Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,082 results · Clear filters · Feed

  • High max 8.9
    ELSA-2026-91267 1 CVE

    Important: libXrender security update (Oracle Linux 8)

    [0.9.10-8] - CVE-2026-88807 libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats in RenderQueryPictFormats

  • High max 7.1
    ELSA-2026-91294 1 CVE

    Important: libXtst security update (Oracle Linux 8)

    [1.2.3-8] - CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser in RECORD reply parser

  • High max 8.5
    ELSA-2026-88164 4 CVEs

    Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update (Oracle Linux 8)

    flute [1.3.0-19.OOo31] - OpenJDK 8 won't be supported anymore on RHEL 8 starting from November 2026, move to OpenJDK 21 - Resolves: RHEL-275416 libbase [1.1.3-21] - Remove commons logging dependency - Related: RHEL-286491 [1.1.3-20] - OpenJDK 8 won't be suppo…

  • High max 7.5
    ELSA-2026-89760 2 CVEs

    Important: container-tools:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

    aardvark-dns [2:1.10.1-2] - build off the RHEL maintenance branch - Resolves: RHEL-59129 buildah [2:1.33.15-2] - Rebuild for CVE-2026-78667 and CVE-2026-111943 - Resolves: RHEL-278949 RHEL-287628 RHEL-272014 [2:1.33.15-1] - fix Version to match the upstream r…

  • High max 7.5
    ELSA-2026-90362 3 CVEs

    Important: podman security update (Oracle Linux 9)

    [5.8.2-8.0.1] - Rework CNI/Netavark detection logic [JIRA: EVG-3769] - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.8.2-8] - Rebuild for CVE-2026-7…

  • High max 7.5
    ELSA-2026-90424 4 CVEs

    Important: buildah security update (Oracle Linux 9)

    [1.43.4-2.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.43.4-2] - Rebuild for CVE-2026-78667 and CVE-2026-111943 - Resolves: RHEL-279009 - Resolves: RHEL-287507 [2:1.43.4-1] - Update to buildah 1.43.4 (c7061d00) - …

  • High max 9.8
    ELSA-2026-90365 15 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.61.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 9.2
    ELSA-2026-90449 1 CVE 1 exploited

    Important: brotli security update (Oracle Linux 10)

    [1.1.0-8.0.1] - Fix out-of-bounds write in the Brotli decoder [CVE-2026-111497]

  • High max 7.5
    ELSA-2026-90887 1 CVE

    Important: emacs security update (Oracle Linux 10)

    [1:29.4-17] - Fix arbitrary code execution upon opening file (CVE-2026-96269) [1:29.4-16] - Generalize trusted-content-p check to all Flymake backends (CVE-2026-96442) [1:29.4-15] - tramp: restrict user name to prevent shell injection (CVE-2026-79992)

  • High max 7.5
    ELSA-2026-91366 1 CVE

    Important: libX11 security update (Oracle Linux 10)

    [1.8.10-1.1] - CVE-2026-88806 libX11: libX11: Heap-based buffer overflow via malicious X server X server Resolves: https://issues.redhat.com/browse/RHEL-267123

  • High max 2.9
    ELSA-2026-90895 1 CVE

    Important: thunderbird security, bug fix, and enhancement update (Oracle Linux 10)

    [153.5.0-1.0.1] - Add Oracle prefs [153.5.0-1] - Update to 153.5.0 ESR [140.14.0-2] - Update to 140.14.0 ESR [140.13.0-1] - Update to 140.13.0 ESR [140.12.0-1] - Update to 140.12.0 ESR [140.11.0-1] - Update to 140.11.0 ESR [140.10.1-1] - Update to 140.10.1 ES…

  • High max 8.9
    ELSA-2026-91003 1 CVE

    Important: libXrender security update (Oracle Linux 10)

    [0.9.11-8.1] - CVE-2026-88807 libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats overflow in RenderQueryPictFormats Resolves: RHEL-267112

  • High max 3.7
    ELSA-2026-57174 1 CVE

    Important: postfix security update (Oracle Linux 7)

