Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,089 results · Clear filters · Feed

High max 8.2

ELSA-2026-0421 1 CVE

Important: libsoup security update (Oracle Linux 8)

[2.62.3-11] - Backport patch for CVE-2025-14523

Jan 12, 2026
High max 9.8

ELSA-2026-0444 3 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.92.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [O…

Jan 12, 2026
High max 8.2

ELSA-2026-0422 1 CVE

Important: libsoup security update (Oracle Linux 9)

[2.72.0-12.3] - Fix patch for CVE-2025-14523 to handle comparison case-insensitively [2.72.0-12.2] - Backport patch for CVE-2025-14523 [2.72.0-12.1] - Backport patch for CVE-2025-4945 and CVE-2025-11021

Jan 12, 2026
High max 7.5

ELSA-2026-0437 1 CVE

Important: buildah security update (Oracle Linux 9)

[1.41.8-1.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.41.8-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.41 (https://github.com/containers/buildah/commit/f85ff89) - fix…

Jan 12, 2026
High max 7.5

ELSA-2026-0470 1 CVE

Important: podman security update (Oracle Linux 9)

[5.6.0-11.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.6.0-11] - update to the latest content…

Jan 12, 2026
High max 8.2

ELSA-2026-0423 1 CVE

Important: libsoup3 security update (Oracle Linux 10)

[3.6.5-8] - Fix CVE-2025-14523 [3.6.5-7] - Add patch for CVE-2025-12105 [3.6.5-6] - Fix integer overflow in date/time parsing [3.6.5-5] - Bump revision number [3.6.5-4] - Fix several CVEs

Jan 12, 2026
High max 7.5

ELSA-2026-0436 1 CVE

Important: buildah security update (Oracle Linux 10)

[1.41.8-1.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.41.8-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.41 (https://github.com/containers/buildah/commit/f85ff89) - fix…

Jan 12, 2026
High max 9.8

ELSA-2026-0453 9 CVEs

Important: kernel security update (Oracle Linux 10)

[6.12.0-124.27.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jan 12, 2026
High max 8.3

ELSA-2026-0075 1 CVE

Important: httpd security update (Oracle Linux 7)

[2.4.6-99.0.9.1] - Fix CVE-2025-58098 [Orabug: 38816066] [2.4.6-99.0.7.1] - Fixed security update CVE-2024-47252 CVE-2025-49812 [Orabug: 38378160] [2.4.6-99.0.5.1] - Differentiate trusted sources [Orabug: 37100272][CVE-2024-38476] [2.4.6-99.0.3.1] - Opt-ins f…

Jan 9, 2026
High max 7.0

ELSA-2026-0247 7 CVEs

Important: mariadb:10.11 security update (Oracle Linux 9)

galera mariadb [3:10.11.15-1] - Rebase to 10.11.15 - Resolves: RHBZ#2417697 [3:10.11.14-3] - Add installation of downstream sysusers.d config file in place of the upstream one [3:10.11.14-3] - Bump release for tmpfiles.d change [3:10.11.14-2] - Revert to soft…

Jan 9, 2026
High max 7.0

ELSA-2026-0225 1 CVE

Important: mariadb:10.3 security update (Oracle Linux 8)

galera Judy mariadb [3:10.3.39-2] - Release bump for rebuild

Jan 8, 2026
High max 7.1

ELSA-2026-0125 3 CVEs

Important: mingw-libpng security update (Oracle Linux 8)

[1.6.34-1] - Rebase to version 1.6.34 - Fix the following CVEs CVE-2025-64720 CVE-2025-65018 CVE-2025-66293 - Resolves: RHEL-131458 - Resolves: RHEL-131471 - Resolves: RHEL-133229

Jan 7, 2026
High max 7.1

ELSA-2026-0241 3 CVEs

Important: libpng security update (Oracle Linux 8)

[2:1.6.34-9] - CVE-2025-64720: buffer overflow (RHEL-131452) - CVE-2025-65018: heap buffer overflow (RHEL-131465) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133226) [2:1.6.34-8] - Remove redundant fix for CVE-2017-12652 [2:1.6.34-7…

