Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,089 results · Clear filters · Feed

  • High max 8.7
    ELSA-2025-7524 1 CVE

    Important: xz security update (Oracle Linux 10)

    [1:5.6.2-4] - Fix: heap-use-after-free bug in threaded .xz decoder (CVE-2025-31115) - Resolves: RHEL-86029

  • High max 7.8
    ELSA-2025-9178 3 CVEs

    Important: kea security update (Oracle Linux 10)

    [2.6.3-1] - New version 2.6.3 - Fix for: CVE-2025-32801, CVE-2025-32802, CVE-2025-32803 - kea.conf: Remove /tmp/ from socket-name for existing configurations - kea.conf: Set pseudo-random password for default config to secure fresh install and allow CA startu…

  • High max 7.8
    ELSA-2025-7496 2 CVEs

    Important: libxslt security update (Oracle Linux 10)

    [1.1.39-7] - Fix CVE-2024-55549 (RHEL-83503) - Fix CVE-2025-24855 (RHEL-83489)

  • High max 7.5
    ELSA-2025-8135 1 CVE

    Important: python-tornado security update (Oracle Linux 10)

    [6.4.2-1.el10_0.1] - httputil: Raise errors instead of logging in multipart/form-data parsing Resolves: RHEL-91992

  • High max 9.2
    ELSA-2025-7489 6 CVEs

    Important: php security update (Oracle Linux 10)

    [8.3.19-1] - rebase to 8.3.19

  • High max 8.4
    ELSA-2025-7500 1 CVE

    Important: perl security update (Oracle Linux 10)

    [4:5.40.2-512.1] - 5.40.2 bump (see <https://metacpan.org/release/SHAY/perl-5.40.2/view/pod/perldelta.pod>) - Resolves: RHEL-87186

  • High max 7.5
    ELSA-2025-7509 1 CVE

    Important: valkey security update (Oracle Linux 10)

    [8.0.3.1] - rebase to 8.0.3

  • High max 7.5
    ELSA-2025-8128 4 CVEs

    Important: libsoup3 security update (Oracle Linux 10)

    [3.6.5-3.el10_0.6] - Fix CVE-2025-4035, CVE-2025-4948, CVE-2025-32049, CVE-2025-32907 [3.6.5-3] - Add patch to hopefully fix http2-body-size-test timeouts [3.6.5-2] - Add patch to hopefully fix server-test timeouts [3.6.5-1] - Update to 3.6.5 and add patches …

  • High max 5.4
    ELSA-2025-8550 1 CVE

    Important: varnish security update (Oracle Linux 10)

    [7.6.1-2.el10_0.1] - Resolves: RHEL-89691 - varnish: request smuggling attacks (CVE-2025-47905)

  • High max 7.8
    ELSA-2025-9304 6 CVEs

    Important: xorg-x11-server-Xwayland security update (Oracle Linux 10)

    [24.1.5-4] - CVE fix for: CVE-2025-49175 (RHEL-97129), CVE-2025-49176 (RHEL-97135), CVE-2025-49177 (RHEL-97141), CVE-2025-49178 (RHEL-97147), CVE-2025-49179 (RHEL-97153), CVE-2025-49180 (RHEL-97159) [24.1.5-3] Rebuild for 10.0.z required due to issue when rel…

  • High
    ELSA-2025-20371 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 10)

    [6.12.0-100.28.2.el10uek] - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash (Omar Sandoval) - certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967533] - Revert 'block: sysfs option to change ioticks g…

  • High max 8.8
    ELSA-2025-9605 1 CVE

    Important: perl-File-Find-Rule security update (Oracle Linux 8)

    [0.34-9] - Use 3 arg open in grep() (CVE-2011-10007) - Package tests

  • High max 9.1
    ELSA-2025-9329 1 CVE

    Important: perl-YAML-LibYAML security update (Oracle Linux 8)

    [1:0.70-2] - Use 3-arg form of open in LoadFile (CVE-2025-40908)

  • High max 8.8
    ELSA-2025-9517 1 CVE

    Important: perl-File-Find-Rule security update (Oracle Linux 9)

    [0.34-19.1] - Use 3 arg open in grep() (CVE-2011-10007) - Package tests

  • High max 7.8
    ELSA-2025-9526 1 CVE

    Important: pam security update (Oracle Linux 9)

    [1.5.1-25.0.1] - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36406534] [1.5.1-25] - pam_namespace: fix potential privilege escalation. Resolves: CVE-2025-6020 and RHEL-96729

