Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,082 results · Clear filters · Feed

  • High max 9.8
    ELSA-2026-89860 11 CVEs

    Important: httpd security update (Oracle Linux 10)

    [2.4.63-13.0.1.el10_2.8] - Replace index.html with Oracle's index page oracle_index.html. [2.4.63-13.8] - Related: RHEL-275253 - httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292) - Resolves: RHEL-280355 - httpd: Den…

  • High max 9.6
    ELSA-2026-89758 29 CVEs

    Important: firefox security, bug fix, and enhancement update (Oracle Linux 10)

    [153.5.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [153.5.0-1] - Update to 153.5.0 ESR [140.15.0-1] - Update to 140.15.0 ESR [140.12.0-1] - Updat…

  • High max 8.8
    ELSA-2026-90523 1 CVE

    Important: xdg-dbus-proxy security update (Oracle Linux 10)

    [0.1.5-4.1] - Message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422) Resolves: RHEL-271542

  • High max 9.1
    ELSA-2026-500496 4 CVEs

    Important: ca-certificates security update (Oracle Linux 7)

    [2025.2.80_v9.0.304-71.0.2] - eMudhra: add 'emSign ECC Root CA - G3' and 'Comodo AAA Services root' to blocklist [2025.2.80_v9.0.304-71.0.1] - Resolve ELBA-2025-22492 [Orabug: 38712242] - Update to CKBI 2.80_v9.0.304 from NSS 3.114 - Adding: - # Certificate '…

  • High max 6.2
    ELSA-2026-85916 1 CVE

    Important: perl-DBI:1.641 security update (Oracle Linux 8)

    perl-DBI [1.641-11] - CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting read during numeric type casting Resolves: RHEL-271961 [1.641-10] - Fix number of tests Resolves: RHEL-247869 [1.641-9] - Fix placeh…

  • High max 8.4
    ELSA-2026-87805 8 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.60.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 7.5
    ELSA-2026-88280 4 CVEs

    Important: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

    [0.9.27-7.4] - rebuilt with golang-1.26.10-1.el10_2

  • High max 7.5
    ELSA-2026-88262 4 CVEs

    Important: buildah security update (Oracle Linux 10)

    [1.43.1-7.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.43.1-7] - Rebuild for CVE-2026-111943 - Resolves: RHEL-287469

  • High max 8.8
    ELSA-2026-88477 18 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.68.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 9.2
    ELSA-2026-87073 3 CVEs 2 exploited

    Important: php:8.2 security update (Oracle Linux 8)

    libzip [1.7.3-1] - update to 1.7.3 [1.6.1-1] - update to 1.6.1 - enable lzma support [1.5.2-1] - update to 1.5.2 - add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available [1.5.1-1] - update to 1.5.1 - drop …

  • High max 7.5
    ELSA-2026-88188 4 CVEs

    Important: grafana security update (Oracle Linux 8)

    [9.2.10-36.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-36] - Rebuild against updated golang - Resolves RHEL-287629 - Resolves RHEL-279255 - Resolves RHEL-278945 - Resolves RHEL-278602

  • High max 7.5
    ELSA-2026-88189 3 CVEs

    Important: grafana-pcp security update (Oracle Linux 8)

    [5.1.1-19] - Rebuild against updated golang - Resolves RHEL-287631 - Resolves RHEL-279256 - Resolves RHEL-278603

  • High max 8.8
    ELSA-2026-87375 7 CVEs

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.177.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 9.2
    ELSA-2026-87079 3 CVEs 2 exploited

    Important: php:8.3 security update (Oracle Linux 9)

    php [8.3.36-1] - rebase to 8.3.36 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 [5.1.21-1] - update to 5.1.21 for PHP 8.1 #2070040 php-pecl-redis6 [6.1.0-3] - use valkey for tests [6.1.0-2] - ignore 1 ONLINE test [6.1.0-1] - RHEL build [6…

  • High max 9.2
    ELSA-2026-87072 3 CVEs 2 exploited

    Important: php:8.2 security update (Oracle Linux 9)

    php [8.2.35-1] - rebase to 8.2.35 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd [2.0.3-4] - build for PHP 8.1 #2070040 [2.0.3-3] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 [2.0.3-2] - Rebuilt for …

