Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,082 results · Clear filters · Feed

High

ELSA-2026-81518 0 CVEs

Important: gd security update (Oracle Linux 10)

[2.3.3-20.1] - Fix LZW decompression in GIF handling (CVE-2026-9672) (Resolves: RHEL-259570)

Oct 12, 2026
High max 8.2

ELSA-2026-80510 1 CVE

Important: compat-openssl10 security update (Oracle Linux 8)

[1:1.0.2o-4.4] - Fix CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset

Oct 11, 2026
High max 8.8

ELSA-2026-80687 4 CVEs

Important: flatpak security update (Oracle Linux 8)

[1.12.9-7] - Use gsize for OCI delta sizes and harden delta parser (CVE-2026-96280) Resolves: RHEL-271507 [1.12.9-6] - Avoid symlink path traversal in revokefs writer (CVE-2026-96808) Resolves: RHEL-267897 - Prevent arbitrary write as root via extra-data extr…

Oct 11, 2026
High max 7.5

ELSA-2026-75870 2 CVEs

Important: nodejs:22 security update (Oracle Linux 8)

nodejs [1:22.23.2-2] - Patches pacote CVE and updates undici to 6.28.1 Fixes: CVE-2026-9496 CVE-2026-19534 Resolves: RHEL-259888 RHEL-255268 nodejs-nodemon [3.1.14-2] - Rebase npm/brace-expansion to 5.0.9 Fixes: CVE-2026-69152 Resolves: RHEL-223760 nodejs-pac…

Oct 11, 2026
High max 7.8

ELSA-2026-80506 2 CVEs

Important: emacs security update (Oracle Linux 8)

[1:26.1-15.2] - Fix TRAMP user name shell injection vulnerability (CVE-2026-79992) - Resolves: RHEL-248545 [1:26.1-15.1] - Fix integer overflow in PBM image loader (CVE-2026-77219) - Resolves: RHEL-248064

Oct 11, 2026
High max 8.8

ELSA-2026-80497 4 CVEs

Important: flatpak security update (Oracle Linux 9)

[1.12.9-4.4] - Use gsize for OCI delta sizes and harden delta parser (CVE-2026-96280) Resolves: RHEL-271518 [1.12.9-4.3] - Avoid symlink path traversal in revokefs writer (CVE-2026-96808) Resolves: RHEL-267902 - Prevent arbitrary write as root via extra-data …

Oct 11, 2026
High max 7.5

ELSA-2026-79177 1 CVE

Important: mod_auth_openidc security update (Oracle Linux 9)

[2.4.16.11-1.1] - Resolves: RHEL-248048 - CVE-2026-54789 out-of-bounds read/write in oidc_state_cookies_clean_expired when a state-prefixed cookie token contains no '=' separator

Oct 11, 2026
High max 7.8

ELSA-2026-80507 2 CVEs

Important: emacs security update (Oracle Linux 9)

[1:27.2-18.el9_8.2] - Fix integer overflow in pbm_load image validation (RHEL-248067) [1:27.2-18.el9_8.1] - Restrict Tramp user name to fix CVE-2026-79992 (RHEL-248552)

Oct 11, 2026
High max 7.5

ELSA-2026-76750 2 CVEs

Important: nodejs:22 security update (Oracle Linux 9)

nodejs [1:22.23.2-2] - Patches Pacote CVE and update undici to 6.28.1 Fixes: CVE-2026-9496 CVE-2026-19534 Resolves: RHEL-259889 RHEL-255272 [1:22.23.2-1] - Update to version 22.23.2 Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043 Resolves: RHEL-234381 RHE…

Oct 11, 2026
High max 7.5

ELSA-2026-80504 1 CVE

Important: jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update (Oracle Linux 9)

jackson-core [2.21.6-1] - Rebase to version 2.21.6 - Resolves: RHEL-259227 jackson-databind [2.21.6-1] - Rebase to version 2.21.6 - Resolves: RHEL-259227 jackson-jaxrs-providers [2.21.6-1] - Rebase to version 2.21.6 - Resolves: RHEL-259227 jackson-modules-bas…

Oct 11, 2026
High max 9.8

ELSA-2026-76739 38 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.56.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Oct 11, 2026
High max 7.8

