Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,082 results · Clear filters · Feed

High max 8.2

ELSA-2026-85968 2 CVEs

Important: openssl security update (Oracle Linux 8)

[1:1.1.1k-18] - Fix CVE-2026-63072: heap buffer overflow in CMS key unwrapping Resolves: RHEL-246295 - Fix CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset Resolves: RHEL-264420

Oct 20, 2026
High max 7.5

ELSA-2026-84798 2 CVEs

Important: pcs security update (Oracle Linux 8)

[0.10.18-2.0.1.el8_10.10] - Replaced HAM-logo [0.10.18-2.el8_10.10] - Fixed CVE-2026-82397, CVE-2024-14029 by patching bundled Tornado Resolves: RHEL-271884, RHEL-271929

Oct 20, 2026
High max 9.8

ELSA-2026-85773 9 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.176.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 20, 2026
High max 9.1

ELSA-2026-500449 3 CVEs

Important: ca-certificates security update (Oracle Linux 8)

[2025.2.80_v9.0.304-80.2.0.1] - eMudhra: add 'emSign Root TLS CA - G3' and 'Comodo AAA Services root' to blocklist

Oct 20, 2026
High max 8.8

ELSA-2026-85791 1 CVE

Important: postgresql:16 security update (Oracle Linux 9)

pgaudit [16.0-1] - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3635 pg_repack [1.5.1-1] - Update to v1.5.1 [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604 [1.4.8-1] - Res…

Oct 20, 2026
High max 8.8

ELSA-2026-85814 1 CVE

Important: postgresql:18 security update (Oracle Linux 9)

pgaudit [18.0-1] - Update to 18.0 - Initial import for postgresql18 pg_repack [1.5.3-1] - Update to 1.5.3 - Initial import for postgresql18 [1.5.1-1] - Update to v1.5.1 [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604…

Oct 20, 2026
High max 8.9

ELSA-2026-85929 2 CVEs

Important: python3.12-urllib3 security update (Oracle Linux 9)

[1.26.19-3.2] - CVE-2026-97689 python3.12-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282261 [1.26.19-3.1] - CVE-2026-97687 python3.12-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configurat…

Oct 20, 2026
High max 8.2

ELSA-2026-500448 1 CVE

Important: openssl security update (Oracle Linux 9)

[3.5.8-2.0.1_fips] - Replace upstream references in fips man pages [Orabug: 35824276] - Update additional upstream references - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824…

Oct 20, 2026
High max 9.8

ELSA-2026-86033 15 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.59.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Oct 20, 2026
High max 9.1

ELSA-2026-500450 3 CVEs

Important: ca-certificates security update (Oracle Linux 9)

[2025.2.80_v9.0.305-91.0.1] - eMudhra: add 'emSign Root TLS CA - G3' and 'Comodo AAA Services root' to blocklist

Oct 20, 2026
High max 8.9

ELSA-2026-85930 2 CVEs

Important: python-urllib3 security update (Oracle Linux 10)

[1.26.19-4.2] - CVE-2026-97689 python3.12-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282258 [1.26.19-4.1] - CVE-2026-97687 python3.12-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configurat…

Oct 20, 2026
High max 7.5

ELSA-2026-85848 2 CVEs

Important: rust-sequoia-sq security update (Oracle Linux 10)

[1.4.0.1-4.0.1] - Put 'Requires' openssl-libs in correct placeholder [Orabug: 38742109] - Hard require needed openssl-libs [Orabug: 38742109] [1.4.0.1-4] - Fix CVE-2026-93657 [1.4.0.1-3] - Fix CVE-2026-93599

Oct 20, 2026
High max 7.5

ELSA-2026-86056 2 CVEs

Important: lrzsz security, bug fix, and enhancement update (Oracle Linux 10)

[0.12.20-69] - Fix long-standing SIGSEGV bug when using the -s parameter without an argument (RHEL-282106) [0.12.20-68] - Backport tightened path handling from 0.13.1 (CVE-2026-105840) [0.12.20-67] - Remove 'Topipe' feature. (CVE-2026-105841)