  • High max 8.2
    ELSA-2026-88247 2 CVEs

    Important: expat security update (Oracle Linux 9)

    [2.5.0-6.7] - CVE-2026-102633 expat: expat: Denial of Service via integer overflow in expat_realloc - Resolves: RHEL-272833 [2.5.0-6.6] - CVE-2026-77214 expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer over-read in XML_ParseBu…

  • High max 9.8
    ELSA-2026-88229 11 CVEs

    Important: httpd security update (Oracle Linux 9)

    [2.4.62-13.0.1.el9_8.9] - Replace index.html with Oracle's index page oracle_index.html. [2.4.62-13.9] - Related: RHEL-275261 - httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292) - Resolves: RHEL-280369 - httpd: Deni…

  • High max 8.2
    ELSA-2026-88248 2 CVEs

    Important: expat security update (Oracle Linux 10)

    [2.7.3-63] - CVE-2026-102633 expat: expat: Denial of Service via integer overflow in expat_realloc [2.7.3-62] - CVE-2026-77214 expat: expat: Information disclosure via heap buffer over- read in XML_ParseBuffer [2.7.3-61] - CVE-2026-66046 expat: Expat: Denial …

  • High max 10.0
    ELSA-2026-88202 1 CVE

    Important: podman security update (Oracle Linux 10)

    [5.8.2-10.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-10] - update to the latest upstream commit bd9083e0 - Resolves: RHEL-271981

  • High max 7.5
    ELSA-2026-88207 1 CVE

    Important: iperf3 security update (Oracle Linux 10)

    [3.17.1-6.2] - DoS via UDP receive worker infinite loop (CVE-2026-102253) - Resolves: RHEL-273152

  • High max 7.5
    ELSA-2026-88336 3 CVEs

    Important: podman security update (Oracle Linux 10)

    [5.8.2-11.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-11] - Rebuild for CVE-2026-111943 - Resolves: RHEL-287477

  • High max 7.5
    ELSA-2026-88316 3 CVEs

    Important: grafana-pcp security update (Oracle Linux 10)

    [5.3.0-8.2] - Rebuilt against updated golang - Resolves RHEL-287474, RHEL-279348, RHEL-278699

  • High max 8.8
    ELSA-2026-88359 1 CVE

    Important: postgresql16-pgvector security update (Oracle Linux 10)

    [0.8.7-1] - CVE-2026-103484 postgresql16-pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build execution via out-of-bounds write during IVFFlat index build - Resolves: RHEL-282041

  • High max 8.8
    ELSA-2026-88360 1 CVE

    Important: postgresql18-pgvector security update (Oracle Linux 10)

    [0.8.7-0.1] - CVE-2026-103484 postgresql18-pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build execution via out-of-bounds write during IVFFlat index build - Resolves: RHEL-282040

  • High max 7.8
    ELSA-2026-86842 1 CVE

    Important: librsvg2 security update (Oracle Linux 8)

    [2.42.7-6] - CVE-2026-96889 librsvg2: Use-after-free when XML includes have duplicated entities duplicated entities - Resolves: RHEL-267981

  • High max 8.5
    ELSA-2026-86907 8 CVEs

    Important: xorg-x11-server-Xwayland security update (Oracle Linux 8)

    [21.1.3-20.4] - CVE fix for: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516 CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93523, CVE-2026-93524 Resolves: https://redhat.atlassian.net/browse/RHEL-277856 Resolves: http…

  • High max 9.2
    ELSA-2026-87080 12 CVEs 2 exploited

    Important: php:7.4 security update (Oracle Linux 8)

    libzip [1.6.1-1] - update to 1.6.1 - enable lzma support [1.5.2-1] - update to 1.5.2 - add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available [1.5.1-1] - update to 1.5.1 - drop dependency on zlib-devel and…

