Oracle Linux Security Advisories (ELSA)

5,089 results · Clear filters · Feed

• High max 7.5
  ELSA-2026-8075 1 CVE

  Important: bind security update (Oracle Linux 9)

  [9.16.23-34.0.1.el9_7.2] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-34.2] - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) [32:9.16.23-34.1] - Prevent cache poisoning due to weak…

  Apr 14, 2026
• High max 7.5
  ELSA-2026-7992 1 CVE

  Important: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

  [0.9.27-5.1] - rebuilt to fix CVE-2026-25679

  Apr 14, 2026
• High max 9.2
  ELSA-2026-8119 2 CVEs

  Important: squid security update (Oracle Linux 10)

  [7:6.10-6.3] - Resolves: RHEL-160667 - squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748) [7:6.10-6.2] - Resolves: RHEL-160665 - squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)

  Apr 14, 2026
• High max 7.5
  ELSA-2026-7667 1 CVE

  Important: nghttp2 security update (Oracle Linux 8)

  [1.33.0-6.2] - fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135)

  Apr 13, 2026
• High max 8.7
  ELSA-2026-7670 17 CVEs

  Important: nodejs:24 security update (Oracle Linux 8)

  nodejs [1:24.14.1-2] - Update bundled nghttp2 to 1.68.1 Related: RHEL-151374 [1:24.14.1-1] - Update to 24.14.0 Resolves: RHEL-151374 nodejs-nodemon [3.0.3-1] - Initial import into nodejs:24 module nodejs-packaging [2021.06-6] - Properly handle @group/package …

  Apr 13, 2026
• High max 9.8
  ELSA-2026-7681 2 CVEs

  Important: perl-XML-Parser security update (Oracle Linux 8)

  [2.44-12.0.1] - Add perl(LWP), perl(URI), perl(URI::file) Requires [2.44-12] - Fix CVE-2006-10002, CVE-2006-10003

  Apr 13, 2026
• High max 7.5
  ELSA-2026-7668 1 CVE

  Important: nghttp2 security update (Oracle Linux 9)

  [1.43.0-6.1] - fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135)

  Apr 13, 2026
• High max 9.8
  ELSA-2026-7671 5 CVEs

  Important: firefox security update (Oracle Linux 9)

  [140.9.1-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.9.1] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Ab…

  Apr 13, 2026
• High max 9.8
  ELSA-2026-7679 2 CVEs

  Important: perl-XML-Parser security update (Oracle Linux 9)

  [2.46-9.1.0.1] - Add perl(LWP), perl(URI), perl(URI::file) Requires [2.46-9.1] - Fix CVE-2006-10002, CVE-2006-10003

  Apr 13, 2026
• High max 8.4
  ELSA-2026-7682 1 CVE

  Important: openexr security update (Oracle Linux 10)

  [3.1.10-8.1] - fix CVE-2026-27622

  Apr 13, 2026
• High max 9.8
  ELSA-2026-7672 5 CVEs

  Important: firefox security update (Oracle Linux 10)

  [140.9.1-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.9.1-1] - Update to 140.9.1 ESR

  Apr 13, 2026
• High max 9.8
  ELSA-2026-7680 2 CVEs

  Important: perl-XML-Parser security update (Oracle Linux 10)

  [2.47-6.1.0.1] - Add perl(LWP) Requires [2.47-6.1] - Fix CVE-2006-10002, CVE-2006-10003

  Apr 13, 2026
• High max 5.6
  ELSA-2026-7711 3 CVEs

  Important: vim security update (Oracle Linux 10)

  [9.1.083-6.0.1.el10_1.3] - Remove upstream references [Orabug: 31197557] [2:9.1.083-6.3] - RHEL-159615 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function [2:9.1.083-6.2] - RHEL-155409 CVE-2026-28421 vim: Vim: Denial of …

  Apr 13, 2026
• High max 7.5
  ELSA-2026-7666 1 CVE

  Important: nghttp2 security update (Oracle Linux 10)

  [1.64.0-2.1] - fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135)

  Apr 12, 2026
• High max 8.2
  ELSA-2026-7343 4 CVEs

  Important: nginx:1.26 security update (Oracle Linux 9)

  [2:1.26.3-2.0.1.1] - Require oracle-indexhtml [2:1.26.3-6] - Resolves: RHEL-157887 - CVE-2026-32647 nginx:1.26/nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files [2:1.26.3-5] - Resolves: RHEL-159446 - CVE-2026-27651 nginx:1.26/n…

