Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,082 results · Clear filters · Feed

High max 10.0

ELSA-2026-500377 383 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-325.220.5] - octeontx2-pf: fix SQB pointer leak on init failure (Dawei Feng) [Orabug: 39951718] - batman-adv: Remove stale reason member from batadv_tp_vars (Vijayendra Suman) [Orabug: 39966037] - Revert 'octeontx2-pf: Fix leak of SQ timestamp buffer …

Oct 7, 2026
High max 6.2

ELSA-2026-76760 1 CVE

Important: perl-DBI security update (Oracle Linux 9)

[1.643-9.7] - CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting memory read during numeric type casting Resolves: RHEL-271974

Oct 7, 2026
High max 9.8

ELSA-2026-76761 43 CVEs

Important: firefox security update (Oracle Linux 9)

[140.17.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.17.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

Oct 7, 2026
High max 9.8

ELSA-2026-76764 43 CVEs

Important: firefox security update (Oracle Linux 10)

[140.17.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.17.0-1] - Update to 140.17.0 ESR

Oct 7, 2026
High max 10.0

ELSA-2026-500374 1468 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-207.111.5.1] - selftests/mm/khugepaged: include kselftest.h in khugepaged (Sherry Yang) [Orabug: 40099804] [6.12.0-207.111.5] - Rename ONOS kernel flavor to OSP for OL9 and OL10 (Vijay Kumar) [Orabug: 40055216] - tcp: Remove hashinfo test for inet6?_l…

Oct 7, 2026
High max 7.1

ELSA-2026-75582 1 CVE

Important: librabbitmq security update (Oracle Linux 8)

[0.9.0-6] - CVE-2026-44236 librabbitmq: rabbitmq-c: Heap buffer overflow leading to denial of service [rhel-8.10.z] leading to denial of service [rhel-8.10.z] - Resolves: RHEL-266743

Oct 6, 2026
High max 8.8

ELSA-2026-76747 6 CVEs

Important: freerdp security update (Oracle Linux 8)

[2:2.11.7-14] - Backport several CVE fixes (CVE-2026-91953, CVE-2026-91954, CVE-2026-91956, CVE-2026-91959, CVE-2026-91963, CVE-2026-91964) Resolves: RHEL-260751, RHEL-260776, RHEL-260800, RHEL-260846, RHEL-260860 Resolves: RHEL-260892

Oct 6, 2026
High max 9.1

ELSA-2026-76763 8 CVEs

Important: dovecot security, bug fix, and enhancement update (Oracle Linux 8)

[1:2.3.16-15] - fix CVE-2026-33605: ManageSieve login deadlock caused by lone CR protocol violation (RHEL-251995) [1:2.3.16-14] - fix CVE-2026-42007: heap use-after-free in pigeonhole edit_mail_snapshot after deleteheader operation (RHEL-251946) [1:2.3.16-13]…

Oct 6, 2026
High max 9.1

ELSA-2026-500375 13 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.360.3] - IB/mlx4: delete allocated id_map_entry while sending REJ (Praveen Kumar Kannoju) [Orabug: 39999072] - net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40020673] {CVE-2026-81000} - xfrm: ah6: validate routing header s…

Oct 6, 2026
High max 7.8

ELSA-2026-75579 1 CVE

Important: sudo security update (Oracle Linux 10)

[1.9.17-7] - CVE-2026-96512 sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization [rhel-10.2.z] [1.9.17-6] - Fix CVE-2026-82474: execveat(2) intercept/log_subcmds bypass [1.9.17-5.p2] - Resolves: RHEL-212546 - Use ca…

Oct 6, 2026
High max 8.8

ELSA-2026-75570 11 CVEs

Important: freerdp security update (Oracle Linux 10)

[2:3.10.3-12.14] - Backport several CVE fixes (CVE-2026-85089, CVE-2026-91946, CVE-2026-91947, CVE-2026-91950, CVE-2026-91953, CVE-2026-91954, CVE-2026-91956, CVE-2026-91959, CVE-2026-91960, CVE-2026-91963, CVE-2026-91964) Resolves: RHEL-253892, RHEL-260716, …

