Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,089 results · Clear filters · Feed

High max 8.8

ELSA-2025-16099 1 CVE

Important: postgresql security update (Oracle Linux 7)

[9.2.24-9.0.7] - Restrict psql meta-commands in plain-text dumps [Orabug: 38442031][CVE-2025-8714] [9.2.24-9.0.5] - Resolves CVE-2025-1094: Improper neutralization of quoting syntax in certain - libpq functions [Orabug: 37843176]

Nov 19, 2025
High max 10.0

ELSA-2025-19167 1 CVE

Important: squid security update (Oracle Linux 7)

[7:3.5.20-17.0.9.13] - Fixes CVE-2025-62168, squid: Squid vulnerable to information disclosure via - authentication credential leakage in error handling [Orabug: 38587551] [7:3.5.20-17.0.7.13] - Fixes CVE-2025-54574, add URN access disabling config options [O…

Nov 18, 2025
High max 8.4

ELSA-2025-21232 3 CVEs

Important: container-tools:ol8 security update (Oracle Linux 8)

slirp4netns [1.2.3-1] - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.3 - Related: Jira:RHEL-2110 [1.2.2-1] - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.2 - Related: Jira:RHEL-2110 [1.2.1-1]…

Nov 17, 2025
High max 8.6

ELSA-2025-21140 2 CVEs

Important: idm:DL1 security update (Oracle Linux 8)

bind-dyndb-ldap [11.6-6] - Fix rpminspect warnings Resolves: RHEL-22497 custodia ipa [4.9.13-20.0.1] - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674] ipa-healthcheck opendnssec [2.1.7-2] - Don't creat /var/run/opendnssec directory - Resolv…

Nov 13, 2025
High max 9.1

ELSA-2025-17649 1 CVE

Important: ipa security update (Oracle Linux 7)

[4.6.8-5.0.5.el7_9.17] - Fixes CVE-2025-7493 Enforce uniqueness across krbprincipalname - and krbcanonicalname [Orabug: 38520120] [4.6.8-5.0.3.el7_9.17] - Fix privilege escalation from host to domain vulnerability - CVE-2025-4404 [Orabug: 38085890]

Nov 11, 2025
High max 9.8

ELSA-2025-25755 10 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.349.3.1] - i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38604171] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Justin Bronder) [Orabug: 38604171] {CVE-2025-39973} [5.4.17-2136.349.3] - Revert 'net/mlx5e: Updat…

Nov 10, 2025
High max 8.6

ELSA-2025-19950 3 CVEs

Important: bind9.18 security update (Oracle Linux 9)

[32:9.18.29-4.2] - Fix upstream reported regression in recent CVE fix (CVE-2025-8677) - Add upstream created test to this regression [32:9.18.29-4.1] - Refuse malformed DNSKEY records (CVE-2025-8677) - Address various spoofing attacks (CVE-2025-40778) - Preve…

Nov 10, 2025
High max 8.6

ELSA-2025-19951 2 CVEs

Important: bind security update (Oracle Linux 9)

[9.16.23-31.0.1] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-31.2] - Replace downstream fixes with upstream changes [32:9.16.23-31.1] - Prevent cache poisoning due to weak PRNG (CVE-2025-40780) - Address various spoofing…

Nov 10, 2025
High max 9.8

ELSA-2025-25757 121 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-314.193.5.3] - Revert 'cpufreq: Introduce an optional cpuinfo_avg_freq sysfs entry' (Samasth Norway Ananda) [Orabug: 38633525] [5.15.0-314.193.5.2] - i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38607608] {CVE-2025-39973} - i40e: …

Nov 10, 2025
High max 9.8

ELSA-2025-25754 121 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-105.51.5] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Patrisious Haddad) [Orabug: 38226124] - arm64: Utilize for_each_cpu_wrap for reference lookup (Beata Michalska) [Orabug: 38454705] - arm64: Update AMU-based freq scale factor on enterin…

Nov 9, 2025
High max 8.8

ELSA-2025-19906 2 CVEs

Important: mingw-libtiff security update (Oracle Linux 8)

[4.0.9-3] - Fix CVE-2018-5784 CVE-2018-7456 CVE-2017-9935 CVE-2017-9935 - Fix CVE-2017-18013 CVE-2018-8905 CVE-2018-10963 CVE-2018-17100 - Fix CVE-2018-18557 CVE-2018-18661 (RHBZ #1602597) CVE-2018-12900 - Fix CVE-2019-14973 CVE-2019-17546 CVE-2020-35521 CVE-…

Nov 7, 2025
High max 8.4

ELSA-2025-19927 3 CVEs

Important: runc security update (Oracle Linux 9)