Oct 20, 2026
High max 7.8

ELSA-2026-86331 1 CVE

Important: glycin-loaders security update (Oracle Linux 10)

[1.0.1-2] - Backport CVE-2026-96889 fix to vendored librsvg

Oct 20, 2026
High max 9.8

ELSA-2026-85321 17 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.67.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Oct 20, 2026
High max 9.1

ELSA-2026-500451 3 CVEs

Important: ca-certificates security update (Oracle Linux 10)

[2025.2.80_v9.0.305-102.0.1] - eMudhra: add 'emSign Root TLS CA - G3' and 'Comodo AAA Services root' to blocklist

Oct 20, 2026
High max 8.6

ELSA-2026-84586 4 CVEs

Important: libsoup security update (Oracle Linux 8)

[2.62.3-19] - CVE-2026-102557 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly [2.62.3-18] - CVE-2026-102558 libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth [2.62.3-17] - CVE-2026-102556 libsoup: libsoup…

Oct 19, 2026
High max 8.8

ELSA-2026-85306 1 CVE

Important: bubblewrap security update (Oracle Linux 8)

[0.4.0-3] - Security fix for CVE-2026-87766

Oct 19, 2026
High max 8.9

ELSA-2026-84577 2 CVEs

Important: python3.14-urllib3 security update (Oracle Linux 9)

[2.6.3-6] - Fix a regression with Python 3.14.8 [2.6.3-5] - Fix test_start_closed_socket with latest Python [2.6.3-4] - CVE-2026-97689 python3.14-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser [2.6.3-3] - CVE-2026-97687 py…

Oct 19, 2026
High max 8.5

ELSA-2026-84574 5 CVEs

Important: xorg-x11-server security update (Oracle Linux 9)

[1.20.11-34.5] - CVE fix for: CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520 Resolves: https://redhat.atlassian.net/browse/RHEL-282169 Resolves: https://redhat.atlassian.net/browse/RHEL-282173 Resolves: https://redhat.atlassian…

Oct 19, 2026
High max 7.5

ELSA-2026-85231 1 CVE

Important: jackson-databind security update (Oracle Linux 9)

[2.21.6-1.1] - Resolves: RHEL-276419 - Fix CVE-2026-91777

Oct 19, 2026
High max 7.8

ELSA-2026-85245 1 CVE

Important: emacs security update (Oracle Linux 9)

[1:27.2-18.el9_8.3] - Generalize trusted-content-p check to all Flymake backends (CVE-2026-96442) - Resolves: RHEL-265110

Oct 19, 2026
High max 8.5

ELSA-2026-85193 9 CVEs

Important: xorg-x11-server-Xwayland security update (Oracle Linux 9)

[24.1.9-4.4] - CVE fix for: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516 CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536 Resolves: https://redhat.atlassian.net/br…

Oct 19, 2026
High max 7.5

ELSA-2026-85234 2 CVEs

Important: resteasy security update (Oracle Linux 9)

[3.0.26-20.1] - Fix CVE-2026-89058: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config - Fix CVE-2026-89059: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) - Resolves: RHEL-278032 - Resolves: RHEL-277999

Oct 19, 2026
High max 8.8

ELSA-2026-85309 1 CVE

Important: bubblewrap security update (Oracle Linux 9)

[0.6.3-1.1] - Fix CVE-2026-87766 path traversal through symlinked mount targets - Use O_PATH for parent directory traversal during setup - Resolves: RHEL-256871

Oct 19, 2026
High max 8.9

ELSA-2026-84578 2 CVEs

Important: python3.14-urllib3 security update (Oracle Linux 10)

[2.6.3-6] - Fix a regression with Python 3.14.8 [2.6.3-5] - Fix test_start_closed_socket with latest Python [2.6.3-4] - CVE-2026-97689 python3.14-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser [2.6.3-3] - CVE-2026-97687 py…

Oct 19, 2026
High max 7.8

ELSA-2026-84591 3 CVEs

Important: emacs security update (Oracle Linux 10)

[1:29.4-16] - Generalize trusted-content-p check to all Flymake backends (CVE-2026-96442) [1:29.4-15] - tramp: restrict user name to prevent shell injection (CVE-2026-79992) [1:29.4-14] - image: fix integer overflow in pbm_load (CVE-2026-77219)