Oct 6, 2026
High max 7.5

ELSA-2026-75864 2 CVEs

Important: nodejs22 security update (Oracle Linux 10)

[1:22.23.1-4.0.1] - Add c-ares as dependency [orabug 39781219]

Oct 6, 2026
High max 7.4

ELSA-2026-76735 1 CVE

Important: rust-sequoia-sqv security update (Oracle Linux 10)

[1.3.0.2-1] - Update openpgp crate to fix CVE-2026-42784

Oct 6, 2026
High max 7.4

ELSA-2026-76734 1 CVE

Important: rust-rpm-sequoia security, bug fix, and enhancement update (Oracle Linux 10)

[1.10.2.1-1] - Rebase to 1.10.2 and sequioa-openpgp with fixes for CVE-2026-42784

Oct 6, 2026
High max 6.2

ELSA-2026-76762 1 CVE

Important: perl-DBI security update (Oracle Linux 10)

[1.643-26.7] - CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting memory read during numeric type casting Resolves: RHEL-271970

Oct 6, 2026
High max 7.8

ELSA-2026-75580 1 CVE

Important: sudo security update (Oracle Linux 8)

[1.9.5p2-2.0.1] - Fixes sudo -s unclosed sessions when use_pty option used [Orabug: 36952911] [1.9.5p2-2] RHEL 8.10.0.Z ERRATUM - CVE-2026-96512 - TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization [rhel-8.10.z] Resolves: RHE…

Oct 5, 2026
High max 6.9

ELSA-2026-75674 1 CVE

Important: mariadb-connector-c security update (Oracle Linux 8)

[3.1.11-3] - CVE-2026-44172 fix

Oct 5, 2026
High max 8.7

ELSA-2026-76045 1 CVE

Important: libpcap security update (Oracle Linux 8)

[14:1.9.1-6] - Fix CVE-2026-0799: add bounds checks for BPF scratch memory register indices in the BPF interpreter - Resolves: RHEL-256926

Oct 5, 2026
High max 9.8

ELSA-2026-75747 29 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.171.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 5, 2026
High max 9.8

ELSA-2026-72468 13 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.170.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 5, 2026
High

ELSA-2026-75680 0 CVEs

Important: gd security update (Oracle Linux 8)

[2.2.5-8] - Fix CVE-2026-9672: incorrect array index and uninitialized memory in GIF LZW decoder Resolves: RHEL-259584

Oct 5, 2026
High max 7.2

ELSA-2026-75573 1 CVE

Important: pki-core:10.6 security update (Oracle Linux 8)

jss [4.11.0-1] - Rebase to JSS 4.11.0 [4.10.0-0.1] - Rebase to JSS 4.10.0-alpha1 [4.9.8-1] - Rebase to JSS 4.9.8 [4.9.4-1] - Rebase to JSS 4.9.4 - Bug 2013674 - JSS cannot be properly initialized after using another NSS-backed security provider [4.9.3-1] - Re…

Oct 5, 2026
High max 7.8

ELSA-2026-75575 4 CVEs

Important: gimp security update (Oracle Linux 9)

[2:3.0.4-4.14] - fix CVE-2026-97185 [2:3.0.4-4.13] - fix CVE-2026-92248 [2:3.0.4-4.12] - fix CVE-2026-90947 [2:3.0.4-4.11] - fix CVE-2026-90948

Oct 5, 2026
High max 6.9

ELSA-2026-75673 1 CVE

Important: mariadb-connector-c security update (Oracle Linux 9)

[3.2.6-2] - CVE-2026-44172 fix

Oct 5, 2026
High max 7.8

ELSA-2026-75571 1 CVE

Important: sudo security update (Oracle Linux 9)

[1.9.17p2-3.3] - CVE-2026-96512 sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization [rhel-9.8.z] Resolves: RHEL-267328

Oct 5, 2026
High max 7.1

ELSA-2026-75768 1 CVE

Important: vim security update (Oracle Linux 9)

