Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,089 results · Clear filters · Feed

  • High max 10.0
    ELSA-2025-20480 1345 CVEs 3 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-101.33.4.3.el10uek] - Revert 'Add normal counters' (Boris Ostrovsky) [Orabug: 38171405] [6.12.0-101.33.4.2.el10uek] - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) [Orabug: 38178286] {CVE-2025-38089} - mm: memcontro…

  • High max 9.8
    ELSA-2025-11333 2 CVEs

    Important: tomcat security update (Oracle Linux 8)

    [1:9.0.87-1.el8_10.4] - Resolves: RHEL-91761 tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650) - Resolves: RHEL-71971 tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337)

  • High max 9.8
    ELSA-2025-11335 2 CVEs

    Important: tomcat security update (Oracle Linux 9)

    [1:9.0.87-3.el9_6.1] - Resolves: RHEL-91765 tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650) - Resolves: RHEL-71981 tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337) [1:9.0.87-3] - R…

  • High max 8.6
    ELSA-2025-10867 4 CVEs

    Important: java-17-openjdk security update (Oracle Linux 8)

    [1:17.0.16.0.8-2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:17.0.16.0.8-2] - Update to jdk-17.0.16+8 - Add to .gitignore openjdk-17.0.16+8.tar.xz - Set updatever to 16 - Set buildver to 8 - Update sources to openjdk-17.0.16+8.tar.xz - Resolves: RH…

  • High max 7.8
    ELSA-2025-10854 1 CVE

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-55.21.1.0.1_0.OL10] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyon…

  • High max 9.8
    ELSA-2025-10181 4 CVEs

    Important: firefox security update (Oracle Linux 7)

    [128.12.0-1.0.1] - Update to 128.12.0 [Orabug: 38141310][CVE-2025-6424][CVE-2025-6425] [CVE-2025-6429][CVE-2025-6430]

  • High max 9.8
    ELSA-2025-20471 56 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.345.5.3] - x86/bpf: Classic BPF program can fail when BHB barrier is used (Alexandre Chartre) [Orabug: 38167806] [5.4.17-2136.345.5.2] - Add Zen34 clients (Borislav Petkov (AMD)) [Orabug: 38023241] {CVE-2024-36350} {CVE-2024-36357} - x86/process:…

  • High max 8.8
    ELSA-2025-10848 1 CVE

    Important: cloud-init security update (Oracle Linux 9)

    [24.4-4.0.1.el9_6.3] - Fix Oracle Datasource network and getdata methods for OCI OL [Orabug: 35950168] - Fix log file permission [Orabug: 35302969] - Update detection logic for OL distros in config template [Orabug: 34845400] - Added missing services in rhel/…

  • High max 9.8
    ELSA-2025-20470 148 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-310.184.5.2] - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (Jeff Layton) {CVE-2025-38089} - net_sched: sch_sfq: move the limit validation (Octavian Purdila) {CVE-2025-37752} - net_sched: sch_sfq: use a temporary work area for v…

  • High max 8.8
    ELSA-2025-10844 1 CVE

    Important: cloud-init security update (Oracle Linux 10)

    [24.4-3.0.1.2] - NetworkManagerActivator brings up interface failed when using sysconfig renderer [RHEL-18981] - Include module cc_write_files_deferred in config template [Orabug: 36959464] - Fix Oracle Datasource network, getdata methods and increase retries…

  • High max 8.8
    ELSA-2025-9741 1 CVE

    Important: perl-File-Find-Rule security update (Oracle Linux 7)

    [0.33-5.0.1] - Use 3 arg open in grep() [Orabug: 38120380][CVE-2011-10007]

  • High max 8.8
    ELSA-2025-10669 3 CVEs

    Important: kernel security update (Oracle Linux 8)

    - [4.18.0-553.60.1_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.…

  • High max 9.1
    ELSA-2025-10698 3 CVEs

    Important: libxml2 security update (Oracle Linux 8)

