Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,089 results · Clear filters · Feed

High max 4.7

ELSA-2024-12377 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.331.7] - Revert 'tracing/trigger: Fix to return error if failed to alloc snapshot' (Siddh Raman Pant) - Revert 'selftests: mm: fix map_hugetlb failure on 64K page size systems' (Harshit Mogalapalli) [Orabug: 36584568] - Revert 'net/mlx5: Enable S…

May 13, 2024
High max 8.2

ELSA-2024-2780 5 CVEs

Important: nodejs:18 security update (Oracle Linux 8)

nodejs [1:18.20.2-1] - Removes .ps1 files - Rebase to 18.20.2 - Fixes: CVE-2024-27983, CVE-2024-28182, CVE-2024-27982, CVE-2024-25629 nodejs-nodemon nodejs-packaging

May 10, 2024
High max 8.2

ELSA-2024-2778 5 CVEs

Important: nodejs:20 security update (Oracle Linux 8)

nodejs [1:20.12.2-2] - Backport nghttp2 patch for CVE-2024-28182 [1:20.12.2-1] - Rebase to version 20.12.0 Fixes: CVE-2024-27983 CVE-2024-27982 CVE-2024-22025 (node) Fixes: CVE-2024-25629 (c-ares) nodejs-nodemon nodejs-packaging

May 9, 2024
High max 7.5

ELSA-2024-2699 1 CVE

Important: git-lfs security update (Oracle Linux 8)

[3.2.0-3] - Rebuild with new Golang - Resolves: RHEL-32542

May 8, 2024
High max 7.3

ELSA-2024-2722 1 CVE

Important: glibc security update (Oracle Linux 8)

[2.28-236.0.1.13] - Forward port of Oracle patches. Reviewed-by: Jose E. Marchesi

May 8, 2024
High max 8.8

ELSA-2024-2566 1 CVE

Important: pcp security, bug fix, and enhancement update (Oracle Linux 9)

[6.2.0-2.0.1] - Fixed libpcp derived metric issue for ol9 [Orabug: 36538820] [6.2.0-2] - Disable RESP proxying by default in pmproxy (RHEL-30719)

May 8, 2024
High max 7.0

ELSA-2024-12354 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.85.1] - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (Zheng Wang) [Orabug: 35282809] {CVE-2023-1989}

May 7, 2024
High max 7.5

ELSA-2024-2724 4 CVEs

Important: git-lfs security update (Oracle Linux 9)

[3.4.1-2] - Rebuild with new Golang - Resolves: RHEL-32570, RHEL-28385, RHEL-28402, RHEL-28432

May 7, 2024
High max 7.8

ELSA-2024-2616 3 CVEs

Important: tigervnc security update (Oracle Linux 9)

[1.13.1-8.3] - Rebuild (z-stream target) Resolves: RHEL-30985 Resolves: RHEL-31015 [1.13.1-8.2] - Fix crash caused by fix for CVE-2024-31083 Resolves: RHEL-30985 [1.13.1-8.1] - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in…

May 7, 2024
High max 7.5

ELSA-2024-2551 6 CVEs

Important: bind security update (Oracle Linux 9)

bind [9.16.23-18.0.1] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-18.1] - Rebuild with correct z-stream tag again [32:9.16.23-18] - Prevent crashing at masterformat system test (CVE-2023-6516) [32:9.16.23-17] - Import te…

May 7, 2024
High max 7.5

ELSA-2024-2569 1 CVE

Important: grafana-pcp security update (Oracle Linux 9)

[5.1.1-2] - fix CVE-2024-1394

May 7, 2024
High max 7.5

ELSA-2024-2562 7 CVEs

Important: golang security update (Oracle Linux 9)

[1.21.9-2] - Rebuilt for z-stream - Related: RHEL-24312 - Related: RHEL-28940 [1.21.9-1] - Fix CVE-2024-1394 - Fix CVE-2023-45288 - Resolves RHEL-24312 - Resolves RHEL-28940

May 7, 2024
High max 8.3

ELSA-2024-2264 8 CVEs

Important: edk2 security update (Oracle Linux 9)

[20231122-6.0.1] - Replace upstream references [Orabug:36569119] [20231122-6] - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853] - edk2-NetworkPkg-Add-Unit-tests-to-…

May 3, 2024
High max 7.0

ELSA-2024-2298 2 CVEs

Important: tigervnc security update (Oracle Linux 9)

[1.13.1-8] - Fix copy/paste error in the DeviceStateNotify Resolves: RHEL-20533 [1.13.1-7] - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice Resolves: RHEL-20389 - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer o…

May 2, 2024
High

ELSA-2024-2199 1 CVE

Important: pmix security update (Oracle Linux 9)

[3.2.3-5] - Add pmix_test - Resolves: RHEL-3693 [3.2.3-4] - Fix CVE-2023-41915 - Resolves: RHEL-3693