[8.2.2637-26.0.1.el9_8.23] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-26.23] - RHEL-271037 vim: ex command injection via crafted filename in sign_jump() [2:8.2.2637-26.22] - RHEL-257027 CVE-2026-73073 vim: arbitrary Ex command execution durin…

Oct 5, 2026
High max 7.5

ELSA-2026-75578 5 CVEs

Important: bind9.18 security update (Oracle Linux 9)

[32:9.18.29-14.10] - Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666) - Prevent memory leak on following HTTPS/SVCB RR (CVE-2026-81563) - Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs (CVE-2026-80274) …

Oct 5, 2026
High max 7.5

ELSA-2026-75767 3 CVEs

Important: bind security update (Oracle Linux 9)

[9.16.23-40.0.1.el9_8.10] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-40.10] - Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666) - Prevent crash on wildcard responses containing both NSEC and…

Oct 5, 2026
High max 7.8

ELSA-2026-75583 2 CVEs

Important: libvirt security, bug fix, and enhancement update (Oracle Linux 10)

[11.10.0-12.9.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] [11.10.0-12.9.el10_2] - remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245266, CVE-2026-18917) - qemu: Always assume support for 'QEMU_CAP…

Oct 5, 2026
High max 7.5

ELSA-2026-75577 5 CVEs

Important: bind security update (Oracle Linux 10)

[9.18.33-15.0.1.el10_2.12] - Hard require needed openssl-libs [Orabug: 38742109] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.18.33-15.12] - Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666) - Preve…

Oct 5, 2026
High max 7.5

ELSA-2026-75581 1 CVE

Important: mod_auth_openidc security update (Oracle Linux 10)

[2.4.16.11-1.1] - Fix CVE-2026-54789: out-of-bounds read/write in state cookie parsing - Resolves: RHEL-248045

Oct 5, 2026
High max 9.8

ELSA-2026-70498 12 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.60.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Oct 5, 2026
High max 7.1

ELSA-2026-75769 1 CVE

Important: vim security update (Oracle Linux 10)

[9.1.083-9.0.1.el10_2.22] - Remove upstream references [Orabug: 31197557] [2:9.1.083-9.22] - RHEL-271045 ex command injection via crafted filename in sign_jump() [2:9.1.083-9.21] - RHEL-257016 CVE-2026-73073 arbitrary Ex command execution during C omni-comple…

Oct 5, 2026
High max 9.3

ELSA-2026-75576 2 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.62.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Oct 5, 2026
High max 9.8

ELSA-2026-70402 20 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.168.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 2, 2026
High max 9.8

ELSA-2026-71213 7 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.168.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 2, 2026
High max 8.3

ELSA-2026-73519 2 CVEs

Important: ruby:2.5 security update (Oracle Linux 8)

ruby [2.5.9-114] - Fix integer overflow in search_in_range function in regexec.c (CVE-2019-19012). Resolves: RHEL-87505 [2.5.9-113] - Fix REXML ReDoS vulnerability. (CVE-2024-49761) Resolves: RHEL-68515 [2.5.9-112] - Fix ReDoS vulnerability - upstream's incom…

Oct 2, 2026
High max 7.5

ELSA-2026-74085 3 CVEs

Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 8)

nodejs [1:24.21.0-1] - Update to version 24.21.0 Fix: CVE-2026-85152 CVE-2026-84961 CVE-2026-19534 Resolves: RHEL-255252 RHEL-255291 RHEL-255313 RHEL-249188 [1:24.18.0-3] - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 5.9.0 Fix:…

Oct 2, 2026
High max 7.8

ELSA-2026-74424 2 CVEs

Important: libvirt security, bug fix, and enhancement update (Oracle Linux 9)

[11.10.0-12.7.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] [11.10.0-12.7.el9_8] - remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245282, CVE-2026-18917) - qemu: Always assume support for 'QEMU_CAPS…

Oct 2, 2026
High max 9.8

ELSA-2026-71233 13 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.60.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Oct 2, 2026