Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,092 results · Clear filters · Feed

High max 7.8

ELSA-2022-9014 3 CVEs 2 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.59.1.2] - fix regression in 'epoll: Keep a reference on files added to the check list' (Al Viro) [Orabug: 33679854] {CVE-2021-1048} - fget: check that the fd still exists after getting a ref to it (Linus Torvalds) [Orabug: 33679806] {CVE-2021-0920…

Jan 10, 2022
High max 6.4

ELSA-2022-9012 2 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.302.7.2] - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) [Orabug: 33699625] {CVE-2021-4155} [5.4.17-2136.302.7.1] - fget: check that the fd still exists after getting a ref to it (Linus Torvalds) [Orabu…

Jan 10, 2022
High max 6.4

ELSA-2022-9013 2 CVEs 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.302.7.2] - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) [Orabug: 33699625] {CVE-2021-4155} [5.4.17-2136.302.7.1] - fget: check that the fd still exists after getting a ref to it (Linus Torvalds) [Orabu…

Jan 10, 2022
High

ELSA-2022-9005 2 CVEs

Important: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-43.0.2] - scoreboard: fix null pointer deference [Orabug: 33690670][CVE-2021-34798] - fix ap_escape_quote logic [Orabug: 33690686][CVE-2021-39275]

Jan 6, 2022
High

ELSA-2021-9638 10 CVEs

Important: qemu security update (Oracle Linux 7)

Jan 4, 2022
High

ELSA-2022-0003 4 CVEs

Important: xorg-x11-server security update (Oracle Linux 7)

[1.20.4-17] - CVE fix for: CVE-2021-4008 (#2030161), CVE-2021-4009 (#2030171), CVE-2021-4010 (#2030176), CVE-2021-4011 (#2030180)

Jan 4, 2022
High max 7.5

ELSA-2022-0001 1 CVE

Important: grafana security update (Oracle Linux 8)

[7.5.9-5] - resolve CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache

Jan 4, 2022
High

ELSA-2021-9623 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.302.6.1] - rds/ib: Use both iova and key in free_mr socket call (aru kolappan) [Orabug: 33667276] [5.4.17-2136.302.6] - Revert fs: align IOCB_* flags with RWF_* flags (Prasad Singamsetty) [Orabug: 33627551] [5.4.17-2136.302.5] - Revert drm: Initi…

Dec 20, 2021
High

ELSA-2021-9621 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.302.6.1] - rds/ib: Use both iova and key in free_mr socket call (aru kolappan) [Orabug:33667276] [5.4.17-2136.302.6] - Revert fs: align IOCB_* flags with RWF_* flags (Prasad Singamsetty) [Orabug: 33627551] [5.4.17-2136.302.5] - Revert drm: Initia…

Dec 20, 2021
High

ELSA-2021-5192 2 CVEs

Important: samba security and bug fix update (Oracle Linux 7)

[4.10.16-17] - related: #2019673 - Add missing checks for IPA DC server role [4.10.16-16] - resolves: #2019661 - Fix CVE-2016-2124 - resolves: #2019673 - Fix CVE-2020-25717 - resolves: #2021428 - Add missing PAC buffer types to krb5pac.idl

Dec 17, 2021
High

ELSA-2021-9619 2 CVEs

Important: httpd security update (Oracle Linux 7)

[2.4.6-97.0.5.2] - scoreboard: fix null pointer deference [Orabug: 33561206][CVE-2021-34798] - fix ap_escape_quote logic [Orabug: 33617690][CVE-2021-39275]

Dec 16, 2021
High max 7.5

ELSA-2021-5160 2 CVEs

Important: go-toolset:ol8 security and bug fix update (Oracle Linux 8)

golang [1.16.12-1] - Rebase to Go 1.16.12 - Resolves: rhbz#2031125 go-toolset [1.16.12-1] - Rebase to Go 1.16.12 - Resolves: rhbz#2031125

Dec 16, 2021
High

ELSA-2021-5082 3 CVEs

Important: samba security update (Oracle Linux 8)

[4.14.5-7] - related: rhbz#2021171 - Fix CVE-2020-25717 - Fix running ktest (selftest) [4.14.5-6] - related: rhbz#2021171 - Fix CVE-2020-25717 - Add missing checks for IPA DC server role

Dec 14, 2021
High

ELSA-2021-5046 10 CVEs

Important: thunderbird security update (Oracle Linux 7)

