Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,089 results · Clear filters · Feed

High max 8.8

ELSA-2026-2230 3 CVEs

Important: fontforge security update (Oracle Linux 10)

[20230101-14] - Resolves: RHEL-138159 CVE-2025-15279 GUtils BMP File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138144 CVE-2025-15275 SFD File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138126 CVE-2025-15269 SFD File Parsing Use-After-Free

Feb 9, 2026
High max 9.8

ELSA-2026-2271 13 CVEs

Important: firefox security update (Oracle Linux 10)

[140.7.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.7.0-1] - Update to 140.7.0 ESR

Feb 9, 2026
High max 9.8

ELSA-2026-2286 13 CVEs

Important: thunderbird security update (Oracle Linux 10)

[140.7.0-1.0.1] - Add Oracle prefs [140.7.0-1] - Update to 140.7.0 ESR

Feb 9, 2026
High max 7.7

ELSA-2026-2222 7 CVEs

Important: freerdp security update (Oracle Linux 10)

[2:3.10.3-5.1] - Backport several CVE fixes Resolves: RHEL-142413, RHEL-142397, RHEL-142381, RHEL-142365, RHEL-142349 Resolves: RHEL-142333, RHEL-142317

Feb 8, 2026
High max 9.8

ELSA-2026-50100 30 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.352.5] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38879907] {CVE-2025-40022} [5.4.17-2136.352.4] - arm64: pensando: Must boot Ortano kernel with spin-table (Rob Gardner) [Orabug: 38821197] [5.4.17-2136.3…

Feb 7, 2026
High max 7.5

ELSA-2026-2124 1 CVE

Important: osbuild-composer security update (Oracle Linux 8)

[101.4-3.0.1] - Support using repository definitons with OCI variables [JIRA: OLDIS-38657] - Update repositories to contain OCI variables - Remove image types Minimal-raw and wsl [JIRA: OLDIS-38123] - Increase default /boot size to 1GB [Orabug: 36827079] - su…

Feb 6, 2026
High max 9.8

ELSA-2026-50095 5 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-316.196.4.2] - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca) - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon) - ext4: clear i_state_flags when alloc in…

Feb 6, 2026
High max 9.8

ELSA-2026-50094 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-107.59.3.4] - mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38932996] {CVE-2025-40257} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38932973] {CVE-2025-40149} - mptcp: fix r…

Feb 6, 2026
High max 7.7

ELSA-2026-2081 7 CVEs

Important: freerdp security update (Oracle Linux 8)

[2:2.11.7-2] - Backport several CVE fixes Resolves: RHEL-142417, RHEL-142401, RHEL-142385, RHEL-142369, RHEL-142353 Resolves: RHEL-142337, RHEL-142321

Feb 5, 2026
High max 7.1

ELSA-2026-2090 1 CVE

Important: python3.12-wheel security update (Oracle Linux 8)

[0.41.2-4] - Security fix for CVE-2026-24049 Resolves: RHEL-143636

Feb 5, 2026
High max 7.5

ELSA-2026-2042 1 CVE

Important: brotli security update (Oracle Linux 9)

[1.0.9-9] - Resolves: RHEL-133995 Rebuild for CVE-2025-6176 Brotli decompression bomb DoS in scrapy [1.0.9-8] - Resolves: RHEL-133995 CVE-2025-6176 Brotli decompression bomb DoS in scrapy

Feb 5, 2026
High max 7.7

ELSA-2026-2048 7 CVEs

Important: freerdp security update (Oracle Linux 9)

[2:2.11.7-1.1] - Backport several CVE fixes Resolves: RHEL-142426, RHEL-142410, RHEL-142394, RHEL-142378, RHEL-142362, Resolves: RHEL-142346, RHEL-142330

Feb 5, 2026
High max 8.8

ELSA-2026-2039 3 CVEs

Important: fontforge security update (Oracle Linux 9)

[20201107-7] - Resolves: RHEL-138206 CVE-2025-15279 GUtils BMP File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138228 CVE-2025-15275 SFD File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138158 CVE-2025-15269 SFD File Parsing Use-After-Free

