Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,092 results · Clear filters · Feed

  • High
    ELSA-2021-4056 3 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-305.25.1_4.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

  • High max 4.7
    ELSA-2021-9534 4 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.57.1] - target; fix print statement warning (John Donnelly) [Orabug: 33495661] - enic;: fix warning on module_param disable_vlan0, (John Donnelly) [Orabug: 33495661] - bnx2fc: correct BNX2FC_TM_TIMEOUT to be 60 sec (John Donnelly) [Orabug: 3349566…

  • High max 5.7
    ELSA-2021-3819 1 CVE

    Important: .NET 5.0 security and bugfix update (Oracle Linux 8)

    [5.0.208-1.0.1] - Merge Oracle Linux modifications [5.0.208-1] - Update to .NET SDK 5.0.208 and Runtime 5.0.11 - Resolves: RHBZ#2011060

  • High max 8.8
    ELSA-2021-4044 1 CVE

    Important: flatpak security update (Oracle Linux 7)

    [1.0.9-12] - Fix CVE-2021-41133 (#2012864)

  • High max 8.8
    ELSA-2021-4042 1 CVE

    Important: flatpak security update (Oracle Linux 8)

    [1.8.5-4] - Fix CVE-2021-41133 (#2012867)

  • High max 7.5
    ELSA-2021-9528 2 CVEs

    Important: openssl security update (Oracle Linux 7)

    [1.0.2k-22_fips] - Change Epoch from 1 to 10 - Fix DH self-test to add shared secret comparison [Orabug: 32467026] - Add DH support changes for SP 800-56A rev3 requirements [Orabug: 32467059] - Add TLS KDF self-test [Orabug: 32467193] - Add EC keys pairwise c…

  • High max 8.5
    ELSA-2021-3956 14 CVEs 1 exploited

    Important: xstream security update (Oracle Linux 7)

    [1.3.1-16] - Fix workaround - Resolves: CVE-2021-39148 [1.3.1-15] - Fix remote code execution vulnerabilities - Resolves: CVE-2021-39139 - Resolves: CVE-2021-39140 - Resolves: CVE-2021-39141 - Resolves: CVE-2021-39144 - Resolves: CVE-2021-39145 - Resolves: CV…

  • High max 9.8
    ELSA-2021-3791 6 CVEs

    Important: firefox security update (Oracle Linux 7)

    [91.2.0-4.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.2.0-4] - Disable webrender on the s390x due to wrong c…

  • High max 9.8
    ELSA-2021-3841 7 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [91.2.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.2.0-1] - Update to 91.2.0 build1 [91.1.2-1] - Update to 91.1.2 build1 [91.1.0-1] - Update to 91.1.0 build2

  • High max 6.8
    ELSA-2021-3892 10 CVEs

    Important: java-11-openjdk security and bug fix update (Oracle Linux 7)

    [1:11.0.13.0.8-1.0.1] - link atomic for ix86 build [1:11.0.13.0.8-1] - Revert addition of libharfbuzz.so after its removal by JDK-8255790 - Resolves: rhbz#2012332 [1:11.0.13.0.8-1] - Update to jdk-11.0.12.0+8 - Update release notes to 11.0.12.0+8 - Switch to …

  • High max 6.8
    ELSA-2021-3889 11 CVEs

    Important: java-1.8.0-openjdk security and bug fix update (Oracle Linux 7)

    [1:1.8.0.312.b07-1] - Update to aarch64-shenandoah-jdk8u312-b07 (EA) - Update release notes for 8u312-b07. - Switch to GA mode for final release. - This tarball is embargoed until 2021-10-19 @ 1pm PT. - Resolves: rhbz#2011826 [1:1.8.0.312.b05-0.3.ea] - Add pa…

  • High max 7.5
    ELSA-2021-3945 6 CVEs

    Important: redis:6 security update (Oracle Linux 8)

    [6.0.9-5] - fix denial of service via Redis Standard Protocol (RESP) request CVE-2021-32675 [6.0.9-4] - fix lua scripts can overflow the heap-based Lua stack CVE-2021-32626 - fix integer overflow issue with Streams CVE-2021-32627 - fix integer overflow bug in…

  • High max 6.8
    ELSA-2021-3893 11 CVEs

    Important: java-1.8.0-openjdk security and bug fix update (Oracle Linux 8)

    [1:1.8.0.312.b07-1] - Update to aarch64-shenandoah-jdk8u312-b07 (EA) - Update release notes for 8u312-b07. - Switch to GA mode for final release. - This tarball is embargoed until 2021-10-19 @ 1pm PT. - Resolves: rhbz#2011826 [1:1.8.0.312.b05-0.4.ea] - Allow …

  • High max 6.8
    ELSA-2021-3891 10 CVEs

    Important: java-11-openjdk security update (Oracle Linux 8)