[4:1.2.5-3] - Add relevant patches to CVEs - Resolves: RHEL-122402 [4:1.2.5-2] - fix CVE-2025-31133 CVE-2025-52565 CVE-2025-52881 - Resolves: RHEL-122402 - Resolves: RHEL-122404 - Resolves: RHEL-122415 [4:1.2.5-1] - update to https://github.com/opencontainers…

Nov 7, 2025
High max 7.5

ELSA-2025-19513 5 CVEs

Important: pcs security update (Oracle Linux 10)

[0.12.0-3.0.1.el10_0.3] - Fixed CVE-2025-59830, CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919 by updating bundled rubygem rack Resolves: RHEL-120943, RHEL-121036, RHEL-123631, RHEL-123644, RHEL-124942

Nov 7, 2025
High max 7.5

ELSA-2025-19719 5 CVEs

Important: pcs security update (Oracle Linux 8)

[0.10.18-2.0.1.7] - Replaced HAM-logo

Nov 6, 2025
High max 7.3

ELSA-2025-19909 3 CVEs

Important: tigervnc security update (Oracle Linux 8)

[1.15.0-8] - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation Resolves: RHEL-119979 - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal Resolves: RHEL-120001 - Fix CVE-2025-62231: xorg-…

Nov 6, 2025
High max 8.8

ELSA-2025-19851 1 CVE

Important: sssd security update (Oracle Linux 10)

[2.10.2-3.0.1.3] - Restore default debug level for sss_cache [Orabug: 32810448] [2.10.2-3.3] - Resolves: RHEL-120286 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.0.z] [2.10.2-3.2] -…

Nov 6, 2025
High max 8.6

ELSA-2025-19912 3 CVEs

Important: bind security update (Oracle Linux 10)

[9.18.33-4.0.1] - Fix warning when changing device file permissions [Orabug: 36518580] [9.18.33-4.2] - Fix upstream reported regression in recent CVE fix (CVE-2025-8677) [9.18.33-4.1] - Refuse malformed DNSKEY records (CVE-2025-8677) - Address various spoofin…

Nov 6, 2025
High max 8.6

ELSA-2025-19793 2 CVEs

Important: bind9.16 security update (Oracle Linux 8)

[32:9.16.23-0.22.4] - Prevent cache poisoning due to weak PRNG (CVE-2025-40780) - Address various spoofing attacks (CVE-2025-40778) - Replace downstream fixes with upstream changes [32:9.16.23-0.22.3] - Update addresses of b.root-servers.net (RHEL-18449)

Nov 5, 2025
High max 8.6

ELSA-2025-19835 1 CVE

Important: bind security update (Oracle Linux 8)

[32:9.11.36-16.6] - Address various spoofing attacks (CVE-2025-40778) [32:9.11.36-16.5] - Add support for max-records-per-type and max-types-per-name options (RHEL-61936) - Support reading of new options also in named-checkconf -z, v2

Nov 5, 2025
High max 10.0

ELSA-2025-19675 4 CVEs

Important: valkey security update (Oracle Linux 10)

[8.0.6-1.0.1] - Fix for CVE-2025-49844 [Orabug: 38515582] [8.0.6-1] - rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819

Nov 5, 2025
High max 9.4

ELSA-2025-19772 1 CVE

Important: qt6-qtsvg security update (Oracle Linux 10)

[6.8.1-1.1] - Fix CVE-2025-10729: Prevent dangling pointers from misplaced elements Resolves: RHEL-119697

Nov 5, 2025
High max 8.8

ELSA-2025-19610 1 CVE

Important: sssd security update (Oracle Linux 8)

[2.9.4-5.0.2.3] - Missing ntohs to service port [Orabug: 37389651] - Restore default debug level for sss_cache [Orabug: 32810448] [2.9.4-5.3] - Resolves: RHEL-112455 - p11_child currently has an infinite timeout [rhel-8.10.z] - Resolves: RHEL-120292 - CVE-202…

Nov 4, 2025
High max 7.5

ELSA-2025-19714 2 CVEs

Important: libsoup security update (Oracle Linux 8)

[2.62.3-10] - Backport patch for CVE-2025-4945 and CVE-2025-11021

Nov 4, 2025
High max 7.5

ELSA-2025-19713 2 CVEs

Important: libsoup security update (Oracle Linux 9)

[2.72.0-10.3] - Backport patch for CVE-2025-4945 and CVE-2025-11021 [2.72.0-10.2] - Backport patches for various CVEs Resolves: RHEL-85888 Resolves: RHEL-87081 Resolves: RHEL-88332 Resolves: RHEL-92285 [2.72.0-10.1] - Backport patches for various CVEs, plus t…