    [2:2.10.1-9.0.1] - Fix CVE-2026-43964 buffer over-read [Orabug: 39905988] - Allow build on Linux 5.x kernels [Orabug: 39905988]

  • High max 7.5
    ELSA-2026-89730 1 CVE

    Important: libX11 security update (Oracle Linux 8)

    [1.6.8-10] - CVE-2026-88806 libX11: libX11: Heap-based buffer overflow via malicious X server Resolves: https://issues.redhat.com/browse/RHEL-267125

  • High max 9.2
    ELSA-2026-500512 1 CVE 1 exploited

    Important: brotli security update (Oracle Linux 8)

    [1.0.6-4.0.1] - Fix CVE-2026-111497: reject invalid Brotli block switches

  • High max 8.5
    ELSA-2026-89747 8 CVEs

    Important: xorg-x11-server security update (Oracle Linux 8)

    [1.20.11-28.5] - CVE fix for: CVE-2026-88812, CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93523 Resolves: https://redhat.atlassian.net/browse/RHEL-278163 Resolves: https://redhat.atlassian.net/brows…

  • High max 9.6
    ELSA-2026-89756 41 CVEs

    Important: firefox security, bug fix, and enhancement update (Oracle Linux 8)

    [153.5.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [153.5.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [153.5.0-1] - Upd…

  • High max 9.2
    ELSA-2026-500520 1 CVE 1 exploited

    Important: nodejs:24 security update (Oracle Linux 8)

    nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

  • High max 9.2
    ELSA-2026-500519 1 CVE 1 exploited

    Important: nodejs:22 security update (Oracle Linux 8)

    nodejs [1:22.23.2-2.0.1] - Backport upstream fix for CVE-2026-111497 in the bundled Brotli decoder - Expose the block-switch error and add malformed-stream regression coverage - Require the fixed Oracle Linux 8 system Brotli build nodejs-nodemon nodejs-packag…

  • High max 7.1
    ELSA-2026-89859 2 CVEs

    Important: flatpak security update (Oracle Linux 8)

    [1.12.9-9] - Use fd-relative operations for files/etc during runtime deploy (CVE-2026-97024) Resolves: RHEL-272181 [1.12.9-8] - Avoid path traversal deletion via deploy export/bin (CVE-2026-97023) Resolves: RHEL-272023

  • High max 9.8
    ELSA-2026-89083 13 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-553.178.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 7.5
    ELSA-2026-89755 2 CVEs

    Important: lrzsz security, bug fix, and enhancement update (Oracle Linux 9)

    [0.12.20-58] - Fix long-standing SIGSEGV bug when using the -s parameter without an argument (RHEL-282108) [0.12.20-57] - Backport tightened path handling from 0.13.1 (CVE-2026-105840) [0.12.20-56] - Remove 'Topipe' feature. (CVE-2026-105841)

  • High max 9.2
    ELSA-2026-89742 3 CVEs

    Important: python3.9 security update (Oracle Linux 9)

    [3.9.25-7.0.1.el9_8.6] - Remove upstream URL reference [3.9.25-7.6] - CVE-2026-19553 python3.9: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() Resolves: RHEL-274143 [3.9.25-7.5] - CVE-2026-19445 python3…

  • High max 7.5
    ELSA-2026-89748 3 CVEs

    Important: libreswan security update (Oracle Linux 9)

    [4.15-11.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.15-11] - Backport fixes for CVE-2026-94453, CVE-2026-77206, and CVE-2026-77207 (RHEL-281889, RHEL-281998, RHEL-281985)

  • High max 9.2
    ELSA-2026-500513 1 CVE 1 exploited

    Important: brotli security update (Oracle Linux 9)

    [1.0.9-10.0.1] - Fix out-of-bounds write in the Brotli decoder [CVE-2026-111497]

  • High max 9.6
    ELSA-2026-89757 48 CVEs

    Important: firefox security, bug fix, and enhancement update (Oracle Linux 9)

    [153.5.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [153.5.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Ab…