[91.4.0-3.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.4.0-3] - Bump NVR for ppc64 build [91.4.0-2] - Update to 91.4.0 build2 [91.4.0-1] - Update to 91.4.0 build1

Dec 10, 2021
High

ELSA-2021-5045 10 CVEs

Important: thunderbird security update (Oracle Linux 8)

[91.4.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.4.0-2] - Update to 91.4.0 build2 [91.4.0-1] - Update to 91.4.0 build1

Dec 10, 2021
High

ELSA-2021-5013 9 CVEs

Important: firefox security update (Oracle Linux 8)

[91.4.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.4.0-1] - Update to 91.4.0 build1

Dec 9, 2021
High

ELSA-2021-5014 9 CVEs

Important: firefox security update (Oracle Linux 7)

[91.4.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.4.0-1] - Update to 91.4.0 build1

Dec 8, 2021
High

ELSA-2021-9577 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.58.2] - ovl: prevent private clone if bind mount is not allowed (Miklos Szeredi) [Orabug: 33560431] {CVE-2021-3732} [4.1.12-124.58.1] - sunrpc: move NO_CRKEY_TIMEOUT to the auth->au_flags (Scott Mayhew) [Orabug: 33443537] - xen/netfront: stop tx q…

Dec 6, 2021
High max 8.8

ELSA-2021-4913 3 CVEs

Important: mailman security update (Oracle Linux 7)

[3:2.1.15-30.2] - Fix for CVE-2021-44227 - Resolves: #2026866 [3:2.1.15-30.1] - Fix for CVE-2016-6893 - Fix for CVE-2021-42097 - Resolves: #2024884, #2020688

Dec 3, 2021
High max 8.8

ELSA-2021-4916 1 CVE

Important: mailman:2.1 security update (Oracle Linux 8)

[3:2.1.29-12.2] - Fix for CVE-2021-44227 - Resolves: #2026871 [3:2.1.29-12.1] - Fix for CVE-2021-42096 - Fix for CVE-2021-42097 - Resolves: #2021139, #2020692

Dec 2, 2021
High

ELSA-2021-9568 14 CVEs

Important: virt:kvm_utils security update (Oracle Linux 8)

hivex [1.3.18] - Resolves: bz#1810193 (Upgrade components in virt:rhel module:stream for RHEL-8.3 release) [1.3.18] - Resolves: bz#1810193 (Upgrade components in virt:rhel module:stream for RHEL-8.3 release) libguestfs [1:1.40.2-25.0.1] - Replace upstream ref…

Dec 1, 2021
High

ELSA-2021-4777 1 CVE

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1160.49.1.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and…

Nov 24, 2021
High

ELSA-2021-4826 2 CVEs

Important: mailman:2.1 security update (Oracle Linux 8)

[3:2.1.29-12.1] - Fix for CVE-2021-42096 - Fix for CVE-2021-42097 - Resolves: #2021139, #2020692

Nov 24, 2021
High

ELSA-2021-9565 3 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.301.1.2.el7] - Revert 'net/rds: Allocate pages on HCA NUMA nodeid' (Gerd Rausch) [Orabug: 33561324] - Revert 'net/rds: Allocate rds_ib_{incoming,frag}_slab on HCA NUMA nodeid' (Gerd Rausch) [Orabug: 33561324] - Revert 'net/rds: Use the same vecto…

Nov 23, 2021
High

ELSA-2021-9564 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.301.1.2] - Revert 'net/rds: Allocate pages on HCA NUMA nodeid' (Gerd Rausch) [Orabug: 33561324] - Revert 'net/rds: Allocate rds_ib_{incoming,frag}_slab on HCA NUMA nodeid' (Gerd Rausch) [Orabug: 33561324] - Revert 'net/rds: Use the same vector fo…

Nov 23, 2021
High max 5.7

ELSA-2021-9562 1 CVE

Important: python3 security update (Oracle Linux 7)

[3.6.8-18.0.5] - Remove the 'getfile' feature of pydoc [Orabug: 33182027][CVE-2021-3426]

Nov 20, 2021
High

ELSA-2021-4537 1 CVE

Important: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-43.0.1] - Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262] - Replace index.html with Oracle's index page oracle_index.html. [2.4.37-43] - Related: #2007235 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via a crafted request uri-path…