    [2.9.7-21.1] - Fix CVE-2025-6021 (RHEL-96498) - Fix CVE-2025-49794 (RHEL-96398) - Fix CVE-2025-49796 (RHEL-96424) [2.9.7-21] - Fix integer overflow (RHEL-74345)

  • High max 9.1
    ELSA-2025-10699 3 CVEs

    Important: libxml2 security update (Oracle Linux 9)

    [2.9.13-10] - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431)

  • High max 5.4
    ELSA-2025-9331 1 CVE

    Important: libvpx security update (Oracle Linux 7)

    [1.3.0-8.0.1] - Fixes CVE-2025-5283 vpx_codec_enc_init_multi fix double free on init fail [Orabug: 38103810]

  • High
    ELSA-2025-9332 1 CVE

    Important: mpfr security update (Oracle Linux 7)

    [3.1.1-4.0.1] - Fixes buffer overflow in mpfr_strtofr (CVE-2014-9474) [Orabug: 38103811]

  • High max 8.8
    ELSA-2025-9740 1 CVE

    Important: perl-File-Find-Rule-Perl security update (Oracle Linux 7)

    [1.13-2.0.1] - Use 3 arg open in grep() [Orabug: 38120371][CVE-2011-10007]

  • High max 8.3
    ELSA-2025-10551 1 CVE

    Important: container-tools:ol8 security update (Oracle Linux 8)

    aardvark-dns buildah cockpit-podman conmon containernetworking-plugins containers-common container-selinux criu crun fuse-overlayfs libslirp netavark oci-seccomp-bpf-hook podman [4.9.4-22.0.1] - Fixes issue of container created in cgroupv2 not start in cgroup…

  • High max 8.3
    ELSA-2025-10550 1 CVE

    Important: podman security update (Oracle Linux 9)

    [5.4.0-12.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [5:5.4.0-12] - update to the latest content…

  • High max 8.3
    ELSA-2025-10549 1 CVE

    Important: podman security update (Oracle Linux 10)

    [6:5.4.0-12.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.4.0-12] - update to the latest conte…

  • High max 8.6
    ELSA-2025-10371 3 CVEs

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-55.20.1.0.1_0.OL10] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyon…

  • High max 9.1
    ELSA-2025-10630 4 CVEs

    Important: libxml2 security update (Oracle Linux 10)

    [2.12.5-7] - Refresh patches from upstream (RHEL-96395, RHEL-96408 and RHEL-96421) [2.12.5-6] - Fix CVE-2025-6021 (RHEL-96495) - Fix CVE-2025-49794 (RHEL-96395) - Fix CVE-2025-49795 (RHEL-96408) - Fix CVE-2025-49796 (RHEL-96421)

  • High max 9.1
    ELSA-2025-9189 1 CVE

    Important: ipa security update (Oracle Linux 7)

    [4.6.8-5.0.3.el7_9.17] - Fix privilege escalation from host to domain vulnerability - CVE-2025-4404 [Orabug: 38085890]

  • High max 8.6
    ELSA-2025-10379 5 CVEs

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-570.25.1.0.1_6.OL9] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 7.8
    ELSA-2025-7458 9 CVEs

    Important: xorg-x11-server-Xwayland security update (Oracle Linux 10)

    [24.1.5-4] - CVE fix for: CVE-2025-49175 (RHEL-97129), CVE-2025-49176 (RHEL-97135), CVE-2025-49177 (RHEL-97141), CVE-2025-49178 (RHEL-97147), CVE-2025-49179 (RHEL-97153), CVE-2025-49180 (RHEL-97159) [24.1.5-3] Rebuild for 10.0.z required due to issue when rel…

  • High max 9.8
    ELSA-2025-7501 1 CVE

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-55.19.1.0.1_0.OL10] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyon…

  • High max 7.8
    ELSA-2025-8137 2 CVEs 1 exploited

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-55.19.1.0.1_0.OL10] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyon…

  • High max 8.8
    ELSA-2025-8669 5 CVEs

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-55.19.1.0.1_0.OL10] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyon…

