Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,092 results · Clear filters · Feed

High

ELSA-2022-9260 5 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.61.2] - exec, elf: ignore invalid note data (Anthony Yznaga) [Orabug: 34023956] [4.1.12-124.61.1] - drm/i915: Flush TLBs before releasing backing store (Tvrtko Ursulin) [Orabug: 33835812] {CVE-2022-0330} - drm/i915: Reduce locking in execlist comm…

Apr 5, 2022
High max 7.5

ELSA-2022-9249 1 CVE

Important: openssl security update (Oracle Linux 7)

[1.0.2k-25_fips] - Change Epoch from 1 to 10 - Fix DH self-test to add shared secret comparison [Orabug: 32467026] - Add DH support changes for SP 800-56A rev3 requirements [Orabug: 32467059] - Add TLS KDF self-test [Orabug: 32467193] - Add EC keys pairwise c…

Mar 30, 2022
High max 7.5

ELSA-2022-1066 1 CVE

Important: openssl security update (Oracle Linux 7)

[1:1.0.2k-25] - Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates - Related: rhbz#2067160

Mar 29, 2022
High max 9.8

ELSA-2022-1069 12 CVEs

Important: expat security update (Oracle Linux 7)

[2.1.0-14.0.1] - lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910302] [2.1.0-14] - Fix multiple CVEs - CVE-2022-25236 expat: namespace-separator characters in 'xmlns[:prefix]' attribute values can lead to arbitrary code execution - CVE…

Mar 28, 2022
High max 7.5

ELSA-2022-1065 1 CVE

Important: openssl security update (Oracle Linux 8)

[1:1.1.1k-6] - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates - Resolves: rhbz#2067144

Mar 28, 2022
High

ELSA-2022-1049 1 CVE

Important: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-43.0.2.3] - Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-43.3] - Resolves: #2065247 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling vulnerability in Ap…

Mar 25, 2022
High

ELSA-2022-1045 1 CVE

Important: httpd security update (Oracle Linux 7)

[2.4.6-97.0.5.5] - mod_session: save one apr_strtok() [Orabug: 33338149][CVE-2021-26690] - replace index.html with Oracle's index page oracle_index.html [2.4.6-97.5] - Resolves: #2065243 - CVE-2022-22720 httpd: HTTP request smuggling vulnerability in Apache H…

Mar 24, 2022
High max 7.5

ELSA-2022-9233 1 CVE

Important: openssl security update (Oracle Linux 8)

[1:1.1.1k-5.0.1] - fix CVE-2022-0778 - possible infinite loop in BN_mod_sqrt() [Orabug: 33974871]

Mar 23, 2022
High max 7.8

ELSA-2022-9245 10 CVEs 2 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.305.5.3] - bpf: fix out-of-tree module build (Alan Maguire) [Orabug: 33973548] - ACPICA: Enable sleep button on ACPI legacy wake (Anchal Agarwal) [Orabug: 33973543] - Revert 'btrfs: inode: refactor the parameters of insert_reserved_file_extent()'…

Mar 23, 2022
High max 7.8

ELSA-2022-9244 10 CVEs 2 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.305.5.3] - bpf: fix out-of-tree module build (Alan Maguire) [Orabug: 33973548] - ACPICA: Enable sleep button on ACPI legacy wake (Anchal Agarwal) [Orabug: 33973543] - Revert 'btrfs: inode: refactor the parameters of insert_reserved_file_extent()'…

Mar 23, 2022
High max 6.2

ELSA-2022-9240 2 CVEs

Important: libtpms security update (Oracle Linux 7)

libtpms [0.8.8-1.el7] - spec: Update spec file to version 0.8.8 * Fri Sep 17 2021 Stefan Berger - 0.8.7-1 - tpm2: Fixes for building and running with OpenSSL 3.0 * Fri Sep 10 2021 Stefan Berger - 0.8.6-1 - tpm2: Marshal event sequence objects' hash state * We…

Mar 22, 2022
High max 7.5

ELSA-2022-9224 1 CVE

Important: openssl security update (Oracle Linux 7)

[1.0.2k-24.0.3] - fix CVE-2022-0778 - possible infinite loop in BN_mod_sqrt()