Nov 18, 2021
High max 5.8

ELSA-2021-4622 2 CVEs

Important: freerdp security update (Oracle Linux 8)

[2:2.2.0-7] - Updated: Refactored RPC gateway parser (rhbz#2017948) + fixed issues discovered by Covscan [2:2.2.0-6] - Refactored RPC gateway parser (rhbz#2017948) [2:2.2.0-5] - Revert: Refactored RPC gateway parser (rhbz#2017948) [2:2.2.0-4] - Refactored RPC…

Nov 18, 2021
High max 6.8

ELSA-2021-4135 8 CVEs

Important: java-17-openjdk security update (Oracle Linux 8)

[1:17.0.1.0.12-2] - Extend LTS check to exclude EPEL. - Related: rhbz#2013841 [1:17.0.1.0.12-2] - Set LTS designator. - Related: rhbz#2013841 [1:17.0.1.0.12-1] - Drop JDK-8272332/RH2004078 patch which is upstream in 17.0.1 - Resolves: rhbz#2013841 [1:17.0.1.0…

Nov 18, 2021
High

ELSA-2021-4647 2 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-348.2.1_5.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genk…

Nov 18, 2021
High max 5.8

ELSA-2021-4619 2 CVEs

Important: freerdp security update (Oracle Linux 7)

[2:2.2.0-5] - Update: Refactored RPC gateway parser (rhbz#2017944) + fix issues discovered by Covscan [2:2.2.0-4] - Refactored RPC gateway parser (rhbz#2017944) [2.1.1-3] - Add checks for bitmap and glyph width/heigth values (rhbz#2017951)

Nov 11, 2021
High

ELSA-2021-9545 1 CVE

Important: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-39.0.2.1] - mod_session: save one apr_strtok() [Orabug: 33338149][CVE-2021-26690]

Nov 11, 2021
High max 8.6

ELSA-2021-9525 5 CVEs

Important: olcne security update (Oracle Linux 7)

olcne [1.2.5-2] - Update Istio to 1.9.8 to address CVE-2021-32777, CVE-2021-32778, CVE-2021-32779, CVE-2021-32780 & CVE-2021-32781 - Update proxyv2 image to select iptables legacy or latest based on host operating system - Turn off Istio PodDisruptionBudget i…

Nov 10, 2021
High max 8.8

ELSA-2021-9526 6 CVEs

Important: olcne security update (Oracle Linux 7)

olcne [1.3.2-2] - Turn off default PodDisruptionBudget in istio template to unblock kubernetes module upgrade - Update Kubernetes version to 1.20.11 to address CVE-2021-25741 - Update Istio to 1.9.8, 1.10.4 to address CVE-2021-32777, CVE-2021-32778, CVE-2021-…

Nov 9, 2021
High max 8.8

ELSA-2021-9546 6 CVEs

Important: olcne istio istio kubernetes security update (Oracle Linux 8)

olcne [1.3.2-2] - Turn off default PodDisruptionBudget in istio template to unblock kubernetes module upgrade - Update Kubernetes version to 1.20.11 to address CVE-2021-25741 - Update Istio to 1.9.8, 1.10.4 to address CVE-2021-32777, CVE-2021-32778, CVE-2021-…

Nov 9, 2021
High

ELSA-2021-4134 6 CVEs

Important: thunderbird security update (Oracle Linux 7)

[91.3.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.3.0-2] - Update to 19.3.0 build2 [91.3.0-1] - Update to 91.3.0 build1

Nov 5, 2021
High

ELSA-2021-4130 6 CVEs

Important: thunderbird security update (Oracle Linux 8)

[91.3.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.3.0-2] - Update to 19.3.0 build2 [91.3.0-1] - Update to 91.3.0 build1

Nov 5, 2021
High

ELSA-2021-4116 6 CVEs

Important: firefox security update (Oracle Linux 7)

[91.3.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.3.0-1] - Update to 91.3.0 build1

Nov 4, 2021
High

ELSA-2021-9541 1 CVE

Important: httpd security update (Oracle Linux 7)

[2.4.6-97.0.3.1] - mod_session: save one apr_strtok() [Orabug: 33338149][CVE-2021-26690]

Nov 4, 2021
High

ELSA-2021-4123 6 CVEs

Important: firefox security update (Oracle Linux 8)

[91.3.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.3.0-1] - Update to 91.3.0 build1

Nov 4, 2021