  Apr 11, 2026
• High max 9.2
  ELSA-2026-7302 9 CVEs

  Important: nodejs:22 security update (Oracle Linux 9)

  nodejs [1:22.22.2-1] - Update to version 22.22.2 - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135 - disabled failing tests in nghttp2 due to newer version - patch for npm/braces CVE-2026-25547 Resolves: RHEL-163369 Fixes: CVE-2026-1528 …

  Apr 10, 2026
• High max 9.2
  ELSA-2026-7350 18 CVEs

  Important: nodejs:24 security update (Oracle Linux 9)

  nodejs [1:24.14.1-2] - Update bundled nghttp2 to 1.68.1 [1:24.14.1-1] - Update to version 24.14.1 nodejs-nodemon [3.0.3-3] - Keep BR on just npm [3.0.3-2] - Fix BR for nodejs-npm nodejs-packaging [2021.06-6] - Properly handle @group/package deps in nodejs-sym…

  Apr 10, 2026
• High max 7.5
  ELSA-2026-7342 1 CVE

  Important: kea security update (Oracle Linux 10)

  [3.0.1-3] - Fixes CVE-2026-3608

  Apr 10, 2026
• High max 7.5
  ELSA-2026-7011 1 CVE

  Important: grafana security update (Oracle Linux 8)

  [9.2.10-29.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-29] - Resolves RHEL-156639: CVE-2026-25679

  Apr 9, 2026
• High max 9.2
  ELSA-2026-7123 9 CVEs

  Important: nodejs:22 security update (Oracle Linux 8)

  nodejs [1:22.22.2-1] - Update to version 22.22.2 Resolves: RHEL-154019 Fixes: CVE-2026-1528 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-27135 CVE-2026-1528 nodejs-nodemon [3.0.1-1] - Exclude ix86 arches from building. Related: RHEL-35991 [3.0.1-1] -…

  Apr 9, 2026
• High max 7.5
  ELSA-2026-7259 1 CVE

  Important: git-lfs security update (Oracle Linux 9)

  [3.6.1-8] - Rebuild with new Golang - Resolves: RHEL-158724

  Apr 9, 2026
• High max 5.6
  ELSA-2026-6915 3 CVEs

  Important: vim security update (Oracle Linux 8)

  [8.0.1763-22.0.1.el8_10.1] - Remove upstream references [Orabug: 31197557] - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984] [2:8.0.1763-22.1] - RHEL-159620 CVE-2026-33412 vim: Vim: Arbitrary code execution via command inje…

  Apr 8, 2026
• High max 7.5
  ELSA-2026-7009 1 CVE

  Important: grafana-pcp security update (Oracle Linux 8)

  [5.1.1-13] - Resolves RHEL-156641: CVE-2026-25679

  Apr 8, 2026
• High max 8.2
  ELSA-2026-6907 4 CVEs

  Important: nginx:1.24 security update (Oracle Linux 8)

  [1.24.0-3.0.1] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-3] - Resolves: RHEL-157877 CVE-2026-32647 nginx:1.24/nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files - Resolves: RHEL-159436 CVE-2026-27651 nginx:1.24/ng…

  Apr 8, 2026
• High max 7.8
  ELSA-2026-6949 2 CVEs

  Important: go-toolset:ol8 security update (Oracle Linux 8)

  delve [1.25.2-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.25.2-1] - Update to Delve 1.25.2 (Sync from CentOS Stream 9) - Related: RHEL-121223 golang [1.25.7-2] - Update to Go 1.25.8 (fips-1) - Resolves: RHEL-156551 [1.25.7-1] - Upd…

  Apr 8, 2026
• High max 8.2
  ELSA-2026-6923 4 CVEs

  Important: nginx:1.24 security update (Oracle Linux 9)

  [1.24.0-5.2.0.1] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-5.2] - Resolves: RHEL-157886 CVE-2026-32647 nginx:1.24/nginx: NGINX: Denial of Service or Code Execution via specially cr…

  Apr 8, 2026
• High max 8.2
  ELSA-2026-7002 4 CVEs

  Important: nginx security update (Oracle Linux 9)

  [1.20.1-24.0.1.el9_7.2] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] - Update upstream references [Orabug: 36579090] [2:1.20.1-24.2] - Resolves: RHEL-159557 - CVE-2026-27654 nginx: NGINX: Denia…

  Apr 8, 2026
• High max 7.5
  ELSA-2026-7005 1 CVE

  Important: git-lfs security update (Oracle Linux 10)

  [3.6.1-8] - Rebuild with new Golang

  Apr 8, 2026
• High max 4.8
  ELSA-2026-6817 2 CVEs

  Important: capstone security update (Oracle Linux 10)

