Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,089 results · Clear filters · Feed

  • High max 7.8
    ELSA-2026-11388 3 CVEs

    Important: xorg-x11-server security update (Oracle Linux 9)

    [1.20.11-33] - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001 CVE-2026-34002, CVE-2026-34003 Resolves: https://redhat.atlassian.net/browse/RHEL-163225 Resolves: https://redhat.atlassian.net/browse/RHEL-163307 Resolves: https://redhat.atlassian.ne…

  • High max 7.8
    ELSA-2026-11352 3 CVEs

    Important: xorg-x11-server-Xwayland security update (Oracle Linux 10)

    [24.1.5-6] - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001 CVE-2026-34002, CVE-2026-34003 Resolves: https://redhat.atlassian.net/browse/RHEL-163188 Resolves: https://redhat.atlassian.net/browse/RHEL-163284 Resolves: https://redhat.atlassian.net/…

  • High max 8.1
    ELSA-2026-10713 1 CVE

    Important: pcs security update (Oracle Linux 10)

    [0.12.1-1.el10_1.3] - Fixed CVE-2026-4800 by updating HA Cluster Management add-on to 0.1.23.2 Resolves: RHEL-164062

  • High max 8.2
    ELSA-2026-11389 1 CVE

    Important: vim security update (Oracle Linux 10)

    [9.1.083-6.0.1.el10_1.4] - Remove upstream references [Orabug: 31197557] [2:9.1.083-6.4] - Resolves: RHEL-164951 vim: arbitrary command execution via modeline sandbox bypass [2:9.1.083-6.3] - RHEL-159615 CVE-2026-33412 vim: Vim: Arbitrary code execution via c…

  • High max 7.5
    ELSA-2026-11412 1 CVE

    Important: yggdrasil-worker-package-manager security update (Oracle Linux 10)

    [0.2.3-5] - Bump release for rebuild

  • High max 7.5
    ELSA-2026-11413 1 CVE

    Important: yggdrasil security update (Oracle Linux 10)

    [0.4.8-4] - Bump release for rebuild

  • High max 7.5
    ELSA-2026-10702 18 CVEs

    Important: webkit2gtk3 security update (Oracle Linux 8)

    [2.52.3-1] - Update to 2.52.3

  • High max 7.5
    ELSA-2026-10741 1 CVE

    Important: gdk-pixbuf2 security update (Oracle Linux 8)

    * Wed Apr 22 2026 Benjamin Otte <botte@redhat.com - 2.36.12-8 - Backport fixes for CVE-2026-5201 - Related: RHEL-163056

  • High max 9.1
    ELSA-2026-10950 11 CVEs

    Important: python3.12 security update (Oracle Linux 8)

    [3.12.13-2] - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-168130, RHEL-167892 [3.12.13-1] - Update to 3.12.13 - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CV…

  • High max 9.1
    ELSA-2026-11062 2 CVEs

    Important: python3.11 security update (Oracle Linux 8)

    [3.11.13-7.0.1] - Update rpm-macros description [Orabug: 36024572] [3.11.13-7] - Security fixes for CVE-2026-4786, CVE-2026-6100 Resolves: RHEL-168129, RHEL-167891

  • High max 9.8
    ELSA-2026-10704 6 CVEs

    Important: go-toolset:ol8 security update (Oracle Linux 8)

    delve [1.25.2-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.25.2-1] - Update to Delve 1.25.2 (Sync from CentOS Stream 9) - Related: RHEL-121223 golang [1.25.9-1] - Update to Go 1.25.9 (fips-2) - Resolves: RHEL-169932 [1.25.7-2] - Upd…

  • High max 9.8
    ELSA-2026-10766 26 CVEs 1 exploited

    Important: firefox security update (Oracle Linux 8)

    [140.10.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] [140.10.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.10.0-1] - Update to 140.10.0 ESR

  • High max 8.5
    ELSA-2026-10739 4 CVEs

    Important: tigervnc security update (Oracle Linux 9)