Nov 4, 2025
High max 7.3

ELSA-2025-19489 3 CVEs

Important: tigervnc security update (Oracle Linux 9)

[1.14.1-9] - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation Resolves: RHEL-119987 - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal Resolves: RHEL-120006 - Fix CVE-2025-62231: xorg-…

Nov 3, 2025
High max 7.5

ELSA-2025-19512 5 CVEs

Important: pcs security update (Oracle Linux 9)

[0.11.9-2.el9_6.2] - Fixed CVE-2025-59830, CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919 by updating bundled rubygem rack Resolves: RHEL-120943, RHEL-121036, RHEL-123631, RHEL-123644, RHEL-124942

Nov 3, 2025
High max 8.8

ELSA-2025-25733 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-313.189.5.3] - i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38603025] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Justin Bronder) [Orabug: 38603025]

Nov 3, 2025
High max 8.8

ELSA-2025-25731 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.348.3.1] - i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38604168] {CVE-2025-39973} - i40e: increase max descriptors for XL710 (Justin Bronder) [Orabug: 38604168] {CVE-2025-39973}

Nov 2, 2025
High max 7.5

ELSA-2025-19403 1 CVE

Important: expat security update (Oracle Linux 10)

[2.7.1-3] - Backport security fixes to expat [2.7.1-2] - https://issues.redhat.com/browse/RHELMISC-13073

Nov 2, 2025
High max 10.0

ELSA-2025-19345 4 CVEs

Important: redis:7 security update (Oracle Linux 9)

[7.2.11-1.0.1] - Build with 64k pages to support redis on UEK on aarch64 [7.2.11-1] - rebase to 7.2.11 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819

Oct 31, 2025
High max 10.0

ELSA-2025-19238 4 CVEs

Important: redis:6 security update (Oracle Linux 8)

[6.2.20-1.0.1] - Build with 64k pages to support redis on both UEK6 and UEK7 on aarch64 [6.2.20-1] - rebase to 6.2.20 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819

Oct 30, 2025
High max 10.0

ELSA-2025-19237 4 CVEs

Important: redis security update (Oracle Linux 9)

[6.2.20-1] - rebase to 6.2.20 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819

Oct 30, 2025
High max 8.8

ELSA-2025-17710 1 CVE

Important: compat-libtiff3 security update (Oracle Linux 7)

[3.9.4-12.0.1] - Fixes CVE-2025-9900 buffer underflow [Orabug: 38523840]

Oct 29, 2025
High max 8.8

ELSA-2025-19276 1 CVE

Important: libtiff security update (Oracle Linux 8)

[4.0.9-35] - fix CVE-2025-9900: buffer underflow crash in TIFFReadRGBAImageOriented() (RHEL-112533)

Oct 29, 2025
High max 8.8

ELSA-2025-19113 2 CVEs

Important: libtiff security update (Oracle Linux 9)

[4.4.0-13.2] - fix CVE-2025-8176 off-by-one error skipping first line in tiffdither and tiffmedian - Resolves: RHEL-120243 [4.4.0-13.1] - fix CVE-2025-9900 buffer underflow in TIFFReadRGBAImageOriented - Resolves: RHEL-112542

Oct 28, 2025
High max 8.8

ELSA-2025-19156 1 CVE

Important: libtiff security update (Oracle Linux 10)

[4.6.0-6.1] - Fix buffer underflow crash in TIFFReadRGBAImageOriented - Resolves: RHEL-112522

Oct 28, 2025
High max 10.0

ELSA-2025-19107 1 CVE

Important: squid:4 security update (Oracle Linux 8)

libecap squid [7:4.15-10.9] - Resolves: RHEL-122484 - squid: Squid vulnerable to information disclosure via authentication credential leakage in error handling (CVE-2025-62168)

Oct 27, 2025
High max 9.8

ELSA-2025-20721 2 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-313.189.5.2] - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (Jeff Layton) [Orabug: 38575798] {CVE-2025-38724} - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38575792] - crypto: af_alg -…

Oct 24, 2025
High max 9.8

ELSA-2025-20719 10 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-104.43.4.3] - io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38572958] {CVE-2025-39698} - fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38572953] {CVE-2025-39866} - kernfs: …

Oct 24, 2025
High max 9.8

ELSA-2025-18983 7 CVEs

Important: thunderbird security update (Oracle Linux 8)

[140.4.0-2.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.4.0] - Add OpenELA debranding [140.4.0-2] - Update to 140.4.0 ESR

Oct 23, 2025