-2026-32283

  • High max 7.8
    ELSA-2026-12265 1 CVE

    Important: libtiff security update (Oracle Linux 10)

    [4.6.0-6.3] - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159309)

  • High max 9.8
    ELSA-2026-12285 25 CVEs

    Important: thunderbird security update (Oracle Linux 10)

    [140.10.0-1.0.1] - Add Oracle prefs [140.10.0-1] - Update to 140.10.0 ESR

  • High max 6.7
    ELSA-2026-12423 1 CVE

    Important: libcap security update (Oracle Linux 10)

    [2.69-7.1] - Fix TOCTOU race condition in cap_set_file() (CVE-2026-4878) Resolves: RHEL-169301

  • High max 7.5
    ELSA-2026-11507 3 CVEs

    Important: grafana security update (Oracle Linux 8)

    [9.2.10-30.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-30] - Resolves RHEL-166519: CVE-2026-32282 - Resolves RHEL-167380: CVE-2026-32280 - Resolves RHEL-167542: CVE-2026-32283

  • High max 8.2
    ELSA-2026-11509 1 CVE

    Important: vim security update (Oracle Linux 8)

    [8.0.1763-22.0.1.el8_10.3] - Remove upstream references [Orabug: 31197557] - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984] [2:8.0.1763-22.3] - Relates: RHEL-164956 vim: arbitrary command execution via modeline sandbox byp…

  • High max 7.5
    ELSA-2026-11514 3 CVEs

    Important: grafana-pcp security update (Oracle Linux 8)

    [5.1.1-14] - Resolves RHEL-166520: CVE-2026-32282 - Resolves RHEL-167381: CVE-2026-32280 - Resolves RHEL-167543: CVE-2026-32283

  • High max 7.8
    ELSA-2026-11692 3 CVEs

    Important: xorg-x11-server security update (Oracle Linux 8)

    [1.20.11-28] - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001 CVE-2026-34002, CVE-2026-34003 Resolves: https://redhat.atlassian.net/browse/RHEL-163216 Resolves: https://redhat.atlassian.net/browse/RHEL-163298 Resolves: https://redhat.atlassian.ne…

  • High max 7.4
    ELSA-2026-11521 1 CVE

    Important: sudo security update (Oracle Linux 8)

    [1.9.5p2-1.0.1.el8_10.5] - Fixes sudo -s unclosed sessions when use_pty option used [Orabug: 36952911] [1.9.5p2-1.5] RHEL 8.10.0.Z ERRATUM - CVE-2026-35535 - Privilege escalation due to failure in privilege drop calls Resolves: RHEL-166060 [1.9.5p2-1.3] RHEL …

  • High max 8.8
    ELSA-2026-11635 1 CVE

    Important: PackageKit security update (Oracle Linux 8)

    [1.1.12-8.0.1] - removed rhel-Vendor.conf.patch [1.1.12-8] - Backport fix for CVE-2026-41651. - Resolves: #RHEL-170493

  • High max 8.2
    ELSA-2026-11510 1 CVE

    Important: vim security update (Oracle Linux 9)

    [8.2.2637-23.0.1.el9_7.3] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-23.3] - Resolves: RHEL-164965 vim: arbitrary command execution via modeline sandbox bypass [2:8.2.2637-23.2] - RHEL-155437 CVE-2026-28417 vim: Vim: Arbitrary code execution …

  • High max 8.8
    ELSA-2026-11504 1 CVE

    Important: PackageKit security update (Oracle Linux 9)

    [1.2.6-2.0.1] - remove RHEL vendor patch PackageKit-0.3.8-RHEL-Vendor.conf.patch [1.2.6-2] - Backport fix for CVE-2026-41651. - Resolves: #RHEL-170502

  • High max 7.5
    ELSA-2026-11704 2 CVEs

    Important: grafana-pcp security update (Oracle Linux 9)

    [5.1.1-14] - Resolves RHEL-166656: CVE-2026-32282 - Resolves RHEL-167661: CVE-2026-32283

  • High max 7.5
    ELSA-2026-11711 2 CVEs

    Important: grafana security update (Oracle Linux 9)

    [10.2.6-21] - Resolves RHEL-166655: CVE-2026-32282 - Resolves RHEL-167660: CVE-2026-32283

  • High max 7.5
    ELSA-2026-11712 2 CVEs

    Important: grafana security update (Oracle Linux 10)

    [10.2.6-25] - Resolves RHEL-166432: CVE-2026-32282 - Resolves RHEL-167473: CVE-2026-32283

  • High max 9.1
    ELSA-2026-11077 2 CVEs

    Important: python3 security update (Oracle Linux 8)

    [3.6.8-76.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8.openela.0] - Add openela to supported dists [3.6.8-76] - Security fixes for CVE-2026-4786, CVE-2026-6100 Resolves: RHEL-167890, RHEL-168128

  • High max 7.8
    ELSA-2026-11369 3 CVEs

    Important: xorg-x11-server-Xwayland security update (Oracle Linux 9)

    [23.2.7-6] - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001 CVE-2026-34002, CVE-2026-34003 Resolves: https://redhat.atlassian.net/browse/RHEL-163198 Resolves: https://redhat.atlassian.net/browse/RHEL-163294 Resolves: https://redhat.atlassian.net/…

  • High max 9.8
    ELSA-2026-11360 2 CVEs

    Important: LibRaw security update (Oracle Linux 9)

    [0.21.1-2] - Fix CVE-2026-21413 and CVE-2026-24450 Resolves: RHEL-165373, RHEL-165456