ELSA-2026-80496 1 CVE

Important: flatpak-builder security update (Oracle Linux 9)

[1.2.3-1.1] - Disable git hooks when applying patches (CVE-2026-86320) Resolves: RHEL-262193

Oct 11, 2026
High max 8.8

ELSA-2026-80498 4 CVEs

Important: flatpak security update (Oracle Linux 10)

[1.16.0-9.4] - Avoid symlink path traversal in revokefs writer (CVE-2026-96808) Resolves: RHEL-267891 - Prevent arbitrary write as root via extra-data extraction (CVE-2026-96275) Resolves: RHEL-267432 - Use gsize for OCI delta sizes and harden delta parser (C…

Oct 11, 2026
High max 9.8

ELSA-2026-80674 42 CVEs

Important: thunderbird security update (Oracle Linux 10)

[140.17.0-1.0.1] - Add Oracle prefs [140.17.0-1] - Update to 140.17.0 ESR

Oct 11, 2026
High max 7.8

ELSA-2026-80495 1 CVE

Important: flatpak-builder security update (Oracle Linux 10)

[1.4.4-1.1] - Disable git hooks when applying patches (CVE-2026-86320) Resolves: RHEL-262185

Oct 11, 2026
High max 7.5

ELSA-2026-69715 1 CVE

Important: mod_auth_openidc security update (Oracle Linux 7)

[1.8.8-9.0.1] - Backport fix for CVE-2026-54789 [Orabug: 40056267]

Oct 9, 2026
High max 8.2

ELSA-2026-77369 2 CVEs

Important: mod_auth_openidc:2.3 security update (Oracle Linux 8)

cjose [0.6.1-5] - CVE-2026-53938 cjose: heap buffer overflow in AES key unwrap Resolves: RHEL-256961 mod_auth_openidc [2.4.9.4-9] - Resolves: RHEL-248080 CVE-2026-54789 Denial of Service via malformed state cookie parsing

Oct 9, 2026
High max 9.3

ELSA-2026-500381 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-325.221.6.1] - x86/kexec: Add EFI config table identity mapping for kexec kernel (Tao Liu) [Orabug: 40127851] - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (Sean Christopherson) [Orabug: 40127747] {CVE-2026-80726} [5.15…

Oct 9, 2026
High max 9.8

ELSA-2026-76850 43 CVEs

Important: firefox security update (Oracle Linux 8)

[140.17.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.17.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.17.0-1] - …

Oct 8, 2026
High max 7.5

ELSA-2026-79162 3 CVEs

Important: bind security update (Oracle Linux 8)

[32:9.11.36-16.16] - Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666) - Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs (CVE-2026-80274) - Reject oversized negative cached records early (CVE-2026-19667)

Oct 8, 2026
High max 7.5

ELSA-2026-79113 3 CVEs

Important: bind9.16 security, bug fix, and enhancement update (Oracle Linux 8)

[32:9.16.23-0.22-16] - Backport 'Do not use header_prev in expire_lru_headers' from upstream. [32:9.16.23-0.22-15] - Reenable unit tests during build [32:9.16.23-0.22.14] - Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666) - Preve…

Oct 8, 2026
High max 9.8

ELSA-2026-77498 3 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.172.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 8, 2026
High max 6.2

ELSA-2026-77576 1 CVE

Important: perl-DBI security update (Oracle Linux 8)

[1.641-4] - CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting memory read during numeric type casting Resolves: RHEL-271960

Oct 8, 2026
High max 9.2

ELSA-2026-77017 2 CVEs

Important: python3.12 security update (Oracle Linux 9)

[3.12.15-1.0.1] - Remove upstream URL reference [3.12.15-1] - Update to 3.12.15 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Securit…

Oct 8, 2026
High max 8.2

ELSA-2026-77396 1 CVE

Important: openssl security update (Oracle Linux 9)

[3.5.8-2.0.1] - Replace upstream references [Orabug: 34340177] [1:3.5.8-2] - Fixed DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782) Resolves: RHEL-264479

Oct 8, 2026
High max 9.2

ELSA-2026-77021 2 CVEs

Important: python3.14 security update (Oracle Linux 9)