Oct 19, 2026
High max 8.1

ELSA-2026-84721 8 CVEs

Important: wireshark security update (Oracle Linux 10)

[4.4.2-10.0.1.el10_2.8] - Fix post script to not fail during initial installation [Orabug: 37565359] [1:4.4.2-10.8] - Fix Heap-based Buffer Overflow in Wireshark (CVE-2026-95389) - Resolves: RHEL-272823 [1:4.4.2-10.7] - Fix DoS via heap-based buffer overflow …

Oct 19, 2026
High max 7.1

ELSA-2026-84795 1 CVE

Important: librabbitmq security update (Oracle Linux 10)

[0.14.0-3.1] - CVE-2026-44236 librabbitmq: rabbitmq-c: Heap buffer overflow leading to denial of service [rhel-8.10.z] denial of service [rhel-8.10.z] Resolves: RHEL-266736

Oct 19, 2026
High max 8.5

ELSA-2026-85191 9 CVEs

Important: xorg-x11-server-Xwayland security update (Oracle Linux 10)

[24.1.9-4.4] - CVE fix for: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516 CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536 Resolves: https://redhat.atlassian.net/br…

Oct 19, 2026
High max 8.8

ELSA-2026-85308 1 CVE

Important: bubblewrap security update (Oracle Linux 10)

[0.10.0-5] - Fix CVE-2026-87766: harden sandbox mount paths [0.10.0-4] - Add tmt plans

Oct 19, 2026
High max 8.4

ELSA-2026-84796 5 CVEs

Important: openexr security update (Oracle Linux 10)

[3.1.10-8.5] - fix CVE-2026-59982 - fix CVE-2026-59184 - fix CVE-2026-59189 - fix CVE-2026-59981 - fix CVE-2026-34544

Oct 19, 2026
High max 8.2

ELSA-2026-84799 3 CVEs

Important: mariadb11.8 security update (Oracle Linux 10)

[3:11.8.8-2] - Release bump for pcre2 CVE fixes - Resolves: CVE-2026-103111, CVE-2026-86145, CVE-2026-89161

Oct 19, 2026
High max 9.8

ELSA-2026-500397 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.360.3.1] - ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40167664] {CVE-2026-98432} - ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40167666] {CVE-2026-99999} - netfilt…

Oct 16, 2026
High max 9.8

ELSA-2026-500398 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-325.221.6.4] - ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40167661] {CVE-2026-98432} - ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40167656] {CVE-2026-99999} - netfilte…

Oct 16, 2026
High max 9.8

ELSA-2026-500399 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-207.111.5.4] - ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40167669] {CVE-2026-98432} - ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40167684] {CVE-2026-99999}

Oct 16, 2026
High max 7.5

ELSA-2026-83525 2 CVEs

Important: lrzsz security, bug fix, and enhancement update (Oracle Linux 8)

[0.12.20-46] - Fix long-standing SIGSEGV bug when using the -s parameter without an argument (RHEL-282148) [0.12.20-45] - Backport tightened path handling from 0.13.1 (CVE-2026-105840) [0.12.20-44] - Remove 'Topipe' feature. (CVE-2026-105841)

Oct 15, 2026
High max 8.8

ELSA-2026-83544 1 CVE

Important: grafana security update (Oracle Linux 8)

[9.2.10-35.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-35] - CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION - Resolves RHEL-253157 [9.2.10-34] -…

Oct 15, 2026
High max 7.5

ELSA-2026-83563 1 CVE

Important: rpcbind security update (Oracle Linux 8)

[1.2.5-11] - CVE-2026-94640 rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service statistics tracking allows unauthenticated remote denial of service Resolves: RHEL-266668

Oct 15, 2026
High max 7.8

ELSA-2026-83552 2 CVEs

Important: ghostscript security update (Oracle Linux 8)

[9.27-19] - CVE-2026-101258 ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free via Type 5 shading OOB write and procedure-stream use-after-free - CVE-2026-103226 ghostscript: ghostscript: stack-ba…

Oct 15, 2026