Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,092 results · Clear filters · Feed

High max 6.9

ELSA-2021-9400 1 CVE 1 exploited

Important: bootstrap security update (Oracle Linux 7)

[3.0.0-7.0.1] - Backport jQuery CVE-2020-11023 fixes from jQuery v3.5.0 to bundled v1.10.2 [Orabug: 33181852]

Aug 9, 2021
High

ELSA-2021-3028 9 CVEs

Important: microcode_ctl security, bug fix and enhancement update (Oracle Linux 7)

[2:2.1-73.11.0.1] - for Intel, do not trigger load if on-disk microcode is not an update [Orabug: 30634727] - set early_microcode='no' in virtualized guests to avoid early load bugs [Orabug: 30618736] - ensure late loading fixes are present on 4.1.12-* and 4.…

Aug 9, 2021
High

ELSA-2021-3027 9 CVEs

Important: microcode_ctl security, bug fix and enhancement update (Oracle Linux 8)

[4:20210216-1.20210608.0.1] - add support for UEK6 kernels - enable early update for 06-4f-01 - remove no longer appropriate caveats for 06-2d-07 and 06-55-04 - enable early and late load on RHCK [4:20210216-1.20210608.1] - Update Intel CPU microcode to micro…

Aug 9, 2021
High

ELSA-2021-9397 6 CVEs

Important: olcne security update (Oracle Linux 7)

olcne [1.2.4-5] - Updated registry-image-helper.sh to work with olcne-utils [1.2.4-4] - Fix istio template for 1.9.6 for k8s update failure [1.2.4-3] - Fixed yaml file to stop olcne-nginx and keepalived services at uninstall [Orabug: 32296282] [1.2.4-2] - Fix…

Aug 6, 2021
High

ELSA-2021-9399 6 CVEs

Important: olcne security update (Oracle Linux 7)

olcne [1.3.1-5] - Updated registry-image-helper.sh to work with olcne-utils [1.3.1-4] - Fix istio template for 1.9.6 and 1.10.2 for k8s update failure [1.3.1-3] - Added END_VERSION_BLOCK for OLM image [1.3.1-2] - Fix iptables issue when running on OL7 host us…

Aug 6, 2021
High

ELSA-2021-9396 6 CVEs

Important: olcne security update (Oracle Linux 8)

olcne [1.2.4-5] - Updated registry-image-helper.sh to work with olcne-utils [1.2.4-4] - Fix istio template for 1.9.6 for k8s update failure [1.2.4-3] - Fixed yaml file to stop olcne-nginx and keepalived services at uninstall [Orabug: 32296282] [1.2.4-2] - Fix…

Aug 6, 2021
High max 8.8

ELSA-2021-3020 4 CVEs

Important: ruby:2.7 security update (Oracle Linux 8)

ruby [2.7.4-137] - Upgrade to Ruby 2.7.4. - Fix command injection vulnerability in RDoc. Resolves: rhbz#1986768 - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host. Resolves: rhbz#1986812 - Fix StartTLS stripping vulnerability in N…

Aug 6, 2021
High

ELSA-2021-9398 6 CVEs

Important: olcne security update (Oracle Linux 8)

olcne [1.3.1-5] - Updated registry-image-helper.sh to work with olcne-utils [1.3.1-4] - Fix istio template for 1.9.6 and 1.10.2 for k8s update failure [1.3.1-3] - Added END_VERSION_BLOCK for OLM image [1.3.1-2] - Fix iptables issue when running on OL7 host us…

Aug 6, 2021
High max 8.3

ELSA-2021-9395 4 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.53.5] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33143006] {CVE-2021-33909} [4.1.12-124.53.3] - net/mlx4: Fix EEPROM dump support (Vladyslav Tarasiuk) [Orabug: 31895301] {CVE-2020-14304} - net/mlx4_en: etht…

Aug 4, 2021
High

ELSA-2021-2988 1 CVE

Important: varnish:6 security update (Oracle Linux 8)

varnish [6.0.6-2.1] - Resolves: #1982861 - CVE-2021-36740 varnish:6/varnish: HTTP/2 request smuggling attack via a large Content-Length header for a POST request varnish-modules [0.15.0-5] - Related: #1795673 - RFE: rebase varnish:6 to latest 6.0.x LTS

Aug 3, 2021
High

ELSA-2021-2989 1 CVE

Important: lasso security update (Oracle Linux 7)

[2.5.1-8] - Fix Coverity warning introduced by the previous patch - Related: #1963855 - CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses [2.5.1-7] - Fix Coverity warning introduced by the previous patch - Related: #196385…