Jan 7, 2026
High max 7.0

ELSA-2026-0232 1 CVE

Important: mariadb:10.11 security update (Oracle Linux 8)

galera Judy mariadb [3:10.11.10-2] - Release bump for rebuild

Jan 7, 2026
High max 7.0

ELSA-2026-0233 1 CVE

Important: mariadb:10.5 security update (Oracle Linux 8)

galera Judy mariadb [3:10.5.29-3] - Release bump for rebuild

Jan 7, 2026
High max 7.0

ELSA-2026-0137 1 CVE

Important: mariadb security update (Oracle Linux 9)

[3:10.5.29-3] - Release bump for rebuild

Jan 7, 2026
High max 7.1

ELSA-2026-0238 3 CVEs

Important: libpng security update (Oracle Linux 9)

[2:1.6.37-12.1] - CVE-2025-64720: buffer overflow (RHEL-131580) - CVE-2025-65018: heap buffer overflow (RHEL-131593) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133287)

Jan 7, 2026
High max 7.1

ELSA-2026-0237 3 CVEs

Important: libpng security update (Oracle Linux 10)

[2:1.6.40-8.1] - CVE-2025-64720: buffer overflow (RHEL-131422) - CVE-2025-65018: heap buffer overflow (RHEL-131435) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133212)

Jan 7, 2026
High max 8.6

ELSA-2025-22205 1 CVE

Important: bind security update (Oracle Linux 7)

[32:9.11.4-26.0.5.P2.16] - Resolve CVE-2025-40778 [Orabug: 38699863] [32:9.11.4-26.0.3.P2.16] - Resolve CVE-2024-11187 [Orabug: 37616907] [32:9.11.4-26.0.1.P2.16] - Resolve CVE-2024-1975 - Resolve CVE-2024-1737 - Add ability to change runtime limits for max t…

Jan 6, 2026
High max 7.0

ELSA-2026-0136 7 CVEs

Important: mariadb10.11 security update (Oracle Linux 10)

[3:10.11.15-1] - Rebase to 10.11.15 - Resolves: RHBZ#2417697 [3:10.11.14-3] - Add installation of downstream sysusers.d config file in place of the upstream one [3:10.11.14-3] - Bump release for tmpfiles.d change [3:10.11.14-2] - Revert to soft static allocat…

Jan 6, 2026
High max 9.8

ELSA-2026-0026 10 CVEs

Important: thunderbird security update (Oracle Linux 8)

[140.6.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.6.0] - Add OpenELA debranding [140.6.0-1] - Update to 140.6.0 ESR

Jan 5, 2026
High max 9.8

ELSA-2026-0025 10 CVEs

Important: thunderbird security update (Oracle Linux 10)

[140.6.0-1.0.1] - Add Oracle prefs [140.6.0-1] - Update to 140.6.0 ESR

Jan 5, 2026
High max 8.3

ELSA-2025-23732 4 CVEs

Important: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-65.0.1.7] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-65.7] - Resolves: RHEL-135054 - httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200) - Resolves: RHEL-135039 - httpd: A…

Dec 24, 2025
High max 9.4

ELSA-2025-23530 12 CVEs

Important: python39:3.9 security update (Oracle Linux 8)

mod_wsgi numpy python39 [3.9.25-2] - Add explicit BR: libxcrypt-devel - Properly apply exported CFLAGS for dtrace/systemtap builds - Update to Python 3.9.25 - Move _sysconfigdata_d_linux*.py to the debug subpackage - Fedora contributions by: Bjorn Esser <bess…

Dec 23, 2025
High max 7.8

ELSA-2025-28068 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.350.3.2] - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38786776] {CVE-2025-40271} [5.4.17-2136.350.3.1] - Reapply 'cpuidle: menu: Avoid discarding useful information' (Harshvardhan Jha) [Orabug: 38744458] - fbcon: fix integer overfl…

