Oracle Linux Security Advisories (ELSA)

297 results · Clear filters · Feed

• Low max 3.9
  ELSA-2026-69553 2 CVEs

  Low: libarchive security update (Oracle Linux 10)

  [3.7.7-11] - Related: CVE-2026-16517 and CVE-2026-15028

  Sep 23, 2026
• Low max 7.5
  ELSA-2026-67583 1 CVE

  Low: rsyslog security update (Oracle Linux 9)

  [8.2510.0-2.0.1.el9_8.1] - Fixes rsyslog segfault during shutdown when relp is configured with TLS [Orabug: 37588023] [8.2510.0-2.1] - Backport: imptcp: guard regex-framing match against iCurrLine == 0 Resolves: RHEL-212699

  Sep 16, 2026
• Low max 9.8
  ELSA-2026-59347 1 CVE

  Low: httpd security update (Oracle Linux 9)

  [2.4.62-13.0.1.el9_8.6] - Replace index.html with Oracle's index page oracle_index.html. [2.4.62-13.6] - Resolves: RHEL-190807 - httpd: use-after-free in mod_ldap uldap_connection_find via per-directory client cert list (CVE-2026-29167) [2.4.62-13.5] - Resolv…

  Aug 25, 2026
• Low max 5.6
  ELSA-2026-48197 1 CVE

  Low: php:8.3 security, bug fix, and enhancement update (Oracle Linux 9)

  php [8.3.32-1] - rebase to 8.3.32 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 [5.1.21-1] - update to 5.1.21 for PHP 8.1 #2070040 php-pecl-redis6 [6.1.0-3] - use valkey for tests [6.1.0-2] - ignore 1 ONLINE test [6.1.0-1] - RHEL build [6…

  Aug 7, 2026
• Low
  ELSA-2026-49870 1 CVE

  Low: kernel security, bug fix, and enhancement update (Oracle Linux 9)

  [5.14.0-687.34.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  Aug 5, 2026
• Low max 5.6
  ELSA-2026-49914 1 CVE

  Low: php8.4 security, bug fix, and enhancement update (Oracle Linux 10)

  [8.4.23-1] - rebase to 8.4.23

  Aug 4, 2026
• Low max 5.6
  ELSA-2026-47749 1 CVE

  Low: php:8.2 security, bug fix, and enhancement update (Oracle Linux 8)

  libzip php [8.2.32-1] - rebase to 8.2.32 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip

  Aug 2, 2026
• Low max 5.6
  ELSA-2026-47750 1 CVE

  Low: php:7.4 security, bug fix, and enhancement update (Oracle Linux 8)

  libzip php [7.4.33-5] - Fix Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD CVE-2026-14355 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug php-pecl-zip

  Aug 2, 2026
• Low max 5.6
  ELSA-2026-48170 1 CVE

  Low: php security, bug fix, and enhancement update (Oracle Linux 10)

  [8.3.32-1] - rebase to 8.3.32

  Jul 29, 2026
• Low max 7.5
  ELSA-2026-28234 1 CVE

  Low: libxml2 security update (Oracle Linux 10)

  [2.12.5-10.2] - Fix CVE-2025-6170 (RHEL-182007) [2.12.5-10.1] - Fix CVE-2024-34459 (RHEL-177890)

  Jul 21, 2026
• Low max 5.6
  ELSA-2026-40416 1 CVE

  Low: php:8.2 security, bug fix, and enhancement update (Oracle Linux 9)

  php [8.2.32-1] - rebase to 8.2.32 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd [2.0.3-4] - build for PHP 8.1 #2070040 [2.0.3-3] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 [2.0.3-2] - Rebuilt for …

  Jul 17, 2026
• Low max 7.5
  ELSA-2026-28235 1 CVE

  Low: libtasn1 security update (Oracle Linux 10)

  [4.20.0-5] - Fix for CVE-2025-13151 stack buffer overflow [4.20.0-4] - Switch to autosetup [4.20.0-3] - plans/ci: modify plan names [4.20.0-2] - Properly check valgrind arches