    [1.15.0-6.1] - Fix CVE-2026-33999, CVE-2026-34000, CVE-2026-34001, CVE-2026-34002, CVE-2026-34003 xorg-x11-server: various XKB and XSYNC vulnerabilities Resolves: RHEL-163212 Resolves: RHEL-163280 Resolves: RHEL-163266 - Fix CVE-2026-34352 Resolves: RHEL-1677…

  • High max 7.5
    ELSA-2026-9683 7 CVEs

    Important: java-1.8.0-openjdk security update (Oracle Linux 8)

    [1:1.8.0.492.b09-1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:1.8.0.492.b09-1] - Update to 8u492-b09 (GA) - Update release notes for 8u492-b09. - Add missing CVEs for 8u482. - Regenerate JDK-8199936/PR3533 patch following JDK-8374917 - Regenerate …

  • High max 7.5
    ELSA-2026-10708 1 CVE

    Important: gdk-pixbuf2 security update (Oracle Linux 9)

    * Tue Apr 21 2026 Benjamin Otte <botte@redhat.com - 2.42.6-6.1 - Backport fixes for CVE-2026-5201 - Related: RHEL-163067

  • High max 9.1
    ELSA-2026-10745 2 CVEs

    Important: python3.12 security update (Oracle Linux 9)

    [3.12.12-4.0.1.el9_7.3] - Remove upstream URL reference [3.12.12-4.3] - Security fixes for CVE-2026-4786, CVE-2026-6100 Resolves: RHEL-168156, RHEL-167914 [3.12.12-4.2] - Security fix for CVE-2026-4519 Resolves: RHEL-158051 [3.12.12-4.1] - Security fixes for …

  • High max 9.1
    ELSA-2026-10774 2 CVEs

    Important: python3.11 security update (Oracle Linux 9)

    [3.11.13-5.3.0.1] - Remove upstream URL reference [Orabug: 36073032] [3.11.13-5.3] - Security fixes for CVE-2026-4786, CVE-2026-6100 Resolves: RHEL-167913, RHEL-168155

  • High max 9.1
    ELSA-2026-10949 2 CVEs

    Important: python3.9 security update (Oracle Linux 9)

    [3.9.25-3.0.1.el9_7.3] - Remove upstream URL reference [3.9.25-3.3] - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-168157, RHEL-167915 [3.9.25-3.2] - Security fix for CVE-2026-4519 Resolves: RHEL-158052 [3.9.25-3.1] - Security fixes for C…

  • High max 7.1
    ELSA-2026-1939 1 CVE

    Important: python3.12-wheel security update (Oracle Linux 9)

    [0.41.2-3.1] - Security fix for CVE-2026-24049 Resolves: RHEL-143652

  • High max 9.8
    ELSA-2026-10757 26 CVEs 1 exploited

    Important: firefox security update (Oracle Linux 9)

    [140.10.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.10.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

  • High max 7.5
    ELSA-2026-10707 1 CVE

    Important: gdk-pixbuf2 security update (Oracle Linux 10)

    [2.42.12-5] - jpeg: Reject unsupported number of components

  • High max 9.1
    ELSA-2026-10711 2 CVEs

    Important: python3.12 security update (Oracle Linux 10)

    [3.12.12-3.0.1.el10_1.3] - Remove upstream URL reference [3.12.12-3.3] - Security fixes for CVE-2026-4786, CVE-2026-6100 Resolves: RHEL-167885, RHEL-168119 [3.12.12-3.2] - Security fix for CVE-2026-4519 Resolves: RHEL-158127 [3.12.12-3.1] - Security fixes for…

  • High max 7.4
    ELSA-2026-10758 1 CVE

    Important: sudo security update (Oracle Linux 10)

    [1.9.15-10.p5] - Resolves: RHEL-164619 - CVE-2026-35535 sudo: Sudo: Privilege escalation due to failure in privilege drop calls

  • High max 7.5
    ELSA-2026-9689 8 CVEs

    Important: java-21-openjdk security update (Oracle Linux 8)

    [1:21.0.11.0.10-1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:21.0.11.0.10-1] - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump fr…