Dec 22, 2025
High max 7.3

ELSA-2025-23543 1 CVE

Important: container-tools:ol8 security update (Oracle Linux 8)

aardvark-dns buildah [2:1.33.13-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.33 (https://github.com/containers/buildah/commit/65707d0) - fixes '[Minor Incident] CVE-2025-52881 container-tools:rhel8/buildah: contain…

Dec 22, 2025
High max 9.8

ELSA-2025-23856 10 CVEs

Important: thunderbird security update (Oracle Linux 9)

[140.6.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.6.0] - Add OpenELA debranding [140.6.0-1] - Update to 140.6.0 ESR

Dec 22, 2025
High max 8.3

ELSA-2025-23919 3 CVEs

Important: httpd security update (Oracle Linux 9)

[2.4.62-7.0.1.3] - Replace index.html with Oracle's index page oracle_index.html. [2.4.62-7.3] - Resolves: RHEL-135063 - httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200) - Resolves: RHEL-135048 - httpd: Apache H…

Dec 22, 2025
High max 7.8

ELSA-2025-28067 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-315.196.5.2] - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [Orabug: 38786195] {CVE-2025-40280} - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38786194] {CVE-2025-40271} - vsock: Ignore signal/timeout on connect…

Dec 22, 2025
High max 7.8

ELSA-2025-28066 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-106.55.4.2] - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) {CVE-2025-40271} - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca) {CVE-2025-40215}

Dec 22, 2025
High max 8.3

ELSA-2025-23932 3 CVEs

Important: httpd security update (Oracle Linux 10)

[2.4.63-4.0.1.3] - Replace index.html with Oracle's index page oracle_index.html. [2.4.63-4.3] - Resolves: RHEL-135052 - httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200) - Resolves: RHEL-135035 - httpd: Apache H…

Dec 22, 2025
High max 8.6

ELSA-2025-23745 1 CVE

Important: git-lfs security update (Oracle Linux 8)

[3.4.1-6] - Backport CVE-2025-26625 fixes - Resolves: RHEL-122423

Dec 21, 2025
High max 7.5

ELSA-2025-23739 1 CVE

Important: mod_md security update (Oracle Linux 9)

[1:2.4.26-1.1] - Resolves: RHEL-134496 - httpd: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)

Dec 21, 2025
High max 8.6

ELSA-2025-23744 1 CVE

Important: git-lfs security update (Oracle Linux 9)

[3.6.1-4] - Backport fix for CVE-2025-26625 - Resolves: RHEL-122431

Dec 21, 2025
High max 7.5

ELSA-2025-23738 1 CVE

Important: mod_md security update (Oracle Linux 10)

[1:2.4.26-4] - Resolves: RHEL-134483 - httpd: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)

Dec 21, 2025
High max 7.8

ELSA-2025-22866 2 CVEs

Important: gimp security update (Oracle Linux 7)

[2:2.22-1.0.5] - Fixes CVE-2025-10922 and CVE-2025-10934 [Orabug: 38739185] [2:2.8.22-1.0.3] - Fixes CVE-2025-5473 (GIMP ICO File Parsing Integer Overflow) [Orabug: 38110877] - Fixes CVE-2025-48797 (Multiple heap buffer overflows in TGA parser) - Fixes CVE-20…

Dec 18, 2025
High max 8.6

ELSA-2025-22982 2 CVEs

Important: python-kdcproxy security update (Oracle Linux 7)

[0.3.2-3.0.1] - Use DNS discovery for declared realms only (CVE-2025-59088) [Orabug: 38745300] - Fix DoS vulnerability based on unbounded TCP buffering (CVE-2025-59089)

Dec 18, 2025
High max 8.8

ELSA-2025-23663 6 CVEs 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.50.4-1] - Update to 2.50.4

Dec 18, 2025
High max 9.8

ELSA-2025-23241 3 CVEs

Important: kernel security update (Oracle Linux 9)

[5.14.0-611.16.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Dec 18, 2025
High max 8.8

ELSA-2025-23700 6 CVEs 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.50.4-1] - Update to 2.50.4

Dec 18, 2025