    [1:11.0.13.0.8-1] - Update to jdk-11.0.12.0+8 - Update release notes to 11.0.12.0+8 - Switch to GA mode for final release. - This tarball is embargoed until 2021-10-19 @ 1pm PT. - Resolves: rhbz#2012333 [1:11.0.13.0.7-0.1.ea] - Update to jdk-11.0.13.0+7 - Upd…

  • High max 7.5
    ELSA-2021-3918 6 CVEs

    Important: redis:5 security update (Oracle Linux 8)

    [5.0.3-5] - fix denial of service via Redis Standard Protocol (RESP) request CVE-2021-32675 [5.0.3-4] - fix lua scripts can overflow the heap-based Lua stack CVE-2021-32626 - fix integer overflow issue with Streams CVE-2021-32627 - fix integer overflow bug in…

  • High max 9.8
    ELSA-2021-3838 7 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [91.2.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.2.0-1] - Update to 91.2.0 build1 [91.1.2-1] - Update to 91.1.2 build1 [91.1.0-1] - Update to 91.1.0 build2

  • High
    ELSA-2021-9488 8 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [4.14.35-2047.508.3.el7] - fuse: fix live lock in fuse_iget() (Amir Goldstein) [Orabug: 33396682] {CVE-2021-28950} - block: workaround to avoid self-deadlock in del_gendisk (Junxiao Bi) [Orabug: 33392821] - net: bonding: add new option arp_allslaves for arp_i…

  • High max 9.0
    ELSA-2021-3856 1 CVE 1 exploited

    Important: httpd security update (Oracle Linux 7)

    [2.4.6-97.0.1.1] - replace index.html with Oracle's index page oracle_index.html [2.4.6-97.1] - Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted request uri-path containing 'unix:'

  • High
    ELSA-2021-9485 8 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.14.35-2047.508.3] - fuse: fix live lock in fuse_iget() (Amir Goldstein) [Orabug: 33396682] {CVE-2021-28950} - block: workaround to avoid self-deadlock in del_gendisk (Junxiao Bi) [Orabug: 33392821] - net: bonding: add new option arp_allslaves for arp_ip_ta…

  • High max 6.3
    ELSA-2021-9487 2 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [5.4.17-2136.300.7.el7] - KVM: SVM: Fix mismerge in svm_update_pi_irte() (Liam Merwick) [Orabug: 33446526] - Revert KVM: x86: hyperv: Remove duplicate definitions of Reference TSC Page (Liam Merwick) [Orabug: 33450675] [5.4.17-2136.300.6] - Revert scsi: core:…

  • High max 6.3
    ELSA-2021-9486 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.300.7] - KVM: SVM: Fix mismerge in svm_update_pi_irte() (Liam Merwick) [Orabug: 33446526] - Revert KVM: x86: hyperv: Remove duplicate definitions of Reference TSC Page (Liam Merwick) [Orabug: 33450675] [5.4.17-2136.300.6] - Revert scsi: core: Cap…

  • High max 9.0
    ELSA-2021-3816 2 CVEs 1 exploited

    Important: httpd:2.4 security update (Oracle Linux 8)

    httpd [2.4.37-39.1.0.1.1] - Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-39.1] - Resolves: #2007234 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via a crafted request ur…

  • High max 8.7
    ELSA-2021-3801 4 CVEs

    Important: kernel security and bug fix update (Oracle Linux 7)

    [3.10.0-1160.45.1.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and…

  • High max 9.8
    ELSA-2021-3771 1 CVE 1 exploited

    Important: grafana security update (Oracle Linux 8)

    [7.3.6-3] - resolve CVE-2021-39226 - resolve CVE-2021-27358

  • High max 9.8
    ELSA-2021-3755 6 CVEs

    Important: firefox security update (Oracle Linux 8)

    [91.2.0-4.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.2.0-4] - Disable webrender on the s390x due to wrong colors: rhbz#2009503 [91.2.0-3] - Update to 91.2.0 build1 [91.1.0-1] - Update…

  • High
    ELSA-2021-9475 5 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [5.4.17-2102.206.1] - Revert 'scsi: core: Cap scsi_host cmd_per_lun at can_queue' (Jack Vogel) [Orabug: 33403144] [5.4.17-2102.206.0] - Revert 'uek-rpm: Don't recompute build-ids for kernel-uek-debuginfo' (Jack Vogel) [Orabug: 33245043] - integrity: Load mokx…

  • High
    ELSA-2021-9474 5 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2102.206.1] - Revert 'scsi: core: Cap scsi_host cmd_per_lun at can_queue' (Jack Vogel) [Orabug: 33403144] [5.4.17-2102.206.0] - Revert 'uek-rpm: Don't recompute build-ids for kernel-uek-debuginfo' (Jack Vogel) [Orabug: 33245043] - integrity: Load mokx…

