Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,089 results · Clear filters · Feed

  • High max 8.6
    ELSA-2025-23667 1 CVE

    Important: git-lfs security update (Oracle Linux 10)

    [3.6.1-4] - Backport fix for CVE-2025-26625

  • High max 7.8
    ELSA-2025-23279 2 CVEs

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-124.21.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 8.2
    ELSA-2025-23210 1 CVE

    Important: keylime security update (Oracle Linux 9)

    [7.12.1-11.3] - Registrar allows identity takeover via duplicate UUID registration Resolves: RHEL-130760 [7.12.1-11.2] - Properly fix the malformed certificate workaround Resolves: RHEL-111244

  • High max 8.2
    ELSA-2025-23201 1 CVE

    Important: keylime security update (Oracle Linux 10)

    [7.12.1-15] - Registrar allows identity takeover via duplicate UUID registration [7.12.1-14] - Properly fix malformed TPM certificates workaround [7.12.1-13] - Avoid opening /dev/stdout when printing [7.12.1-12] - Fix malformed TPM certificates workaround

  • High max 8.8
    ELSA-2025-17453 7 CVEs

    Important: firefox security update (Oracle Linux 7)

    [140.3.0-1.0.1] - Update to 140.3.0 [Orabug: 38509157][CVE-2025-10527][CVE-2025-10528] [CVE-2025-10529][CVE-2025-10532][CVE-2025-10533][CVE-2025-10536] [CVE-2025-10537] - Disable SVE parts of libyuv if not supported [Orabug: 38509157]

  • High max 9.8
    ELSA-2025-19278 7 CVEs

    Important: firefox security update (Oracle Linux 7)

    [140.4.0-4.0.1] - Update to 140.4.0 ESR [Orabug: 38595697][CVE-2025-11708][CVE-2025-11709] [CVE-2025-11710][CVE-2025-11711][CVE-2025-11712][CVE-2025-11714] [CVE-2025-11715]

  • High max 8.8
    ELSA-2025-22371 9 CVEs

    Important: firefox security update (Oracle Linux 7)

    [140.5.0-1.0.1] - Update to 140.5.0 ESR [Orabug: 38708474][CVE-2025-13012][CVE-2025-13013] [CVE-2025-13014][CVE-2025-13015][CVE-2025-13016][CVE-2025-13017] [CVE-2025-13018][CVE-2025-13019][CVE-2025-13020]

  • High max 8.8
    ELSA-2025-28049 65 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.350.3.1] - Reapply 'cpuidle: menu: Avoid discarding useful information' (Harshvardhan Jha) [Orabug: 38744458] - fbcon: fix integer overflow in font allocation (Samasth Norway Ananda) [Orabug: 38744453] [5.4.17-2136.350.3] - net/rds: Fix rs_recv_p…

  • High max 9.8
    ELSA-2025-28048 79 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-315.196.5.1] - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso) [Orabug: 38744086] {CVE-2025-38678} - Reapply 'cpuidle: menu: Avoid discarding useful information' (Harshvardhan Jha) [Orabug: 38744084] - rtc: expose RTC_FEAT…

  • High max 9.8
    ELSA-2025-23128 10 CVEs

    Important: firefox security update (Oracle Linux 8)

    [140.6.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] [140.6.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.6.0-1] - Update to 140.6.0 ESR

  • High max 7.8
    ELSA-2025-23142 1 CVE

    Important: wireshark security update (Oracle Linux 9)

    [1:3.4.10-8.1] - Resolves: RHEL-130438 - Access of Uninitialized Pointer in Wireshark

  • High max 7.0
    ELSA-2025-28047 4 CVEs

    Important: edk2 security update (Oracle Linux 9)

    [20250905-4] - Create new 20250905 release for OL9 which includes the following fixed CVEs: - EDK2: EDK2 contains a vulnerability in BIOS where an attacker may cause 'Protection Mechanism Failure' by local access [Orabug: 38381983] {CVE-2025-3770} - EDK2: EDK…

