Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,089 results · Clear filters · Feed

High max 9.8

ELSA-2026-9345 5 CVEs

Important: thunderbird security update (Oracle Linux 8)

[140.9.1-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.9.1] - Add OpenELA debranding [140.9.1-1] - Update to 140.9.1 ESR

Apr 21, 2026
High max 9.8

ELSA-2026-9131 2 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.120.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Apr 21, 2026
High max 7.5

ELSA-2026-9044 1 CVE

Important: osbuild-composer security update (Oracle Linux 9)

[149-5.0.1] - Add missing dependency over dracut-config-rescue for image-installer [ORABUG: 38587453] - Switch to UEKR8 repositories for OL9.6 [Orabug: 37962207] - Add support to create OpenScap images [JIRA: OLDIS-35301] - Simplify repository names [JIRA: OL…

Apr 21, 2026
High max 8.1

ELSA-2026-6713 2 CVEs

Important: ImageMagick security update (Oracle Linux 7)

[6.9.10.68-7.0.9] - Fix CVE-2026-28691 and CVE-2026-28693 [Orabug: 39174244] [6.9.10.68-7.0.7] - Fixes Local File Disclosure via Path Traversal (CVE-2026-25965) [Orabug: 39118995] - Fixes Memory allocation with excessive without limits in the internal SVG dec…

Apr 20, 2026
High max 7.5

ELSA-2026-8468 4 CVEs

Important: .NET 8.0 security update (Oracle Linux 8)

[8.0.126-1.0.1] - Add support for Oracle Linux [8.0.126-1] - Update to .NET SDK 8.0.126 and Runtime 8.0.26 - Resolves: RHEL-163413

Apr 20, 2026
High max 7.5

ELSA-2026-8945 2 CVEs

Important: freerdp security update (Oracle Linux 8)

[2:2.11.7-7] - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162949, RHEL-162965

Apr 20, 2026
High max 5.1

ELSA-2026-8861 1 CVE

Important: giflib security update (Oracle Linux 8)

[5.1.4-4] - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154853)

Apr 20, 2026
High max 8.4

ELSA-2026-8863 1 CVE

Important: OpenEXR security update (Oracle Linux 8)

[2.2.0-12.1] - fix CVE-2026-27622

Apr 20, 2026
High max 8.4

ELSA-2026-8888 1 CVE

Important: openexr security update (Oracle Linux 9)

[3.1.1-3.1] - fix CVE-2026-27622

Apr 20, 2026
High max 7.5

ELSA-2026-8469 4 CVEs

Important: .NET 8.0 security update (Oracle Linux 9)

[8.0.126-1.0.1] - Add support for Oracle Linux [8.0.126-1] - Update to .NET SDK 8.0.126 and Runtime 8.0.26 - Resolves: RHEL-163416

Apr 20, 2026
High max 5.1

ELSA-2026-8859 1 CVE

Important: giflib security update (Oracle Linux 9)

[5.2.1-9.1] - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154863)

Apr 20, 2026
High max 9.8

ELSA-2026-8921 2 CVEs

Important: kernel security update (Oracle Linux 9)

[5.14.0-611.49.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Apr 20, 2026
High max 7.5

ELSA-2026-8842 2 CVEs

Important: delve security update (Oracle Linux 10)

[1.25.2-3.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.25.2-3] - Rebuild with latest Go

Apr 20, 2026
High max 7.5

ELSA-2026-8841 1 CVE

Important: go-rpm-macros security update (Oracle Linux 9)

[3.6.0-14] - Rebuild with latest Go - Resolves: RHEL-158726

Apr 19, 2026
High max 7.5

ELSA-2026-8840 1 CVE

Important: go-rpm-macros security update (Oracle Linux 10)

[3.6.0-8] - Rebuild with latest Go

Apr 19, 2026
High max 5.1

ELSA-2026-8858 1 CVE

Important: giflib security update (Oracle Linux 10)

[5.2.1-22.1] - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154849)

Apr 19, 2026
High max 8.7

ELSA-2026-8339 4 CVEs

Important: nodejs:20 security update (Oracle Linux 8)

nodejs [1:20.20.2-1] - Update to version 20.20.2 - Patch nghttp2 to version 1.68.1 and disable tests which would fail due to this change. Resolves: RHEL-154018 Fixes: CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547 CVE-2026-21710 nodejs-nodemon [3…

Apr 17, 2026
High max 9.2

ELSA-2026-8317 2 CVEs

Important: squid:4 security update (Oracle Linux 8)

libecap [1.0.1-2] - Resolves: #1695587 - Ensure modular RPM upgrade path [1.0.1-1] - new version 1.0.1 - autoconf.h moved from lookaside to dist-git [1.0.0-7] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild [1.0.0-6] - Rebuilt for…

Apr 16, 2026
High max 7.5

ELSA-2026-8473 4 CVEs

Important: .NET 10.0 security update (Oracle Linux 8)

[10.0.106-1.0.1] - Add support for Oracle Linux [10.0.106-1] - Update to .NET SDK 10.0.106 and Runtime 10.0.6 - Resolves: RHEL-163381

Apr 16, 2026
High max 7.5

ELSA-2026-8475 4 CVEs

Important: .NET 9.0 security update (Oracle Linux 8)

[9.0.116-1.0.1] - Add support for Oracle Linux [9.0.116-1] - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163389

Apr 16, 2026
High max 7.5

ELSA-2026-8534 2 CVEs

Important: libarchive security update (Oracle Linux 8)