  [5.0.1-7] - Fix CVE-2025-67873 (heap buffer overflow) Resolves: RHEL-141551 - Fix CVE-2025-68114 (memory corruption) Resolves: RHEL-137747

  Apr 8, 2026
• High max 9.2
  ELSA-2026-7080 9 CVEs

  Important: nodejs22 security update (Oracle Linux 10)

  [1:22.22.2-1] - Update to version 22.22.2 - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135 - disabled failing tests in nghttp2 due to newer version - patch for npm/braces CVE-2026-25547 [1:22.22.0-4] - sources: changed ICU version syntax

  Apr 8, 2026
• High max 8.8
  ELSA-2026-5320 1 CVE

  Important: libvpx security update (Oracle Linux 7)

  [1.3.0-8.0.3] - Fixes heap buffer overflow in libvpx CVE-2026-2447 [Orabug: 39112729] [1.3.0-8.0.1] - Fixes CVE-2025-5283 vpx_codec_enc_init_multi fix double free on init fail [Orabug: 38103810]

  Apr 7, 2026
• High max 8.6
  ELSA-2026-5573 2 CVEs

  Important: ImageMagick security update (Oracle Linux 7)

  [6.9.10.68-7.0.7] - Fixes Local File Disclosure via Path Traversal (CVE-2026-25965) [Orabug: 39118995] - Fixes Memory allocation with excessive without limits in the internal SVG decoder (CVE-2026-25985) [6.9.10.68-7.0.5] - Fix CVE-2025-62171 and CVE-2026-238…

  Apr 7, 2026
• High max 8.8
  ELSA-2026-6750 6 CVEs

  Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good security update (Oracle Linux 8)

  gstreamer1-plugins-bad-free [1.16.1-6.0.1] - Update origin URL [Orabug: 36209826] [1.16.1-6] - Add patch for CVE-2026-3082 Resolves: RHEL-156202 gstreamer1-plugins-base [1.16.1-6.0.1] - Update origin URL [Orabug: 36209826] [1.16.1-6] - Add patch for CVE-2026-…

  Apr 7, 2026
• High max 10.0
  ELSA-2026-6917 39 CVEs

  Important: thunderbird security update (Oracle Linux 8)

  [140.9.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.9.0] - Add OpenELA debranding [140.9.0-1] - Update to 140.9.0 ESR

  Apr 7, 2026
• High max 9.3
  ELSA-2026-6918 13 CVEs

  Important: freerdp security update (Oracle Linux 8)

  [2:2.11.7-6] - Fix use of nsc_process_message Resolves: RHEL-155984 [2:2.11.7-5] - Backport several CVE fixes Resolves: RHEL-147954, RHEL-147955, RHEL-147970, RHEL-147977, RHEL-147980 Resolves: RHEL-148002, RHEL-148014, RHEL-148031, RHEL-148906, RHEL-148996 R…

  Apr 7, 2026
• High max 7.0
  ELSA-2026-6766 1 CVE

  Important: python3.9 security update (Oracle Linux 9)

  [3.9.25-3.0.1.el9_7.2] - Remove upstream URL reference [3.9.25-3.2] - Security fix for CVE-2026-4519 Resolves: RHEL-158052 [3.9.25-3.1] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143108 RHEL-143169 RHEL…

  Apr 7, 2026
• High max 9.3
  ELSA-2026-6799 14 CVEs

  Important: freerdp security update (Oracle Linux 10)

  [2:3.10.3-5.5] - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155979 [2:3.10.3-5.4] - Backport several CVE fixes Resolves: RHEL-147948, RHEL-147949, RHEL-147956, RHEL-147963, RHEL-147964 Resolves: RHEL-147972, RHEL-14…

  Apr 7, 2026
• High max 8.2
  ELSA-2026-6906 4 CVEs

  Important: nginx security update (Oracle Linux 10)

  [2:1.26.3-2.0.1.1] - Reference oracle-indexhtml within Requires [Orabug: 33802044] [2:1.26.3-6] - Resolves: RHEL-157874 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files [2:1.26.3-5] - Resolves: RHEL-159433 CVE-2…

  Apr 7, 2026
• High max 8.8
  ELSA-2026-6631 1 CVE

  Important: fontforge security update (Oracle Linux 10)

  [20230101-15] - Resolves: RHEL-138129 CVE-2025-15270 SFD File Parsing Remote Code Execution Vulnerability

  Apr 7, 2026
• High max 8.8
  ELSA-2026-6628 1 CVE

  Important: fontforge security update (Oracle Linux 9)

  [20201107-8] - Resolves: RHEL-138245 CVE-2025-15270 SFD File Parsing Remote Code Execution Vulnerability

  Apr 6, 2026