May 2, 2024
High max 9.8

ELSA-2024-2126 10 CVEs

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.42.5-1] - Update to 2.42.5 Resolves: RHEL-3960 [2.42.4-1] - Update to 2.42.4 Resolves: RHEL-3960 Resolves: RHEL-19366 [2.42.3-1] - Update to 2.42.3 Resolves: RHEL-3960 [2.42.2-1] - Update to 2.42.2 Resolves: RHEL-3960 [2.42.1-1] - Update to 2.42.1 Resolves…

May 2, 2024
High max 9.8

ELSA-2024-2394 57 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-427.13.1_4.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.…

May 2, 2024
High max 8.3

ELSA-2024-1959 6 CVEs

Important: shim security update (Oracle Linux 7)

shim [- 15.8-2.0.3.el7] - Set shim.ol sbat generation to 3 [Orabug: 36271343] [- 15.8-2.0.1.el7] - Set SBAT_AUTOMATIC_DATE to 2021030218 [Orabug: 36271343] - Rebuild with Oracle certificates [Orabug: 36271343] - Full list of fixed CVEs: CVE-2023-40546, CVE-20…

May 1, 2024
High max 7.8

ELSA-2024-2080 3 CVEs

Important: tigervnc security update (Oracle Linux 7)

[1.8.0-33.0.1] - Dropped xorg-CVE-2023-5367.patch, xorg-CVE-2023-6816.patch, xorg-CVE-2023-6377.patch, xorg-CVE-2023-6478.patch, xorg-CVE-2024-0229-1.patch, xorg-CVE-2024-0229-2.patch, xorg-CVE-2024-0229-3.patch, xorg-CVE-2024-21885.patch, xorg-CVE-2024-21886…

Apr 29, 2024
High max 8.6

ELSA-2024-2084 1 CVE

Important: container-tools:4.0 security update (Oracle Linux 8)

buildah [1.24.7-1] - bump to v1.24.7 - Resolves: RHEL-26767 cockpit-podman conmon containernetworking-plugins containers-common container-selinux criu crun fuse-overlayfs libslirp oci-seccomp-bpf-hook podman python-podman runc [1.1.12-1.0.1] - rebuild with go…

Apr 29, 2024
High max 8.6

ELSA-2024-2098 1 CVE

Important: container-tools:ol8 security and bug fix update (Oracle Linux 8)

aardvark-dns buildah [1:1.31.5-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.31 (https://github.com/containers/buildah/commit/5fd539c) - Resolves: RHEL-26772 [1:1.31.3-3] - Make the module buildable again - Resolves…

Apr 29, 2024
High max 7.5

ELSA-2024-12348 2 CVEs

Important: cri-o security update (Oracle Linux 8)

cri-o [1.26.4-2] - Address CVE-2024-24786 cri-tools [1.26.1-5] - Address CVE-2024-24786 etcd [3.5.10-3] - Address protobuf [CVE-2024-24786] [3.5.10-1] - Added Oracle specific build files istio [1.17.8-3] - Address protobuf [CVE-2024-24786] - Backport from 1.1…

Apr 26, 2024
High max 7.5

ELSA-2024-12347 2 CVEs

Important: cri-o security update (Oracle Linux 9)

cri-o [1.26.4-2] - Address CVE-2024-24786 cri-tools [1.26.1-5] - Address CVE-2024-24786 etcd [3.5.10-3] - Address protobuf [CVE-2024-24786] [3.5.10-1] - Added Oracle specific build files istio [1.17.8-3] - Address protobuf [CVE-2024-24786] - Backport from 1.1…

Apr 26, 2024
High max 8.3

ELSA-2024-1902 6 CVEs

Important: shim security update (Oracle Linux 8)

[15.8-4.0.1] - Add support for Oracle signed shim [Orabug: 36540084] - Add shim binaries signed with Oracle Secure Boot Signing (key 1) [Orabug: 36540084] [15.8-1.0.3] - Update shimx64.efi, shimia32.efi and shimaa64.efi v15.8 signed by Microsoft [Orabug: 3607…

Apr 25, 2024
High max 8.6

ELSA-2024-2055 1 CVE

Important: buildah security update (Oracle Linux 9)

[1.31.5-1.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [1:1.31.5-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.31 (https://github.com/containers/buildah/commit/5fd539c) - Res…

Apr 25, 2024
High max 7.8

ELSA-2024-2037 3 CVEs

Important: tigervnc security update (Oracle Linux 8)

[1.13.1-2.10] - Fix crash caused by fix for CVE-2024-31083 Resolves: RHEL-30981 [1.13.1-2.9] - Rebuild (z-stream target) Resolves: RHEL-31011 Resolves: RHEL-30981 Resolves: RHEL-30998 [1.13.1-2.8] - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer ov…

Apr 24, 2024
High max 7.8

ELSA-2024-2004 5 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1160.118.1.0.1] - debug: lock down kgdb [Orabug: 34270798] {CVE-2022-21499} [3.10.0-1160.118.1] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@…

