Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,089 results · Clear filters · Feed

High max 7.5

ELSA-2024-5390 3 CVEs

Important: bind9.16 security update (Oracle Linux 8)

[32:9.16.23-0.22] - Minor fix of reclimit test backport (CVE-2024-1737) [32:9.16.23-0.21] - Backport addition of max-records-per-type and max-records-per-type options (CVE-2024-1737) [32:9.16.23-0.20] - Resolve CVE-2024-1975 - Resolve CVE-2024-1737 - Resolve …

Aug 14, 2024
High max 9.8

ELSA-2024-5392 10 CVEs

Important: thunderbird security update (Oracle Linux 9)

[115.14.0-1.0.1] - Add Oracle prefs [115.14.0] - Add OpenELA debranding [115.14.0-1] - Update to 115.14.0 build1

Aug 14, 2024
High max 10.0

ELSA-2024-5363 46 CVEs 1 exploited

Important: kernel security update (Oracle Linux 9)

[5.14.0-427.31.1_4.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.…

Aug 14, 2024
High max 9.8

ELSA-2024-5193 1 CVE

Important: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-65.2.0.1] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-65.2] - Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend applications whose response headers are malicious or exploitable (CVE-2024-38476) - Res…

Aug 13, 2024
High max 8.3

ELSA-2024-5258 8 CVEs

Important: container-tools:ol8 security update (Oracle Linux 8)

aardvark-dns buildah [2:1.33.8-4] - rebuild for golang fixes - Related: RHEL-28452 cockpit-podman [84.1-1] - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/84.1 - Related: Jira:RHEL-25557 conmon [3:2.1.10-1] - update to https://githu…

Aug 13, 2024
High max 8.8

ELSA-2024-5279 1 CVE

Important: python3.11-setuptools security update (Oracle Linux 9)

[65.5.1-2.1] - Security fix for CVE-2024-6345 Resolves: RHEL-50490

Aug 13, 2024
High max 7.5

ELSA-2024-5231 3 CVEs

Important: bind and bind-dyndb-ldap security update (Oracle Linux 9)

bind [9.16.23-18.0.1.6] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-18.6] - Minor fix of reclimit test backport (CVE-2024-1737) [32:9.16.23-18.5] - Backport addition of max-records-per-type and max-records-per-type optio…

Aug 13, 2024
High max 9.8

ELSA-2024-5322 11 CVEs

Important: firefox security update (Oracle Linux 9)

[115.14.0-2.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [115.14.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [115.14.0-2] - Update to 115.14.0 build2 [115.14.0-1] - Update …

Aug 13, 2024
High max 8.8

ELSA-2024-12583 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.539.5] - Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (Jan Kara) - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36879158] {CVE-2024-41090} {CVE-2024-41091} [4.14.35-2047.539.4] - Fix parsin…

Aug 12, 2024
High max 10.0

ELSA-2024-12585 52 CVEs 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.334.6.el7] - loop: Fix a race between loop detach and loop open (Gulam Mohamed) [Orabug: 36197800] - x86/bhi: Do not enable unnecessary BHI mitigation in OCI and Exadata VMs (Alexandre Chartre) [Orabug: 36672495] - x86/bhi: Avoid warning in #DB h…

Aug 12, 2024
High max 10.0

ELSA-2024-12581 52 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.334.6] - loop: Fix a race between loop detach and loop open (Gulam Mohamed) [Orabug: 36197800] - x86/bhi: Do not enable unnecessary BHI mitigation in OCI and Exadata VMs (Alexandre Chartre) [Orabug: 36672495] - x86/bhi: Avoid warning in #DB handl…

Aug 12, 2024
High max 10.0

ELSA-2024-12584 52 CVEs 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

[5.4.17-2136.334.6.el8] - loop: Fix a race between loop detach and loop open (Gulam Mohamed) [Orabug: 36197800] - x86/bhi: Do not enable unnecessary BHI mitigation in OCI and Exadata VMs (Alexandre Chartre) [Orabug: 36672495] - x86/bhi: Avoid warning in #DB h…

Aug 12, 2024
High max 8.8

ELSA-2024-12582 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-209.161.7] - loop: Fix a race between loop detach and loop open (Gulam Mohamed) [Orabug: 36865975] [5.15.0-209.161.6] - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36879156] {CVE-2024-41090} {CVE-2024-41091} - x86/bhi: Do not en…