  • High max 9.8
    ELSA-2026-10767 26 CVEs 1 exploited

    Important: firefox security update (Oracle Linux 10)

    [140.10.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.10.0-1] - Update to 140.10.0 ESR

  • High max 8.1
    ELSA-2026-10710 1 CVE

    Important: pcs security update (Oracle Linux 9)

    [0.11.10-1.el9_7.3] - Fixed CVE-2026-4800 by updating pcs-web-ui to 0.1.23.2 Resolves: RHEL-164191

  • High max 8.3
    ELSA-2026-7032 1 CVE

    Important: libpng12 security update (Oracle Linux 7)

    [1.2.50-10.0.1] - Fix CVE-2026-25646: heap buffer overflow in png_set_quantize [Orabug: 39183864]

  • High max 7.5
    ELSA-2026-10135 1 CVE

    Important: buildah security update (Oracle Linux 9)

    [1.41.8-3.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.41.8-3] - rebuild for CVE-2026-34986 - Resolves: RHEL-165027

  • High max 9.8
    ELSA-2026-10219 6 CVEs

    Important: golang security update (Oracle Linux 9)

    [1.25.9-1] - Update to Go 1.25.9 (fips-2) - Resolves: RHEL-169931

  • High max 6.5
    ELSA-2026-10226 1 CVE

    Important: grafana security update (Oracle Linux 9)

    [10.2.6-20] - Resolves RHEL-161802: CVE-2026-27877

  • High max 7.5
    ELSA-2026-9686 8 CVEs

    Important: java-17-openjdk security update (Oracle Linux 8)

    [1:17.0.19.0.10-1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:17.0.19.0.10-1] - Update to jdk-17.0.19+10 (GA) - Add to .gitignore openjdk-17.0.19+10.tar.xz - Set updatever to 19 - Set buildver to 10 - Set rpmrelease to 1 - Update sources to openjdk…

  • High max 9.8
    ELSA-2026-10217 6 CVEs

    Important: golang security update (Oracle Linux 10)

    [1.25.9-3] - Do not ignore any tests in check [1.25.9-2] - Skip terminal test in container [1.25.9-1] - Update to Go 1.25.9 (fips-2)

  • High
    ELSA-2026-65027 0 CVEs

    Important: oci-utils security update (Oracle Linux 8)

    [-- 0.14.0-19] - Fix secondary vnic default metric to be a lower priority value [Orabug: 38154477]

  • High max 8.2
    ELSA-2026-9693 12 CVEs

    Important: java-25-openjdk security update (Oracle Linux 9)

    [1:25.0.3.0.9-1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:25.0.3.0.9-1] - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, …

  • High max 6.5
    ELSA-2026-10223 1 CVE

    Important: grafana security update (Oracle Linux 10)

    [10.2.6-24] - Resolves RHEL-161790: CVE-2026-27877

  • High max 7.5
    ELSA-2026-9692 18 CVEs

    Important: webkit2gtk3 security update (Oracle Linux 9)

    [2.52.3-0.1] - Update to 2.52.1

  • High max 7.5
    ELSA-2026-8312 1 CVE

    Important: bind security update (Oracle Linux 10)

    [9.18.33-10.0.2.el10_1.3] - Hard require needed openssl-libs [Orabug: 38742109] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.18.33-10.3] - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) …

  • High max 9.8
    ELSA-2026-9264 2 CVEs

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-124.52.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 9.8
    ELSA-2026-9638 5 CVEs

    Important: thunderbird security update (Oracle Linux 10)

    [140.9.1-1.0.1] - Add Oracle prefs [140.9.1-1] - Update to 140.9.1 ESR

  • High max 7.5
    ELSA-2026-8456 1 CVE

    Important: osbuild-composer security update (Oracle Linux 8)

    [101.4-5.0.1] - Support using repository definitons with OCI variables [JIRA: OLDIS-38657] - Update repositories to contain OCI variables - Remove image types Minimal-raw and wsl [JIRA: OLDIS-38123] - Increase default /boot size to 1GB [Orabug: 36827079] - su…