Apr 23, 2024
High max 7.5

ELSA-2024-1962 1 CVE

Important: go-toolset:ol8 security update (Oracle Linux 8)

delve golang [1.20.12-8] - Update sources file - Related: RHEL-27928 [1.20.12-7] - Fix CVE-2024-1394 - Resolves: RHEL-27928 [1.20.12-6] - Fix CVE-2023-45288 - Resolves: RHEL-31914 go-toolset

Apr 23, 2024
High max 7.5

ELSA-2024-1963 1 CVE

Important: golang security update (Oracle Linux 9)

[1.20.12-4] - Rebuild for z-stream - Related: RHEL-28939 [1.20.12-3] - Fix CVE-2023-45288 - Resolves: RHEL-28939 - Temporarily disable FIPS tests (RHELBLD-14822)

Apr 23, 2024
High max 8.3

ELSA-2024-1903 6 CVEs

Important: shim bug fix update (Oracle Linux 9)

[15.8-1.0.3] - Update shimx64.efi and shimaa64.efi v15.8 signed by Microsoft [Orabug: 36072879] - Update shim fb and mm binaries to match unsigned releases [Orabug: 36072879] [15.8-1.0.2] - Use binaries with correct shim.ol generation [Orabug: 36072879] - Set…

Apr 22, 2024
High max 8.8

ELSA-2024-1912 7 CVEs

Important: firefox security update (Oracle Linux 8)

[115.10.0-1.0.1] - Change default prefs file to Oracle version [115.10.0-1] - Update to 115.10.0 build1

Apr 19, 2024
High max 8.8

ELSA-2024-1908 7 CVEs

Important: firefox security update (Oracle Linux 9)

[115.10.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [115.10.0-1] - Update to 115.10.0 build1

Apr 19, 2024
High max 8.8

ELSA-2024-1910 7 CVEs

Important: firefox security update (Oracle Linux 7)

[115.10.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [115.10.0-1] - Update to 115.10.0 build1

Apr 18, 2024
High max 7.5

ELSA-2024-1872 1 CVE

Important: mod_http2 security update (Oracle Linux 9)

[1.15.19-5.1] - Resolves: RHEL-29826 - mod_http2: httpd: CONTINUATION frames DoS (CVE-2024-27316)

Apr 18, 2024
High max 7.5

ELSA-2024-12329 2 CVEs

Important: cri-o security update (Oracle Linux 7)

cri-o [1.25.5-2] - Address CVE-2024-24786 cri-tools [1.25.0-4] - Address CVE-2024-24786 etcd [3.5.9-4] - Address protobuf [CVE-2024-24786] [3.5.9-3] - Address CVE-2023-39326 by upgrading golang to version 1.20.12 istio [1.16.7-4] - Address protobuf [CVE-2024-…

Apr 16, 2024
High max 7.5

ELSA-2024-12328 2 CVEs

Important: cri-o security update (Oracle Linux 8)

cri-o [1.25.5-2] - Address CVE-2024-24786 cri-tools [1.25.0-4] - Address CVE-2024-24786 etcd [3.5.9-4] - Address protobuf [CVE-2024-24786] [3.5.9-3] - Address CVE-2023-39326 by upgrading golang to version 1.20.12 istio [1.16.7-4] - Address protobuf [CVE-2024-…

Apr 16, 2024
High max 7.8

ELSA-2024-1785 3 CVEs

Important: X.Org server security update (Oracle Linux 7)

[1.20.4-29] - Fix regression caused by the fix for CVE-2024-31083 [1.20.4-28] - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and CVE-2024-31083 Resolves: https://issues.redhat.com/browse/RHEL-31003 Resolves: https://issues.redhat.com/browse/RHE…

Apr 11, 2024
High max 8.6

ELSA-2024-1787 6 CVEs

Important: squid security update (Oracle Linux 7)

[7:3.5.20-17.0.1] - Mutiple CVE fixes for squid [Orabug: 33146289] - Resolves: CVE-2021-28651 squid: Bug 5104: Memory leak in RFC 2169 response parsing (#778) - Resolves: CVE-2021-28652 squid: Bug 5106: Broken cache manager URL parsing (#788) - Resolves: CVE-…

Apr 11, 2024
High max 8.0

ELSA-2024-1751 1 CVE

Important: unbound security update (Oracle Linux 8)

[1.16.2-5.6] - Rebuilt again with z-stream target [1.16.2-5.5] - Correct typo in new config file [1.16.2-5.4] - Ensure group access correction reaches also updated configs (CVE-2024-1488) [1.16.2-5.3] - Ensure only unbound group can change configuration (CVE-…

Apr 11, 2024
High max 7.5

ELSA-2024-1781 6 CVEs

Important: bind9.16 security update (Oracle Linux 8)

[32:9.16.23-0.16.2] - Prevent crashing at masterformat system test (CVE-2023-6516) [32:9.16.23-0.16.1] - Prevent increased CPU load on large DNS messages (CVE-2023-4408) - Prevent assertion failure when nxdomain-redirect is used with RFC 1918 reverse zones (C…

Apr 11, 2024