Aug 2, 2021
High

ELSA-2021-2881 4 CVEs

Important: thunderbird security update (Oracle Linux 7)

[78.12.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [78.12.0-2] - Update to 78.12.0 build2 [78.12.0-1] - Update to 78.12.0 build1

Jul 27, 2021
High

ELSA-2021-2883 4 CVEs

Important: thunderbird security update (Oracle Linux 8)

[78.12.0-3.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [78.12.0-3] - Rebuild to pickup older nss [78.12.0-2] - Update to 78.12.0 build2 [78.12.0-1] - Update to 78.12.0 build1

Jul 27, 2021
High max 5.0

ELSA-2021-15790 1 CVE

Important: containerd security update (Oracle Linux 7)

containerd [1.4.8-1] - Address CVE-2021-32760 docker-cli [19.03.11-13] - updated containerd minimum version to 1.4.8 to address CVE-2021-32760. docker-engine [19.03.11-13] - updated containerd minimum version to 1.4.8 to address CVE-2021-32760.

Jul 23, 2021
High max 5.0

ELSA-2021-9373 1 CVE

Important: containerd security update (Oracle Linux 7)

containerd [1.4.8-1] - Address CVE-2021-32760 docker-cli [19.03.11-13] - updated containerd minimum version to 1.4.8 to address CVE-2021-32760. docker-engine [19.03.11-13] - updated containerd minimum version to 1.4.8 to address CVE-2021-32760.

Jul 23, 2021
High

ELSA-2021-9369 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.52.5] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33135634] {CVE-2021-33909}

Jul 22, 2021
High

ELSA-2021-9368 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.505.4.3] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33142065] {CVE-2021-33909}

Jul 22, 2021
High max 7.5

ELSA-2021-2784 3 CVEs

Important: java-11-openjdk security update (Oracle Linux 7)

[1:11.0.12.0.7-0.0.1] - link atomic for ix86 build [1:11.0.12.0.7-0] - Update to jdk-11.0.12.0+7 - Update release notes to 11.0.12.0+7 - Switch to GA mode for final release. - This tarball is embargoed until 2021-07-20 @ 1pm PT. - Resolves: rhbz#1972395 [1:11…

Jul 22, 2021
High

ELSA-2021-9370 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.505.4.3.el7] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33142065] {CVE-2021-33909}

Jul 22, 2021
High max 7.5

ELSA-2021-2845 3 CVEs

Important: java-1.8.0-openjdk security and bug fix update (Oracle Linux 7)

[1:1.8.0.302.b08-0] - Update to aarch64-shenandoah-jdk8u302-b08 (EA) - Update release notes for 8u302-b08. - Switch to GA mode for final release. - This tarball is embargoed until 2021-07-20 @ 1pm PT. - Resolves: rhbz#1972395 [1:1.8.0.302.b07-0.0.ea] - Update…

Jul 22, 2021
High max 7.5

ELSA-2021-2776 3 CVEs

Important: java-1.8.0-openjdk security update (Oracle Linux 8)

[1:1.8.0.302.b08-0] - Update to aarch64-shenandoah-jdk8u302-b08 (EA) - Update release notes for 8u302-b08. - Switch to GA mode for final release. - This tarball is embargoed until 2021-07-20 @ 1pm PT. - Resolves: rhbz#1972395 [1:1.8.0.302.b07-0.0.ea] - Update…

Jul 22, 2021
High

ELSA-2021-9372 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2102.203.6.el7] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33135632] {CVE-2021-33909}

Jul 22, 2021
High max 7.5

ELSA-2021-2781 3 CVEs

Important: java-11-openjdk security update (Oracle Linux 8)

[1:11.0.12.0.7-0] - Update to jdk-11.0.12.0+7 - Update release notes to 11.0.12.0+7 - Switch to GA mode for final release. - This tarball is embargoed until 2021-07-20 @ 1pm PT. - Resolves: rhbz#1972395 [1:11.0.12.0.6-0.0.ea] - Update to jdk-11.0.12.0+6 - Upd…

Jul 22, 2021
High

ELSA-2021-9371 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2102.203.6.el8uek] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33135632] {CVE-2021-33909}

Jul 22, 2021
High

ELSA-2021-2725 5 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1160.36.2.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and…

Jul 21, 2021
High max 5.5

ELSA-2021-2717 1 CVE

Important: systemd security update (Oracle Linux 8)