  • High max 8.0
    ELSA-2021-9473 8 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.56.1] - ocfs2: subsystem.su_mutex is required while accessing the item->ci_parent (alex chen) [Orabug: 29184589] {CVE-2017-18216} - bcache: fix potential deadlock problem in btree_gc_coalesce (Zhiqiang Liu) {CVE-2020-12771} - filldir[64]: remove W…

  • High
    ELSA-2021-9470 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.14.35-2047.507.7.6] - fuse: fix live lock in fuse_iget() (Amir Goldstein) [Orabug: 33406810] {CVE-2021-28950} - block: workaround to avoid self-deadlock in del_gendisk (Junxiao Bi) [Orabug: 33406819] - net: bonding: add new option arp_allslaves for arp_ip_…

  • High
    ELSA-2021-9471 1 CVE

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [4.14.35-2047.507.7.6.el7] - fuse: fix live lock in fuse_iget() (Amir Goldstein) [Orabug: 33406810] {CVE-2021-28950} - block: workaround to avoid self-deadlock in del_gendisk (Junxiao Bi) [Orabug: 33406819] - net: bonding: add new option arp_allslaves for arp…

  • High max 8.2
    ELSA-2021-3666 8 CVEs

    Important: nodejs:14 security and bug fix update (Oracle Linux 8)

    nodejs [1:14.17.5-1] - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939, CVE-2021-22940, - CVE-2021-23343, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672 - Resolves RHBZ#1847529 (make FIPS always available) - Resolves: RHBZ#1988599, RHBZ#1994000, RHBZ#1…

  • High max 6.5
    ELSA-2021-9465 6 CVEs

    Important: squid security update (Oracle Linux 7)

    [7:3.5.20-17.0.1] - Mutiple CVE fixes for squid [Orabug: 33146289] - Resolves: CVE-2021-28651 squid: Bug 5104: Memory leak in RFC 2169 response parsing (#778) - Resolves: CVE-2021-28652 squid: Bug 5106: Broken cache manager URL parsing (#788) - Resolves: CVE-…

  • High
    ELSA-2021-9460 7 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.14.35-2047.507.7.5] - Bluetooth: defer cleanup of resources in hci_unregister_dev() (Tetsuo Handa) [Orabug: 33369947] {CVE-2021-3573} - Bluetooth: use correct lock to prevent UAF of hdev object (Lin Ma) [Orabug: 33369947] - Bluetooth: fix the erroneous flu…

  • High
    ELSA-2021-9458 7 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [4.14.35-2047.507.7.5.el7] - Bluetooth: defer cleanup of resources in hci_unregister_dev() (Tetsuo Handa) [Orabug: 33369947] {CVE-2021-3573} - Bluetooth: use correct lock to prevent UAF of hdev object (Lin Ma) [Orabug: 33369947] - Bluetooth: fix the erroneous…

  • High max 6.3
    ELSA-2021-9459 21 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.54.6.1] - fs/namespace.c: fix mountpoint reference counter race (Piotr Krysiuk) [Orabug: 33369433] {CVE-2020-12114} {CVE-2020-12114} - btrfs: only search for left_info if there is no right_info in try_merge_free_space (Josef Bacik) [Orabug: 333694…

  • High
    ELSA-2021-9457 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2102.205.7.3] - btrfs: fix NULL pointer dereference when deleting device by invalid id (Qu Wenruo) [Orabug: 33281078] {CVE-2021-3739}

  • High
    ELSA-2021-9461 1 CVE

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [5.4.17-2102.205.7.3.el7] - btrfs: fix NULL pointer dereference when deleting device by invalid id (Qu Wenruo) [Orabug: 33281078] {CVE-2021-3739}

  • High max 8.2
    ELSA-2021-3623 8 CVEs

    Important: nodejs:12 security and bug fix update (Oracle Linux 8)

    nodejs [1:12.22.5-1] - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939, CVE-2021-22940, - CVE-2021-23343, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672 - Resolves RHBZ#1951621 (make FIPS always available) - Resolves: RHBZ#1988595, RHBZ#1993992, RHBZ#1…

  • High max 8.7
    ELSA-2021-9452 11 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.14.35-2047.507.7.4] - KVM: x86: Check kvm_rebooting in kvm_spurious_fault() (Sean Christopherson) [Orabug: 33362693] [4.14.35-2047.507.7.3] - arm64: Reserve elfcorehdr before scanning reserved memory from device tree (Dave Kleikamp) [Orabug: 33354710] [4.1…

  • High max 8.7
    ELSA-2021-9453 11 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [4.14.35-2047.507.7.4.el7] - KVM: x86: Check kvm_rebooting in kvm_spurious_fault() (Sean Christopherson) [Orabug: 33362693] [4.14.35-2047.507.7.3] - arm64: Reserve elfcorehdr before scanning reserved memory from device tree (Dave Kleikamp) [Orabug: 33354710] …