  • High max 9.2
    ELSA-2026-500517 1 CVE 1 exploited

    Important: nodejs:22 security update (Oracle Linux 9)

    nodejs [1:22.23.2-2.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

  • High max 9.2
    ELSA-2026-500518 1 CVE 1 exploited

    Important: nodejs:24 security update (Oracle Linux 9)

    nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

  • High max 7.1
    ELSA-2026-89850 2 CVEs

    Important: flatpak security update (Oracle Linux 9)

    [1.12.9-4.6] - Use fd-relative operations for files/etc during runtime deploy (CVE-2026-97024) Resolves: RHEL-272190 [1.12.9-4.5] - Avoid path traversal deletion via deploy export/bin (CVE-2026-97023) Resolves: RHEL-272030

  • High max 7.5
    ELSA-2026-90462 3 CVEs

    Important: skopeo security update (Oracle Linux 9)

    [1:1.22.2-9] - Rebuild for CVE-2026-78667 and CVE-2026-111943 - Resolves: RHEL-279016 - Resolves: RHEL-287514

  • High max 8.9
    ELSA-2026-90494 2 CVEs

    Important: python-urllib3 security update (Oracle Linux 9)

    [1.26.5-8.2] - CVE-2026-97687 python-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override Resolves: RHEL-282326 [1.26.5-8.1] - CVE-2026-97689 python-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk pars…

  • High max 8.8
    ELSA-2026-90522 1 CVE

    Important: xdg-dbus-proxy security update (Oracle Linux 9)

    [0.1.3-1.1] - Message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422) Resolves: RHEL-271548

  • High max 9.2
    ELSA-2026-500514 1 CVE 1 exploited

    Important: brotli security update (Oracle Linux 10)

    [1.1.0-8.0.1] - Fix out-of-bounds write in the Brotli decoder [CVE-2026-111497]

  • High max 7.5
    ELSA-2026-89761 3 CVEs

    Important: skopeo security update (Oracle Linux 10)

    [2:1.22.2-6] - Rebuild for CVE-2026-111943 - Resolves: RHEL-287480

  • High max 7.5
    ELSA-2026-89732 2 CVEs

    Important: grafana security update (Oracle Linux 10)

    [10.2.6-28.9] - Rebuild against updated golang - Resolves RHEL-290737 [10.2.6-28.9] - CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting in Unified Alerting - Resolves RHEL-290765 [10.2.6-28.8] - Rebuild against updated …

  • High max 7.1
    ELSA-2026-89849 2 CVEs

    Important: flatpak security update (Oracle Linux 10)

    [1.16.0-9.6] - Use fd-relative operations for files/etc during runtime deploy (CVE-2026-97024) Resolves: RHEL-272185 [1.16.0-9.5] - Avoid path traversal deletion via deploy export/bin (CVE-2026-97023) Resolves: RHEL-272031

  • High max 9.2
    ELSA-2026-500515 1 CVE 1 exploited

    Important: nodejs24 security update (Oracle Linux 10)

    [24.21.0-1.0.2] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Require fixed OL10 system Brotli for builds without bundled Brotli

  • High max 9.2
    ELSA-2026-500516 1 CVE 1 exploited

    Important: nodejs22 security update (Oracle Linux 10)

    [1:22.23.2-3.0.2] - Backport upstream fix for CVE-2026-111497 in the bundled Brotli decoder - Expose the block-switch error and add malformed-stream regression coverage - Require the fixed Oracle Linux 10 system Brotli build

  • High max 7.5
    ELSA-2026-89923 3 CVEs

    Important: libreswan security update (Oracle Linux 10)

    [5.3.3-1.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [5.3.3-1] - update to 5.3.3 to fix CVE-2026-94453, CVE-2026-77207, CVE-2026-77205, and CVE-2026-77206

  • High max 7.5
    ELSA-2026-89752 3 CVEs

    Important: oci-seccomp-bpf-hook security update (Oracle Linux 10)

    [1.2.11-3] - Rebuild for CVE-2026-111943 - Resolves: RHEL-287608 [1.2.11-2] - rebuild with golang to fix CVE-2026-33811 - Resolves: RHEL-187133