[3.3.3-7] - Resolves: CVE-2026-4424 - Resolves: CVE-2026-5121

Apr 16, 2026
High max 7.5

ELSA-2026-8457 2 CVEs

Important: freerdp security update (Oracle Linux 9)

[2:2.11.7-1.6] - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162958, RHEL-162978

Apr 16, 2026
High max 9.8

ELSA-2026-8459 5 CVEs

Important: thunderbird security update (Oracle Linux 9)

[140.9.1-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.9.1] - Add OpenELA debranding [140.9.1-1] - Update to 140.9.1 ESR

Apr 16, 2026
High max 7.5

ELSA-2026-8471 4 CVEs

Important: .NET 10.0 security update (Oracle Linux 9)

[10.0.106-1.0.1] - Add support for Oracle Linux [10.0.106-1] - Update to .NET SDK 10.0.106 and Runtime 10.0.6 - Resolves: RHEL-163384

Apr 16, 2026
High max 7.5

ELSA-2026-8474 4 CVEs

Important: .NET 9.0 security update (Oracle Linux 9)

[9.0.116-1.0.1] - Add support for Oracle Linux [9.0.116-1] - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163394

Apr 16, 2026
High max 7.5

ELSA-2026-8510 2 CVEs

Important: libarchive security update (Oracle Linux 9)

[3.5.3-9] - Resolves: CVE-2026-4424 - Resolves: CVE-2026-5121 [3.5.3-8] - Release bump

Apr 16, 2026
High max 7.5

ELSA-2026-8492 1 CVE

Important: libarchive security update (Oracle Linux 10)

[3.7.7-8] - Resolves: CVE-2026-4424 [3.7.7-7] - Release bump for typo in dist [3.7.7-6] - Release bump

Apr 16, 2026
High max 7.5

ELSA-2026-8458 2 CVEs

Important: freerdp security update (Oracle Linux 10)

[2:3.10.3-5.6] - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162946, RHEL-162962

Apr 16, 2026
High max 7.5

ELSA-2026-8467 4 CVEs

Important: .NET 10.0 security update (Oracle Linux 10)

[10.0.106-1.0.1] - Add support for Oracle Linux [10.0.106-1] - Update to .NET SDK 10.0.106 and Runtime 10.0.6 - Resolves: RHEL-163385

Apr 16, 2026
High max 7.5

ELSA-2026-8470 4 CVEs

Important: .NET 8.0 security update (Oracle Linux 10)

[8.0.126-1.0.1] - Add support for Oracle Linux [8.0.126-1] - Update to .NET SDK 8.0.126 and Runtime 8.0.26 - Resolves: RHEL-163417

Apr 16, 2026
High max 7.5

ELSA-2026-8472 4 CVEs

Important: .NET 9.0 security update (Oracle Linux 10)

[9.0.116-1.0.1] - Add support for Oracle Linux [9.0.116-1] - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163396

Apr 16, 2026
High max 7.5

ELSA-2026-8352 1 CVE

Important: bind security update (Oracle Linux 8)

[32:9.11.36-16.7] - Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)

Apr 15, 2026
High max 7.8

ELSA-2026-50234 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.354.4.1] - Revert 'rds: Drop rds conn in connect worker if not in down state.' (Alok Tiwari) [Orabug: 39200399] [5.4.17-2136.354.4] - macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887731] {CVE-2026-23001} - macvl…

Apr 15, 2026
High max 5.6

ELSA-2026-8259 3 CVEs

Important: vim security update (Oracle Linux 9)

[8.2.2637-23.0.1.el9_7.2] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-23.2] - RHEL-155437 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin - RHEL-155422 CVE-2026-28421 vim: Vim: Denial of service a…

Apr 15, 2026
High max 9.8

ELSA-2026-50232 108 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-201.74.2.1] - Revert 'rds: Drop rds conn in connect worker if not in down state.' (Vijayendra Suman) [Orabug: 39200413] - io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe) [Orabug: 39202438] - ipv6: use RCU in ip6_xmit…

Apr 15, 2026
High max 8.8

ELSA-2026-7677 4 CVEs

Important: fontforge security update (Oracle Linux 8)

[20200314-7] - Resolves: RHEL-138168 CVE-2025-15270 SFD File Parsing Remote Code Execution Vulnerability - Resolves: RHEL-138174 CVE-2025-15279 GUtils BMP File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138190 CVE-2025-15275 SFD File Parsing Heap-bas…

Apr 14, 2026
High max 9.8

ELSA-2026-8052 5 CVEs

Important: firefox security update (Oracle Linux 8)

[140.9.1-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] [140.9.1] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.9.1-1] - Update to 140.9.1 ESR

Apr 14, 2026
High max 7.5

ELSA-2026-8155 1 CVE

Important: bind9.16 security update (Oracle Linux 8)

[32:9.16.23-0.22.5] - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)

Apr 14, 2026
High max 8.7

ELSA-2026-7896 4 CVEs

Important: nodejs:20 security update (Oracle Linux 9)

nodejs [1:20.20.2-1] - Update to version 20.20.2 Patch nghttp2 to version 1.68.1 and disable tests which would fail due to this change. Resolves: RHEL-164336 Fixes: CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547 CVE-2026-21710 nodejs-nodemon [3.0…

Apr 14, 2026
High max 7.5

ELSA-2026-7915 1 CVE

Important: bind9.18 security update (Oracle Linux 9)

[32:9.18.29-5.4] - Correct backport issue in the patch (CVE-2026-1519) [32:9.18.29-5.3] - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)

Apr 14, 2026