Feb 5, 2026
High max 7.1

ELSA-2026-1902 1 CVE

Important: python-wheel security update (Oracle Linux 10)

[1:0.41.2-5.1] - Security fix for CVE-2026-24049 Resolves: RHEL-143630

Feb 5, 2026
High max 7.5

ELSA-2026-1905 1 CVE

Important: fence-agents security update (Oracle Linux 10)

[4.16.0-13.2] - bundled pyasn1: fix CVE-2026-23490 Resolves: RHEL-142444

Feb 5, 2026
High max 8.6

ELSA-2026-2182 2 CVEs

Important: libsoup3 security update (Oracle Linux 10)

[3.6.5-9] - Fix CVE-2026-0719 [3.6.5-8] - Fix CVE-2025-14523 [3.6.5-7] - Add patch for CVE-2025-12105 [3.6.5-6] - Fix integer overflow in date/time parsing [3.6.5-5] - Bump revision number [3.6.5-4] - Fix several CVEs

Feb 5, 2026
High max 7.5

ELSA-2026-1904 1 CVE

Important: resource-agents security update (Oracle Linux 8)

[4.9.0-54.28] - bundled pyasn1: fix CVE-2026-23490 Resolves: RHEL-142448

Feb 4, 2026
High max 7.5

ELSA-2026-1906 1 CVE

Important: fence-agents security update (Oracle Linux 8)

[4.2.1-129.21] - bundled pyasn1: fix CVE-2026-23490 Resolves: RHEL-142447

Feb 4, 2026
High max 7.5

ELSA-2026-1903 1 CVE

Important: fence-agents security update (Oracle Linux 9)

[4.10.0-98.5] - bundled pyasn1: fix CVE-2026-23490 Resolves: RHEL-142459

Feb 4, 2026
High max 7.5

ELSA-2026-1843 6 CVEs

Important: nodejs22 security update (Oracle Linux 10)

[1:22.22.0-3] - Bump release to get correct RHEL build [1:22.22.0-2] - Filter for nodejs22.fmf in gating plan [1:22.22.0-1] - Update to 22.22.0 [1:22.19.0-3] - Unit-tests adjustment - disable internet/test-dgram-membership

Feb 4, 2026
High max 7.5

ELSA-2026-1842 6 CVEs

Important: nodejs24 security update (Oracle Linux 10)

[1:24.13.0-1.0.1] - Update upstream references [1:24.13.0-1] - Update to 24.13.0 [1:24.11.1-2] - makefile: change package manager to RH one

Feb 4, 2026
High max 9.8

ELSA-2026-0926 1 CVE

Important: net-snmp security update (Oracle Linux 7)

[1:5.7.2-49.0.3] - Fix out of bound access [Orabug: 38873509][CVE-2025-68615]

Feb 3, 2026
High max 7.5

ELSA-2026-1715 1 CVE

Important: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

[0.9.27-4] - rebuild to fix CVE-2025-61729

Feb 2, 2026
High max 9.8

ELSA-2026-1690 19 CVEs

Important: kernel security update (Oracle Linux 10)

[6.12.0-124.31.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Feb 2, 2026
High max 8.2

ELSA-2026-1628 3 CVEs

Important: php security update (Oracle Linux 10)

[8.3.29-1] - rebase to 8.3.29

Feb 1, 2026
High max 7.8

ELSA-2026-1574 1 CVE

Important: gimp:2.8 security update (Oracle Linux 8)

gimp [2:2.8.22-26.4] - fix CVE-2025-14422 pygobject2 pygtk2 python2-pycairo

Jan 29, 2026
High max 8.8

ELSA-2026-50075 12 CVEs

Important: openssl security update (Oracle Linux 9)

[3.5.1-7.0.1_fips] - Update additional upstream references - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824276] [3.5.1-7.0.1] - Enable openssl-fips-provider dependency [Orabu…

Jan 29, 2026
High max 8.2

ELSA-2026-1409 6 CVEs

Important: php:8.2 security update (Oracle Linux 9)

php [8.2.30-1] - rebase to 8.2.30 php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip

Jan 29, 2026
High max 7.0

ELSA-2026-0367 1 CVE

Important: mariadb security update (Oracle Linux 7)