Mar 18, 2022
High max 7.5

ELSA-2022-9225 1 CVE

Important: openssl security update (Oracle Linux 7)

[1.0.2k-24.0.3] - fix CVE-2022-0778 openssl: Fix possible infinite loop in BN_mod_sqrt() - Change Epoch from 1 to 10 - Fix DH self-test to add shared secret comparison [Orabug: 32467026] - Add DH support changes for SP 800-56A rev3 requirements [Orabug: 32467…

Mar 18, 2022
High max 8.8

ELSA-2022-9228 1 CVE

Important: cri-o security update (Oracle Linux 7)

[1.20.7-1] - Added Oracle Specifile Files for cri-o

Mar 18, 2022
High max 7.5

ELSA-2022-9232 1 CVE

Important: expat security update (Oracle Linux 8)

[2.2.5-4.0.1.3] - lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910314]

Mar 18, 2022
High max 8.8

ELSA-2022-9229 1 CVE

Important: cri-o security update (Oracle Linux 7)

[1.21.6-1] - Added Oracle Specifile Files for cri-o

Mar 18, 2022
High max 8.1

ELSA-2022-9227 2 CVEs

Important: expat security update (Oracle Linux 7)

[2.1.0-12.0.1] - lib: Prevent integer overflow on groupSize [CVE-2021-46143][Orabug: 33910302] - lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910302]

Mar 16, 2022
High max 9.8

ELSA-2022-0951 12 CVEs

Important: expat security update (Oracle Linux 8)

[2.2.5-4.3] - Improve fix for CVE-2022-25236 - Related: CVE-2022-25236 [2.2.5-4.2] - Fix multiple CVEs - Resolves: CVE-2022-25236 - Resolves: CVE-2022-25235 - Resolves: CVE-2022-25315 [2.2.5-4.1] - Fix multiple CVEs - CVE-2022-23852 expat: integer overflow in…

Mar 16, 2022
High max 9.8

ELSA-2022-0850 11 CVEs 2 exploited

Important: thunderbird security update (Oracle Linux 7)

[91.7.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [91.7.0-2] - Update to 91.7.0 build2 [91.7.0-1] - Update to 91.7.0 build1

Mar 14, 2022
High max 9.8

ELSA-2022-0845 11 CVEs 2 exploited

Important: thunderbird security update (Oracle Linux 8)

[91.7.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.7.0-2] - Update to 91.7.0 build2 [91.7.0-1] - Update to 91.7.0 build1

Mar 14, 2022
High max 7.5

ELSA-2022-0830 3 CVEs

Important: .NET 5.0 security and bugfix update (Oracle Linux 8)

[5.0.212-1.0.1] - Support AArch64 on Oracle Linux [Orabug: 32738620] - Include new Oracle Linux runtime IDs Add 1000-Add-missing-OL-RIDs.patch [5.0.212-1] - Update to .NET SDK 5.0.212 and Runtime 5.0.15 - Resolves: RHBZ#2060496

Mar 11, 2022
High max 7.8

ELSA-2022-0825 8 CVEs 3 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-348.20.1_5.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

Mar 11, 2022
High max 7.5

ELSA-2022-0826 2 CVEs

Important: .NET 6.0 security and bugfix update (Oracle Linux 8)

[6.0.103-4.0.1] - Add missing Oracle RIDs [6.0.103-4] - Rebuild against .NET 6.0.102 to pick up the correct fixes - Resolves: RHBZ#2059640 [6.0.103-3] - Update to new source release for SDK 6.0.103 and Runtime 6.0.3 - Resolves: RHBZ#2059640 [6.0.103-2] - Swit…

Mar 11, 2022
High max 7.5

ELSA-2022-0827 3 CVEs

Important: .NET Core 3.1 security and bugfix update (Oracle Linux 8)

[3.1.417-1.0.1] - Add missing Oracle Linux Runtime IDs [3.1.417-1] - Update to .NET SDK 3.1.417 and Runtime 3.1.23 - Resolves: RHBZ#2060567

Mar 11, 2022
High max 7.8

ELSA-2022-9213 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.511.5.6.el7] - lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann) [Orabug: 33942242] {CVE-2022-0847}

Mar 10, 2022
High max 7.5

ELSA-2022-9204 1 CVE

Important: python-pip security update (Oracle Linux 7)