Aug 12, 2024
High max 9.8

ELSA-2024-5101 160 CVEs 1 exploited

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.16.1_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.ge…

Aug 8, 2024
High max 9.8

ELSA-2024-5138 1 CVE

Important: httpd security update (Oracle Linux 9)

[2.4.57-11.0.1.el9_4.1] - Replace index.html with Oracle's index page oracle_index.html. [2.4.57-11.1] - Resolves: RHEL-46047 - httpd: Security issues via backend applications whose response headers are malicious or exploitable (CVE-2024-38476) - Resolves: RH…

Aug 8, 2024
High max 8.8

ELSA-2024-12571 13 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.88.3] - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin) [Orabug: 36806710] {CVE-2023-52813} - usbnet: sanity check for maxpacket (Oliver Neukum) [Orabug: 36806658] {CVE-2021-47495} - phonet: fix rtm_phonet_notify() skb allocation (Eric …

Aug 5, 2024
High max 9.0

ELSA-2024-4936 1 CVE

Important: freeradius:3.0 security update (Oracle Linux 8)

[3.0.20-15] - Backport BlastRADIUS CVE fix Resolves: RHEL-46572

Jul 31, 2024
High max 9.0

ELSA-2024-4935 1 CVE

Important: freeradius security update (Oracle Linux 9)

[3.0.21-40] - Backport fixes for BlastRADIUS CVE Resolves: RHEL-46566

Jul 31, 2024
High max 7.5

ELSA-2024-4761 1 CVE

Important: containernetworking-plugins security update (Oracle Linux 9)

[1:1.4.0-4] - rebuild for CVE-2024-1394 - Resolves: RHEL-40809

Jul 24, 2024
High max 8.8

ELSA-2024-12549 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.87.2.2] - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36660755]

Jul 23, 2024
High max 8.8

ELSA-2024-12548 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.538.5.1] - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36660755]

Jul 23, 2024
High max 8.8

ELSA-2024-12551 2 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.333.5.1.el7] - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36660755] - pci: add hotplug patch support for SOLIDIGM Aura10 AIC 0x025e:0x0b60 (Alan Adamson) [Orabug: 36836653]

Jul 23, 2024
High max 9.1

ELSA-2024-4720 5 CVEs 1 exploited

Important: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-65.0.1.1] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-65.1] - Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue in mod_rewrite (CVE-2024-38474) - Resolves: RHEL-45785 - httpd:2.4/httpd: Encoding prob…

Jul 23, 2024
High max 8.8

ELSA-2024-12547 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.333.5.1] - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36660755] - pci: add hotplug patch support for SOLIDIGM Aura10 AIC 0x025e:0x0b60 (Alan Adamson) [Orabug: 36836653]

Jul 23, 2024
High max 8.8

ELSA-2024-12552 2 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

[5.4.17-2136.333.5.1.el8] - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36660755] - pci: add hotplug patch support for SOLIDIGM Aura10 AIC 0x025e:0x0b60 (Alan Adamson) [Orabug: 36836653]

Jul 23, 2024
High max 9.1

ELSA-2024-4726 5 CVEs 1 exploited

Important: httpd security update (Oracle Linux 9)

[2.4.57-11.0.1] - Replace index.html with Oracle's index page oracle_index.html. [2.4.57-11] - Resolves: RHEL-45792 - httpd: Encoding problem in mod_proxy (CVE-2024-38473) [2.4.57-9] - Resolves: RHEL-45766 - httpd: null pointer dereference in mod_proxy (CVE-2…

Jul 23, 2024
High max 7.5

ELSA-2024-4762 1 CVE

Important: runc security update (Oracle Linux 9)

[4:1.1.12-3] - rebuild for CVE-2024-1394 - Resolves: RHEL-24320

Jul 23, 2024
High max 8.8

ELSA-2024-12546 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-208.159.3.2] - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36660755]

Jul 23, 2024
High max 8.6

ELSA-2024-4617 1 CVE

Important: qt5-qtbase security update (Oracle Linux 8)