[1:5.5.68-1.0.1] - Fixes CVE-2025-13699, remote code execution via improper path validation [Orabug: 38829265] - Fixes failing SSL and timezone tests

Jan 28, 2026
High max 8.2

ELSA-2026-1412 6 CVEs

Important: php:8.2 security update (Oracle Linux 8)

libzip [1.7.3-1] - update to 1.7.3 [1.6.1-1] - update to 1.6.1 - enable lzma support [1.5.2-1] - update to 1.5.2 - add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available [1.5.1-1] - update to 1.5.1 - drop …

Jan 28, 2026
High max 7.5

ELSA-2026-1518 1 CVE

Important: grafana-pcp security update (Oracle Linux 8)

[5.1.1-11] - Resolves RHEL-140538: CVE-2025-61729

Jan 28, 2026
High max 8.8

ELSA-2026-1473 12 CVEs

Important: openssl security update (Oracle Linux 9)

[3.5.1-7.0.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177] [3.5.1.openela.0.1] - Add OpenELA specific changes [1:3.5.1-7] …

Jan 28, 2026
High max 8.2

ELSA-2026-1429 3 CVEs

Important: php:8.3 security update (Oracle Linux 9)

php [8.3.29-1] - rebase to 8.3.29 php-pecl-apcu php-pecl-redis6 php-pecl-rrd php-pecl-xdebug3 php-pecl-zip

Jan 28, 2026
High max 8.8

ELSA-2026-1472 12 CVEs

Important: openssl security update (Oracle Linux 10)

[3.5.1-7.0.1] - Replace upstream references [Orabug: 34340177] - Update FIPS provider name [Orabug: 35824276] [1:3.5.1-7] - Fix CVE-2025-11187 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469 CVE-2025-66199 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69…

Jan 28, 2026
High max 7.5

ELSA-2026-0932 5 CVEs

Important: java-1.8.0-openjdk security update (Oracle Linux 8)

[1.8.0.482.b08-1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:1.8.0.482.b08-1] - Update to 8u482-b08 (GA). - Update release notes for 8u482-b08. - Remove generated-configure.sh changes from JDK-8141590 & FIPS patch as we already autogenerate this - …

Jan 27, 2026
High max 8.9

ELSA-2026-1240 3 CVEs

Important: fence-agents security update (Oracle Linux 8)

[4.2.1-129.20] - bundled urllib3: fix CVE-2025-66471 - bundled urllib3: fix CVE-2026-21441 Resolves: RHEL-139756, RHEL-140783 [4.2.1-129.17] - bundled urllib3: fix CVE-2025-66418 Resolves: RHEL-136027 [4.2.1-129.16] - fence_nutanix_ahv: new fence agent Resolv…

Jan 27, 2026
High max 7.5

ELSA-2026-1344 1 CVE

Important: grafana security update (Oracle Linux 8)

[9.2.10-27.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-27] - Resolves RHEL-140537: CVE-2025-61729

Jan 27, 2026
High max 8.9

ELSA-2026-1239 3 CVEs

Important: fence-agents security update (Oracle Linux 9)

[4.10.0-98.4] - bundled urllib3: fix CVE-2025-66471 - bundled urllib3: fix CVE-2026-21441 Resolves: RHEL-139793, RHEL-140795 [4.10.0-98.1] - bundled urllib3: fix CVE-2025-66418 Resolves: RHEL-136061

Jan 27, 2026
High max 9.8

ELSA-2026-1143 8 CVEs

Important: kernel security update (Oracle Linux 9)

[5.14.0-611.26.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Jan 27, 2026
High max 8.9

ELSA-2026-1241 3 CVEs

Important: resource-agents security update (Oracle Linux 8)

[4.9.0-54.27] - bundled urllib3: fix CVE-2025-66471 - bundled urllib3: fix CVE-2026-21441 Resolves: RHEL-139760, RHEL-140787 [4.9.0-54.24] - bundled urllib3: fix CVE-2025-66418 Resolves: RHEL-136031 [4.9.0-54.23] - nfsserver: add ability to set e.g. 'pipefs-d…

Jan 26, 2026