  • High max 9.8
    ELSA-2025-9079 8 CVEs

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-55.19.1.0.1_0.OL10] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyon…

  • High max 7.5
    ELSA-2025-8664 1 CVE

    Important: python-tornado security update (Oracle Linux 7)

    [4.2.1-5.0.1] - Fixed CVE-2025-47287 Raise errors instead of logging [Orabug: 38049949]

  • High max 7.8
    ELSA-2025-9501 3 CVEs

    Important: gimp security update (Oracle Linux 7)

    [2:2.8.22-1.0.3] - Fixes CVE-2025-5473 (GIMP ICO File Parsing Integer Overflow) [Orabug: 38110877] - Fixes CVE-2025-48797 (Multiple heap buffer overflows in TGA parser) - Fixes CVE-2025-48798 (Multiple use after free in XCF parser)

  • High max 9.0
    ELSA-2025-9179 7 CVEs

    Important: libsoup security update (Oracle Linux 7)

    [2.62.2-2.0.5] - Fixes CVE-2025-2784 CVE-2025-4948 CVE-2025-32049 [Orabug: 38085184] - CVE-2025-32906 CVE-2025-32911 CVE-2025-32913 CVE-2025-32914 [2.62.2-2.0.3] - Fixed CVE-2024-52531 buffer overflow via UTF-8 conversion in - soup_header_parse_param_list_str…

  • High max 6.5
    ELSA-2025-10246 1 CVE

    Important: thunderbird security update (Oracle Linux 8)

    [128.12.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [128.12.0] - Add OpenELA debranding [128.12.0-1] - Update to 128.12.0 build1

  • High max 9.4
    ELSA-2025-10148 5 CVEs

    Important: python3.11 security update (Oracle Linux 9)

    [3.11.11-2.1] - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435 - Resolves: RHEL-98045, RHEL-98015, RHEL-98238, RHEL-98177, RHEL-98206

  • High max 9.4
    ELSA-2025-10189 5 CVEs

    Important: python3.12 security update (Oracle Linux 9)

    [3.12.9-1.1] - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435 - Resolves: RHEL-98058, RHEL-98020, RHEL-97809, RHEL-98184, RHEL-98211

  • High max 6.5
    ELSA-2025-10196 1 CVE

    Important: thunderbird security update (Oracle Linux 9)

    [128.12.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [128.12.0] - Add OpenELA debranding [128.12.0-1] - Update to 128.12.0 build1

  • High max 7.5
    ELSA-2025-8319 1 CVE

    Important: pcs security update (Oracle Linux 10)

    [0.12.0-3.el10_0.2] - Rebased pcs to the latest sources (see CHANGELOG.md) Resolves: RHEL-7681, RHEL-21050, RHEL-22423, RHEL-35407, RHEL-44347, RHEL-63186, RHEL-66607, RHEL-76176, RHEL-81938 - Rebased HA Cluster Management add-on to the latest sources Resolve…

  • High max 6.5
    ELSA-2025-10195 1 CVE

    Important: thunderbird security update (Oracle Linux 10)

    [128.12.0-1.0.1] - Add Oracle prefs [128.12.0-1] - Update to 128.12.0 build1

  • High max 9.4
    ELSA-2025-10140 5 CVEs

    Important: python3.12 security update (Oracle Linux 10)

    [3.12.9-2.0.1.2] - Remove upstream URL reference [3.12.9-2.2] - Enable PAC and BTI protections for aarch64 - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435 - Resolves: RHEL-98058, RHEL-98020, RHEL-97809, RHEL-981…

  • High max 9.4
    ELSA-2025-10026 5 CVEs

    Important: python3.11 security update (Oracle Linux 8)

    [3.11.13-1.0.1] - Update rpm-macros description [Orabug: 36024572] [3.11.13-1] - Update to 3.11.13 - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435 Resolves: RHEL-98037, RHEL-98006, RHEL-98223, RHEL-98114, RHEL-9…