[239-45.0.2] - Disable unprivileged BPF by default [Orabug: 32870980] - backport upstream pstore tmpfiles patch [Orabug: 31420486] - udev rules: fix memory hot add and remove [Orabug: 31310273] - fix to enable systemd-pstore.service [Orabug: 30951066] - journ…

Jul 21, 2021
High

ELSA-2021-2714 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 8)

[4.18.0-305.10.2_4.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

Jul 21, 2021
High

ELSA-2021-2741 3 CVEs

Important: firefox security update (Oracle Linux 7)

[78.12.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.12.0-1] - Update to 78.12.0 build1

Jul 16, 2021
High max 6.7

ELSA-2021-9362 10 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2102.203.5] - rds/ib: move rds_ib_clear_irq_miss() to .h file (Manjunath Patil) [Orabug: 33044344] [5.4.17-2102.203.4] - rds/ib: recover rds connection from interrupt loss scenario (Manjunath Patil) [Orabug: 32974199] - Revert Allow mce to reset inste…

Jul 16, 2021
High max 6.7

ELSA-2021-9363 10 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2102.203.5] - rds/ib: move rds_ib_clear_irq_miss() to .h file (Manjunath Patil) [Orabug: 33044344] [5.4.17-2102.203.4] - rds/ib: recover rds connection from interrupt loss scenario (Manjunath Patil) [Orabug: 32974199] - Revert 'Allow mce to reset inst…

Jul 16, 2021
High

ELSA-2021-2743 3 CVEs

Important: firefox security update (Oracle Linux 8)

[78.12.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.12.0-1] - Update to 78.12.0 build1

Jul 16, 2021
High max 7.5

ELSA-2021-2683 1 CVE

Important: xstream security update (Oracle Linux 7)

[1.3.1-14] - Fix remote code execution vulnerability - Resolves: CVE-2021-29505

Jul 13, 2021
High max 6.7

ELSA-2021-9349 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.505.4] - rds/ib: move rds_ib_clear_irq_miss() to .h file (Manjunath Patil) [Orabug: 33044345] - rds/ib: recover rds connection from interrupt loss scenario (Manjunath Patil) [Orabug: 32804265] - rds/ib: handle posted ACK during connection shutdo…

Jul 12, 2021
High max 6.7

ELSA-2021-9351 4 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.505.4.el7] - rds/ib: move rds_ib_clear_irq_miss() to .h file (Manjunath Patil) [Orabug: 33044345] - rds/ib: recover rds connection from interrupt loss scenario (Manjunath Patil) [Orabug: 32804265] - rds/ib: handle posted ACK during connection sh…

Jul 12, 2021
High

ELSA-2021-2658 1 CVE

Important: linuxptp security update (Oracle Linux 7)

[2.0-2.el7_9.1] - validate length of forwarded messages (CVE-2021-3570)

Jul 7, 2021
High

ELSA-2021-2660 1 CVE

Important: linuxptp security update (Oracle Linux 8)

[2.0-5.el8_4.1] - validate length of forwarded messages (CVE-2021-3570)

Jul 7, 2021
High

ELSA-2021-9346 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.52.4] - IB/core: Only update PKEY and GID caches on respective events (Hakon Bugge) [Orabug: 32816368] - Revert 'Allow mce to reset instead of panic on UE' (William Roche) [Orabug: 32820278] - Bluetooth: verify AMP hci_chan before amp_destroy (Arc…

Jul 2, 2021
High

ELSA-2021-2308 4 CVEs

Important: microcode_ctl security, bug fix and enhancement update (Oracle Linux 8)

[4:20210216-1.20210525.0.1] - add support for UEK6 kernels - remove no longer appropriate caveats for 06-2d-07 and 06-55-04 [4:20210216-1.20210525.1] - Update Intel CPU microcode to microcode-20210525 release, addresses CVE-2020-24489, CVE-2020-24511, CVE-202…

Jul 1, 2021
High max 6.5

ELSA-2021-2570 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 8)

[4.18.0-305.7.1_4.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genk…

Jul 1, 2021
High max 7.6

ELSA-2021-15112 1 CVE

Important: docker-engine docker-cli security update (Oracle Linux 7)

docker-engine [19.03.11-11] - Addresses CVE-2021-30465 - updated runc minimum version to runc >= 3:1.0.0-1.rc95. [19.03.11-10] - Addresses runc CVE-2021-30465 - updated runc versions in cli/vendor.conf and docker-engine/vendor.conf to 1.0.0-rc95.

Jun 29, 2021