  • High max 7.5
    ELSA-2026-86203 4 CVEs

    Important: go-toolset:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

    delve [1.26.1-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.26.1-1] - Update to Delve 1.26.1 - Related: RHEL-183712 [1.25.2-1] - Update to Delve 1.25.2 (Sync from CentOS Stream 9) - Related: RHEL-121223 [1.24.1-1] - Rebase to 1.24.1 …

  • High max 7.5
    ELSA-2026-86196 4 CVEs

    Important: golang security, bug fix, and enhancement update (Oracle Linux 9)

    [1.26.10-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.10-1] - Update to Go 1.26.10 (fips-1) - Resolves: RHEL-287192

  • High max 9.2
    ELSA-2026-87151 3 CVEs 2 exploited

    Important: php security update (Oracle Linux 9)

    [8.0.30-8.1] - Fix FILTER_SANITIZE_ENCODED does not encode 0xFF - Fix IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison CVE-2026-91768 - Fix Various packet overreads in mysqlnd wire protocol CVE-2025-1218 - Fix TLS hostname v…

  • High max 7.1
    ELSA-2026-87082 2 CVEs

    Important: qt5-qtbase security update (Oracle Linux 9)

    [5.15.9-11.2] - Fix CVE-2026-19248: unbounded recursion and O(N2) behavior in QDom Resolves: RHEL-261136 - Fix CVE-2026-11573: denial of services via uncontrolled recursion in XML serialization Resolves: RHEL-277670

  • High max 8.2
    ELSA-2026-604898 38 CVEs

    Important: python-oci-sdk security update (Oracle Linux 9)

    [2.187.0-1.0.5] - Fix multiple CVEs in pyjwt, aiohttp, pyOpenSSL, multidict

  • High max 8.4
    ELSA-2026-86983 5 CVEs

    Important: openexr security update (Oracle Linux 9)

    [3.1.1-3.5] - fix CVE-2026-59982 - fix CVE-2026-59184 - fix CVE-2026-59189 - fix CVE-2026-59981 - fix CVE-2026-34544

  • High max 7.8
    ELSA-2026-86921 1 CVE

    Important: librsvg2 security update (Oracle Linux 9)

    [2.50.7-3.1] - CVE-2026-96889 librsvg2: Use-after-free when XML includes have duplicated entities entities

  • High max 9.2
    ELSA-2026-87070 3 CVEs 2 exploited

    Important: php security update (Oracle Linux 10)

    [8.3.36-1] - rebase to 8.3.36 [8.3.35-1] - rebase to 8.3.35

  • High max 9.2
    ELSA-2026-87071 3 CVEs 2 exploited

    Important: php8.4 security update (Oracle Linux 10)

    [8.4.27-1] - rebase to 8.4.27

  • High max 7.5
    ELSA-2026-86093 4 CVEs

    Important: golang security, bug fix, and enhancement update (Oracle Linux 10)

    [1.26.10-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.10-1] - Update to Go 1.26.10 (fips-1)

  • High max 7.8
    ELSA-2026-86841 1 CVE

    Important: librsvg2 security update (Oracle Linux 10)

    [2.57.1-10] - CVE-2026-96889 librsvg2: Use-after-free when XML includes have duplicated entities

  • High max 7.8
    ELSA-2026-84744 4 CVEs

    Important: gimp:2.8 security update (Oracle Linux 8)

    gimp [2:2.8.22-26.9] - fix CVE-2026-90947 - fix CVE-2026-90948 - fix CVE-2026-92248 - fix CVE-2026-97185 [2:2.8.22-26.8] - fix CVE-2026-59090 - fix CVE-2026-18301 - fix CVE-2026-18303 - fix CVE-2026-18305 - fix CVE-2026-18306 - fix CVE-2026-66758 - fix CVE-20…

  • High max 9.2
    ELSA-2026-85239 3 CVEs

    Important: python3 security update (Oracle Linux 8)

    [3.6.8-79.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8.openela.0] - Add openela to supported dists [3.6.8-79] - Security fixes for CVE-2026-12345, CVE-2026-19445, CVE-2026-19553 Resolves: RHEL-272935, RHEL-276260, RHEL-274107