  • High max 9.0
    ELSA-2025-21657 9 CVEs

    Important: libsoup security update (Oracle Linux 7)

    [2.62.2-2.0.7] - Backport patch for CVE-2025-4945 and CVE-2025-11021 [Orabug: 38664275] [2.62.2-2.0.5] - Fixes CVE-2025-2784 CVE-2025-4948 CVE-2025-32049 [Orabug: 38085184] - CVE-2025-32906 CVE-2025-32911 CVE-2025-32913 CVE-2025-32914 [2.62.2-2.0.3] - Fixed C…

  • High max 7.3
    ELSA-2025-22096 3 CVEs

    Important: tigervnc security update (Oracle Linux 7)

    [1.8.0-33.0.9] - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation [Orabug: 38694278] - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal - Fix CVE-2025-62231: xorg-x11-server: Value ove…

  • High max 9.8
    ELSA-2025-23048 2 CVEs

    Important: tomcat security update (Oracle Linux 8)

    [1:9.0.87-1.7] - Resolves: RHEL-124507 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) - Resolves: RHEL-91743 tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

  • High max 9.8
    ELSA-2025-23049 2 CVEs

    Important: tomcat security update (Oracle Linux 9)

    [1:9.0.87-6.1] - Resolves: RHEL-124518 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) - Resolves: RHEL-91753 tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

  • High max 9.8
    ELSA-2025-23034 10 CVEs

    Important: firefox security update (Oracle Linux 9)

    [140.6.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.6.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Ab…

  • High max 9.8
    ELSA-2025-23050 3 CVEs

    Important: tomcat security update (Oracle Linux 10)

    [1:10.1.36-3.1] - Resolves: RHEL-124494 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) - Resolves: RHEL-91729 tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651) - Resolves: RHEL-132527 tomcat: Denial of service (CVE-2025-617…

  • High max 9.8
    ELSA-2025-23052 2 CVEs

    Important: tomcat9 security update (Oracle Linux 10)

    [1:9.0.87-8.1] - Resolves: RHEL-124497 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) - Resolves: RHEL-91732 tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

  • High max 7.8
    ELSA-2025-23083 1 CVE

    Important: wireshark security update (Oracle Linux 10)

    [4.4.2-4.0.1.1] - Fix post script to not fail during initial installation [Orabug: 37565359] [1:4.4.2-4.1] - Resolves: RHEL-130425 - Access of Uninitialized Pointer in Wireshark

  • High max 9.8
    ELSA-2025-23035 10 CVEs

    Important: firefox security update (Oracle Linux 10)

    [140.6.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.6.0-1] - Update to 140.6.0 ESR

  • High max 9.4
    ELSA-2025-28040 41 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-106.55.4.1] - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso) [Orabug: 38712798] {CVE-2025-38678} [6.12.0-106.55.4] - ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek) [Orabug: 37844…

  • High max 8.8
    ELSA-2025-22789 18 CVEs 1 exploited

    Important: webkit2gtk3 security update (Oracle Linux 8)

    [2.50.3-1] - Update to 2.50.3

  • High max 8.8
    ELSA-2025-22790 18 CVEs 1 exploited

    Important: webkit2gtk3 security update (Oracle Linux 9)

    [2.50.3-1] - Update to 2.50.3

  • High max 8.8
    ELSA-2025-19847 1 CVE

    Important: sssd security update (Oracle Linux 7)

    [1.16.5-10.0.5.16] - krb5: disable Kerberos localauth an2ln plugin for AD/IPA [Orabug: 38621159]

  • High max 8.8
    ELSA-2025-22760 1 CVE

    Important: abrt security update (Oracle Linux 8)

    [2.10.9-25.0.1] - Replaces sosreport to sos report in sosreport-event.conf [Orabug: 38590929] - abrt-dump-oops-Fix-vmcore-call-trace-parsing-arm [Orabug: 34184473] - Disable autoreporting on Oracle Linux [Orabug: 32890748] - Add orabug32082455-Upstream_refere…