  • High max 5.3
    ELSA-2025-8625 1 CVE

    Important: perl-FCGI security update (Oracle Linux 7)

    [1:0.74-8.0.1] - Fix CVE-2025-40907 (integer overflow when parsing FastCGI parameters) [Orabug: 38047531]

  • High max 8.1
    ELSA-2025-9074 7 CVEs

    Important: firefox security update (Oracle Linux 7)

    [128.11.0-1.0.1] - Update to 128.11.0 [Orabug: 38077559][CVE-2025-5263][CVE-2025-5264] [CVE-2025-5266][CVE-2025-5267][CVE-2025-5268][CVE-2025-5269]

  • High max 7.8
    ELSA-2025-9305 5 CVEs

    Important: xorg-x11-server and xorg-x11-server-Xwayland security update (Oracle Linux 8)

    xorg-x11-server [1.20.11-26] - CVE fix for: CVE-2025-49175 (RHEL-97273), CVE-2025-49176 (RHEL-97329), CVE-2025-49178 (RHEL-97369), CVE-2025-49179 (RHEL-97422), CVE-2025-49180 (RHEL-97235) xorg-x11-server-Xwayland [21.1.3-18] - CVE fix for: CVE-2025-49175 (RHE…

  • High max 7.8
    ELSA-2025-9392 5 CVEs

    Important: tigervnc security update (Oracle Linux 8)

    [1.15.0-7] - Additional fix to CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension Resolves: RHEL-97294 [1.15.0-6] - Fix CVE-2025-49175: xorg-x11-server: Out-of-Bounds Read in X Rendering Extension Animated Cursors Resolves: RHEL-97268…

  • High max 7.0
    ELSA-2025-9327 1 CVE

    Important: libblockdev security update (Oracle Linux 9)

    [2.28-14.0.1] - enable btrfs support [Orabug: 30792917] [2.28-14] - Don't allow suid and dev set on fs resize (CVE-2025-6019) Resolves: RHEL-96038

  • High max 7.5
    ELSA-2025-9396 1 CVE

    Important: mod_auth_openidc security update (Oracle Linux 9)

    [2.4.10-1.el9_6.2] Resolves: RHEL-95948 - mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled (CVE-2025-3891)

  • High max 9.1
    ELSA-2025-9330 1 CVE

    Important: perl-YAML-LibYAML security update (Oracle Linux 9)

    [1:0.82-6.1] - Use 3-arg form of open in LoadFile (CVE-2025-40908)

  • High max 7.8
    ELSA-2025-9303 5 CVEs

    Important: xorg-x11-server and xorg-x11-server-Xwayland security update (Oracle Linux 9)

    xorg-x11-server [1.20.11-31] - CVE fix for: CVE-2025-49175 (RHEL-97289), CVE-2025-49176 (RHEL-97311), CVE-2025-49178 (RHEL-97388), CVE-2025-49179 (RHEL-97410), CVE-2025-49180 (RHEL-97255) [1.20.11-30] - xfree86: Fix potentially NULL reference to platform devi…

  • High max 7.8
    ELSA-2025-9306 5 CVEs

    Important: tigervnc security update (Oracle Linux 9)

    [1.14.1-8] - Additional fix to CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension Resolves: RHEL-97305 [1.14.1-7] - Fix CVE-2025-49175: xorg-x11-server: Out-of-Bounds Read in X Rendering Extension Animated Cursors Resolves: RHEL-97287…

  • High max 8.1
    ELSA-2025-3978 1 CVE

    Important: postgresql security update (Oracle Linux 7)

    [9.2.24-9.0.5] - Resolves CVE-2025-1094: Improper neutralization of quoting syntax in certain - libpq functions [Orabug: 37843176]

  • High max 5.3
    ELSA-2025-8696 1 CVE

    Important: perl-FCGI:0.78 security update (Oracle Linux 8)

    perl-FCGI [1:0.78-12] - Fix CVE-2025-40907 (integer overflow when parsing FastCGI parameters) perl-FCGI [1:0.78-12] - Fix CVE-2025-40907 (integer overflow when parsing FastCGI parameters) perl-FCGI [1:0.78-12] - Fix CVE-2025-40907 (integer overflow when parsi…