[9.0.3-8.0.1] - CVE-2019-20916 [Orabug: 33861505]

Mar 10, 2022
High max 7.8

ELSA-2022-9210 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.511.5.6] - lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann) [Orabug: 33942242] {CVE-2022-0847}

Mar 10, 2022
High max 7.8

ELSA-2022-9211 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.304.4.5] - lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann) [Orabug: 33942329] {CVE-2022-0847} - bpf: Disallow unprivileged bpf by default (Pawan Gupta) [Orabug: 33942374]

Mar 10, 2022
High max 7.8

ELSA-2022-9212 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.304.4.5] - lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann) [Orabug: 33942329] {CVE-2022-0847} - bpf: Disallow unprivileged bpf by default (Pawan Gupta) [Orabug: 33942374]

Mar 10, 2022
High max 7.5

ELSA-2022-0496 1 CVE

Important: .NET 6.0 security and bugfix update (Oracle Linux 8)

[6.0.102-1.0.1] - Add missing Oracle RIDs [6.0.102-1] - Update to .NET SDK 6.0.102 and Runtime 6.0.2 - Resolves: RHBZ#2048257

Mar 9, 2022
High

ELSA-2022-9201 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

- 4.14.35-2047.511.5.4.el7 - x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp) [Orabug: 33922122] {CVE-2021-26341} - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp) [Orabug: 33922122] {CV…

Mar 8, 2022
High

ELSA-2022-9198 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.511.5.4] - x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp) [Orabug: 33922122] {CVE-2021-26341} - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp) [Orabug: 33922122] {CVE-20…

Mar 8, 2022
High

ELSA-2022-9200 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.304.4.4] - arm64: Use the clearbhb instruction in mitigations (James Morse) [Orabug: 33921646] - arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly) [Orabug: 33921646] - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (J…

Mar 8, 2022
High

ELSA-2022-9199 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.304.4.4] - arm64: Use the clearbhb instruction in mitigations (James Morse) [Orabug: 33921646] - arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly) [Orabug: 33921646] - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (J…

Mar 8, 2022
High max 6.9

ELSA-2022-9177 2 CVEs 1 exploited

Important: jquery-ui security update (Oracle Linux 7)

[1.10.4.custom-4.0.1] - Backport jQuery CVE-2020-11022 and CVE-2020-11023 fixes to bundled jQuery v1.10.2 [Orabug: 33869588] [1.10.4.custom-4] - removed %%defattr from specfile - removed Group from specfile - removed BuildRoot from specfiles * Tue May 10 2016…

Mar 1, 2022
High max 7.8

ELSA-2022-9179 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.511.5.2] - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33876756] {CVE-2022-0492} - scsi: libiscsi: Hold back_lock when calling iscsi_complete_task (Gulam Mohamed) [Orabug: 33876755] [4.14.35-2047.511.5.1] - …

Feb 28, 2022
High max 7.8

ELSA-2022-9180 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.511.5.2.el7] - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33876756] {CVE-2022-0492} - scsi: libiscsi: Hold back_lock when calling iscsi_complete_task (Gulam Mohamed) [Orabug: 33876755] [4.14.35-2047.511.5.1…

Feb 28, 2022
High

ELSA-2022-9181 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.304.4.2] - netfilter: nf_tables_offload: incorrect flow offload action array size (Pablo Neira Ayuso) [Orabug: 33899500] {CVE-2022-25636}

Feb 28, 2022
High

ELSA-2022-9182 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

- 5.4.17-2136.304.4.2.el7 - netfilter: nf_tables_offload: incorrect flow offload action array size (Pablo Neira Ayuso) [Orabug: 33899500] {CVE-2022-25636}

Feb 28, 2022
High

ELSA-2022-9172 15 CVEs

Important: virt:kvm_utils security update (Oracle Linux 8)

hivex [1.3.18-21] - Bounds check for block exceeding page length (CVE-2021-3504) resolves: rhbz#1950501 libguestfs [1.40.2-28.0.1] - Replace upstream references from description tag - Config supermin to use host yum.conf in ol8 [Orabug: 29319324] - Set DISTRO…

Feb 25, 2022