[3.14.8-1] - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for…

Oct 8, 2026
High max 9.8

ELSA-2026-77689 14 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.56.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Oct 8, 2026
High max 8.2

ELSA-2026-76918 1 CVE

Important: openssl security update (Oracle Linux 10)

[3.5.8-2.0.1] - Replace upstream references [Orabug: 34340177] - Update FIPS provider name [Orabug: 35824276] [1:3.5.8-2] - Fixes DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782) Resolves: RHEL-264466

Oct 8, 2026
High max 7.4

ELSA-2026-76737 1 CVE

Important: rust-sequoia-sq security, bug fix, and enhancement update (Oracle Linux 10)

[1.4.0.1-2.0.1] - Put 'Requires' openssl-libs in correct placeholder [Orabug: 38742109] - Hard require needed openssl-libs [Orabug: 38742109] [1.4.0.1-2] - Introduce alias for ML-DSA keys during key generation [1.4.0.1-1] - Update to 1.4.0 and fix CVE-2026-42…

Oct 8, 2026
High max 9.2

ELSA-2026-77018 2 CVEs

Important: python3.14 security update (Oracle Linux 10)

[3.14.8-1] - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for…

Oct 8, 2026
High max 7.5

ELSA-2026-77648 1 CVE

Important: dogtag-pki security update (Oracle Linux 10)

[11.9.0-6.0.1] - Treat Oracle Linux the same as RHEL when selecting the Tomcat app server version. [11.9.0-8] - Update jackson bundled to 2.21.6 - Resolves: RHEL-259220

Oct 8, 2026
High max 9.1

ELSA-2026-79371 8 CVEs

Important: dovecot security update (Oracle Linux 10)

[1:2.3.21-19.8] - fix CVE-2026-33605: ManageSieve: denial of service via lone CR character causing protocol deadlock (RHEL-251984) [1:2.3.21-19.7] - fix CVE-2026-42007: fix use-after-free and info leak in sieve editheader extension (RHEL-251945) [1:2.3.21-19.…

Oct 8, 2026
High max 8.2

ELSA-2026-79122 1 CVE

Important: cjose security update (Oracle Linux 10)

[0.6.2.2-7.1] - Fix CVE-2026-53938: heap buffer overflow in AES key unwrap Resolves: RHEL-256962

Oct 8, 2026
High max 9.2

ELSA-2026-77020 2 CVEs

Important: python3.12 security update (Oracle Linux 10)

[3.12.15-1.0.1] - Remove upstream URL reference [3.12.15-1] - Update to 3.12.15 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Securit…

Oct 8, 2026
High max 9.8

ELSA-2026-76738 35 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.63.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Oct 8, 2026
High max 10.0

ELSA-2026-77690 16 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.64.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Oct 8, 2026
High max 9.2

ELSA-2026-77028 2 CVEs

Important: python3.12 security update (Oracle Linux 8)

[3.12.15-1] - Update to 3.12.15 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-…

Oct 7, 2026
High max 7.1

ELSA-2026-77359 1 CVE

Important: vim security update (Oracle Linux 8)

[8.0.1763-32.0.1] - Remove upstream references [Orabug: 31197557] - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984] [2:8.0.1763-32] - RHEL-271024 vim: vim: Ex command injection via crafted filename in sign_jump() [2:8.0.176…

Oct 7, 2026
High max 8.8

ELSA-2026-76755 6 CVEs

Important: freerdp security update (Oracle Linux 9)

[2:2.11.7-7.8] - Backport several CVE fixes (CVE-2026-91953, CVE-2026-91954, CVE-2026-91956, CVE-2026-91959, CVE-2026-91963, CVE-2026-91964) Resolves: RHEL-260758, RHEL-260785, RHEL-260803, RHEL-260849, RHEL-260871 Resolves: RHEL-260902

Oct 7, 2026
High max 7.4

ELSA-2026-76733 1 CVE

Important: rust-rpm-sequoia security update (Oracle Linux 9)

[1.10.2.1-1] - Rebase to 1.10.2 and sequioa-openpgp with fixes for CVE-2026-42784

Oct 7, 2026