  • High max 9.1
    ELSA-2025-9188 1 CVE

    Important: idm:DL1 security update (Oracle Linux 8)

    bind-dyndb-ldap [11.6-6] - Fix rpminspect warnings Resolves: RHEL-22497 custodia ipa [4.9.13-18.0.1] - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674] [4.9.13-18] - Set krbCanonicalName admin@REALM on the admin user Resolves: RHEL-89895 [4.…

  • High max 8.8
    ELSA-2025-9114 1 CVE

    Important: apache-commons-beanutils security update (Oracle Linux 9)

    * Fri Jun 13 2025 Mikolaj Izdebski <mizdebsk@redhat.com> - Fix improper access control vulnerability - Resolves: CVE-2025-48734

  • High max 7.8
    ELSA-2025-7898 1 CVE

    Important: kernel security update (Oracle Linux 7)

    [3.10.0-1160.119.1.0.9.el7.OL7] - netfilter: ipset: add missing range check in bitmap_ip_uadt (Jeongjun Park) {CVE-2024-53141} [Orabug: 37964173] - Update OL SB certificates - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985797]

  • High max 7.8
    ELSA-2025-9165 3 CVEs

    Important: gimp:2.8 security update (Oracle Linux 8)

    gimp [2:2.8.22-26.2] - fix CVE-2025-5473 (RHEL-95696) [2:2.8.22-26.1] - fix CVE-2025-48797 (RHEL-93503) - fix CVE-2025-48798 (RHEL-93506) pygobject2 [2.28.7-5] - bump spec to fix NVR pygtk2 [2.24.0-25] - Fix shebang mangling for _prefix=app (#1907579) - disab…

  • High max 9.1
    ELSA-2025-9184 1 CVE

    Important: ipa security update (Oracle Linux 9)

    [4.12.2-14.0.1] - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674] - Add bind to ipa-server-common Requires [Orabug: 36518596] [4.12.2-14.1] - Resolves: RHEL-89908 EMBARGOED CVE-2025-4404 ipa: Privilege escalation from host to domain admin i…

  • High max 7.8
    ELSA-2025-9162 3 CVEs

    Important: gimp security update (Oracle Linux 9)

    [2:2.99.8-4.2] - fix CVE-2025-5473 (RHEL-95700) [2:2.99.8-4.1] - fix CVE-2025-48797 (RHEL-93521) - fix CVE-2025-48798 (RHEL-93522)

  • High max 9.8
    ELSA-2025-9080 7 CVEs

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-570.22.1.0.1_6.OL9] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 5.4
    ELSA-2025-9119 1 CVE

    Important: libvpx security update (Oracle Linux 8)

    [1.7.0-12] - Add patch for double free Resolves: RHEL-93914

  • High max 5.4
    ELSA-2025-9118 1 CVE

    Important: libvpx security update (Oracle Linux 9)

    [1.9.0-9] - Add patch for double free Resolves: RHEL-93908

  • High max 7.5
    ELSA-2025-8817 1 CVE

    Important: .NET 9.0 security update (Oracle Linux 9)

    [9.0.107-1.0.1] - Add support for Oracle Linux [9.0.107-1] - Update to .NET SDK 9.0.107 and Runtime 9.0.6 - Resolves: RHEL-94424

  • High max 7.5
    ELSA-2025-8844 1 CVE

    Important: mod_security security update (Oracle Linux 8)

    [2.9.6-2] - add fix for CVE-2025-47947 - Resolves: RHEL-93005

  • High max 7.5
    ELSA-2025-8514 1 CVE

    Important: nodejs:20 security update (Oracle Linux 8)

    nodejs [1:20.19.2-1] - Update to version 20.19.2 Fixes: CVE-2025-23166 Resolves: RHEL-91595 RHEL-89598 RHEL-92854 [1:20.19.1-1] - Update to version 20.19.1 Resolves: RHEL-78763 [1:20.18.2-4] - Update c-ares to 1.34.5 to address CVE-2025-31498 [1:20.18.2-3] - …

  • High max 7.5
    ELSA-2025-8812 1 CVE

    Important: .NET 8.0 security update (Oracle Linux 8)

    [8.0.117-1.0.1] - Add support for Oracle Linux [8.0.117-1] - Update to .NET SDK 8.0.117 and Runtime 8.0.17 - Resolves: RHEL-94415

  • High max 7.5
    ELSA-2025-8815 1 CVE

    Important: .NET 9.0 security update (Oracle Linux 8)

    [9.0.107-1.0.1] - Add support for Oracle Linux [9.0.107-1] - Update to .NET SDK 9.0.107 and Runtime 9.0.6 - Resolves: RHEL-94422