[5.15.3-8] - HTTP2: Delay any communication until encrypted() can be responded to Resolves: RHEL-46340

Jul 18, 2024
High max 8.1

ELSA-2024-4620 1 CVE

Important: libndp security update (Oracle Linux 8)

[1.7-7] - Validate route information option length

Jul 18, 2024
High max 7.5

ELSA-2024-4635 3 CVEs

Important: thunderbird security update (Oracle Linux 8)

[115.13.0-3.0.1] - Add Oracle prefs file [115.13.0] - Add OpenELA debranding [115.13.0-3] - Update to 115.13.0 build5 [115.13.0-2] - Update to 115.13.0 build3 [115.13.0-1] - Update to 115.13.0 build1

Jul 18, 2024
High max 8.6

ELSA-2024-4623 1 CVE

Important: qt5-qtbase security update (Oracle Linux 9)

[5.15.9-10] - HTTP2: Delay any communication until encrypted() can be responded to Resolves: RHEL-46348

Jul 18, 2024
High max 7.4

ELSA-2024-4568 5 CVEs

Important: java-17-openjdk security update (Oracle Linux 8)

[1:17.0.12.0.7-2.0.1] - Add Oracle vendor bug URL [1:17.0.12.0.7-2] - Update to jdk-17.0.12+7 (GA) - Update .gitignore to ignore openjdk-17.0.12+7.tar.xz - Sync java-17-openjdk-portable.specfile - Set buildver to 7 - Set portablerelease 1 - Set is_ga to 1 - U…

Jul 18, 2024
High max 7.5

ELSA-2024-4624 3 CVEs

Important: thunderbird security update (Oracle Linux 9)

[115.13.0-3.0.1] - Add Oracle prefs [115.13.0] - Add OpenELA debranding [115.13.0-3] - Update to 115.13.0 build5 [115.13.0-2] - Update to 115.13.0 build3 [115.13.0-1] - Update to 115.13.0 build1

Jul 18, 2024
High max 7.4

ELSA-2024-4573 5 CVEs

Important: java-21-openjdk security update (Oracle Linux 8)

[1:21.0.4.0.7-1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:21.0.4.0.7-1] - Update to jdk-21.0.4+7 (GA) - Update release notes to 21.0.4+7 - Switch to GA mode. - Sync the copy of the portable specfile with the latest update - Add missing section he…

Jul 18, 2024
High max 9.8

ELSA-2024-4583 17 CVEs

Important: kernel security update (Oracle Linux 9)

- [5.14.0-427.26.1_4.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_ke…

Jul 18, 2024
High max 7.4

ELSA-2024-4567 6 CVEs

Important: java-11-openjdk security update (Oracle Linux 8)

[11.0.24.0.8-2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:11.0.24.0.8-1] - Update to jdk-11.0.24+8 (GA) - Update release notes to 11.0.24+8 - Adjusted DTLS & RPATH NEWS entries to match OpenJDK 17 & 21 release notes - Switch to GA mode for release…

Jul 18, 2024
High max 8.1

ELSA-2024-4636 1 CVE

Important: libndp security update (Oracle Linux 9)

[1.8-6] - Validate route information option length [1.8-5] - Convert the license tag to SPDX format Related: RHELMISC-1363

Jul 18, 2024
High max 7.4

ELSA-2024-4563 6 CVEs

Important: java-1.8.0-openjdk security update (Oracle Linux 8)

[1.8.0.422.b05-2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:1.8.0.422.b05-1.1] - Update to shenandoah-jdk8u422-b05 (GA) - Update release notes for shenandoah-8u422-b05. - Rebase PR2462 patch following patched hunk being removed by JDK-8322106 - Sw…

Jul 18, 2024
High max 7.8

ELSA-2024-4420 1 CVE

Important: virt:ol and virt-devel:ol security update (Oracle Linux 8)

hivex libguestfs libguestfs-winsupport libiscsi libnbd libtpms libvirt libvirt-dbus libvirt-python nbdkit netcf perl-Sys-Virt qemu-kvm [6.2.0-50] - kvm-qcow2-Don-t-open-data_file-with-BDRV_O_NO_IO.patch [RHEL-35616] - kvm-iotests-244-Don-t-store-data-file-wit…

Jul 12, 2024