  • High max 7.0
    ELSA-2025-20669 4 CVEs

    Important: edk2 security update (Oracle Linux 8)

    [20250905-4.el8] - Create new 20250905 release for OL8 which includes the following fixed CVEs: - EDK2: EDK2 contains a vulnerability in BIOS where an attacker may cause "Protection Mechanism Failure" by local access [Orabug: 38381983] {CVE-2025-3770} - EDK2:…

  • High max 8.1
    ELSA-2025-20983 2 CVEs

    Important: podman security update (Oracle Linux 10)

    [5.6.0-6.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.6.0-6] - update to the latest content o…

  • High max 7.5
    ELSA-2025-21006 1 CVE

    Important: kea security update (Oracle Linux 10)

    [3.0.1-2] - Fixes CVE-2025-11232 [3.0.1-1] - New version 3.0.1 - Fixes CVE-2025-40779

  • High
    ELSA-2025-28026 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.349.3.2] - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38705546] {CVE-2025-40019}

  • High
    ELSA-2025-28024 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-314.193.5.5] - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38705933] {CVE-2025-40019}

  • High max 7.8
    ELSA-2025-28025 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-105.51.5.1] - crypto: essiv - Check ssize for decryption and in-place encryption (Herbert Xu) [Orabug: 38712788] {CVE-2025-40019} - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso) [Orabug: 38712786] {CVE-2025-38678}

  • High max 7.5
    ELSA-2025-21030 1 CVE

    Important: expat security update (Oracle Linux 10)

    [2.7.1-3] - Fix CVE-2025-59375 - backport allocation tracking improvements [2.7.1-2] - https://issues.redhat.com/browse/RHELMISC-13073

  • High max 7.5
    ELSA-2025-21032 2 CVEs

    Important: libsoup3 security update (Oracle Linux 10)

    [3.6.5-6] - Fix integer overflow in date/time parsing [3.6.5-5] - Bump revision number [3.6.5-4] - Fix several CVEs

  • High max 8.6
    ELSA-2025-21034 3 CVEs

    Important: bind security update (Oracle Linux 10)

    [9.18.33-10.0.1] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.18.33-10.2] - Fix upstream reported regression in recent CVE fix (CVE-2025-8677) [32:9.18.33-10.1] - Refuse malformed DNSKEY records (CVE-2025-8677) - Address variou…

  • High max 8.6
    ELSA-2025-21142 2 CVEs

    Important: python-kdcproxy security update (Oracle Linux 10)

    [1.0.0-19] - Use DNS discovery for declared realms only (CVE-2025-59088) Resolves: RHEL-122777 - Fix DoS vulnerability based on unbounded TCP buffering (CVE-2025-59089) Resolves: RHEL-122776

  • High max 9.1
    ELSA-2025-20994 1 CVE

    Important: ipa security update (Oracle Linux 10)

    [4.12.2-24.0.1.1] - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674] - Add bind to ipa-server-common Requires [Orabug: 36518596] [4.12.2-24.1] - Resolves: RHEL-118447 CVE-2025-7493 ipa: Privilege escalation from host to domain admin in FreeI…

  • High max 7.3
    ELSA-2025-21220 1 CVE

    Important: podman security update (Oracle Linux 10)

    [5.6.0-6.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.6.0-6] - update to the latest content o…

  • High max 7.5
    ELSA-2025-21691 1 CVE

    Important: haproxy security update (Oracle Linux 10)

    [3.0.5-4.1] - Fix denial of service vulnerability in mjson library (CVE-2025-11230) Resolves: RHEL-126652

  • High max 8.8
    ELSA-2025-21843 9 CVEs

    Important: thunderbird security update (Oracle Linux 10)

    [140.5.0-2.0.1] - Add Oracle prefs [140.5.0-2] - Update to 140.5.0 ESR