  Jul 16, 2026
• Low max 2.5
  ELSA-2026-39304 1 CVE

  Low: libxml2 security update (Oracle Linux 10)

  [2.12.5-10.2] - Fix CVE-2025-6170 (RHEL-182007) [2.12.5-10.1] - Fix CVE-2024-34459 (RHEL-177890)

  Jul 16, 2026
• Low max 6.7
  ELSA-2026-39311 1 CVE

  Low: qemu-kvm security update (Oracle Linux 9)

  [10.1.0-17.el9_8.4] - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184527] - Resolves: RHEL-184527 (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z])

  Jul 14, 2026
• Low max 2.5
  ELSA-2026-39317 1 CVE

  Low: libxml2 security update (Oracle Linux 9)

  [2.9.13-14.2] - Fix CVE-2025-6170 (RHEL-182016)

  Jul 14, 2026
• Low max 7.5
  ELSA-2026-36728 1 CVE

  Low: libtasn1 security update (Oracle Linux 8)

  [4.13-6] - Backport the fix for CVE-2025-13151 (RHEL-139546)

  Jul 8, 2026
• Low max 2.5
  ELSA-2026-36734 1 CVE

  Low: libxml2 security update (Oracle Linux 8)

  [2.9.7-21.6] - Fix CVE-2025-6170 (RHEL-182012)

  Jul 8, 2026
• Low max 3.3
  ELSA-2026-18142 1 CVE

  Low: NetworkManager security update (Oracle Linux 10)

  [1.56.0-1.0.1] - Add connectivity check via Oracle servers [Orabug: 32051972] [1:1.56.0-1] - Update to 1.56.0 [1:1.55.91-1] - Update to 1.56.0 (rc2) - Fix CVE-2025-9615 (RHEL-111772) [1:1.55.90-1] - Update to 1.56.0 (rc1) - Support setting protocol version of…

  Jul 8, 2026
• Low max 5.3
  ELSA-2026-19042 1 CVE

  Low: python-jwcrypto security update (Oracle Linux 10)

  [1.5.6-5] - Fix CVE-2026-39373: Memory exhaustion via crafted compressed JWE tokens

  Jul 8, 2026
• Low max 7.5
  ELSA-2026-28253 1 CVE

  Low: libtasn1 security update (Oracle Linux 9)

  [4.16.0-10] - Backport the fix for CVE-2025-13151 (RHEL-139568)

  Jun 23, 2026
• Low max 7.5
  ELSA-2026-28254 1 CVE

  Low: libxml2 security update (Oracle Linux 9)

  [2.9.13-14.1] - Fix CVE-2024-34459 (RHEL-177882)

  Jun 23, 2026
• Low max 7.5
  ELSA-2026-26354 1 CVE

  Low: libxml2 security update (Oracle Linux 8)

  [2.9.7-21.5] - Fix CVE-2024-34459 (RHEL-36405)

  Jun 16, 2026
• Low max 3.3
  ELSA-2026-18597 1 CVE

  Low: NetworkManager security update (Oracle Linux 9)

  [1.54.3-2.0.1] - disable MPTCP handling by default [Orabug: 34801142] - add connectivity check via Oracle servers [Orabug: 32051972] - Add a dropin file to make Networkmanager-dispatcher persistent [Orabug: 36989910] - Drop 777 permissions from the NetworkMan…

  Jun 12, 2026
• Low max 5.3
  ELSA-2026-19197 1 CVE

  Low: python-jwcrypto security update (Oracle Linux 9)

  [1.5.6-3] - Limit max plaintext size for JWE decompression Resolves: RHEL-166029

  Jun 12, 2026
• Low max 6.5
  ELSA-2023-0099 1 CVE

  Low: virt:ol and virt-devel:ol security and bug fix update (Oracle Linux 8)

  libvirt [8.0.0-10.1.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] - Add runtime deps for pkg librbd1 >= 1:10.2.5 (Keshav Sharma) [8.0.0-10.1.el8] - qemu_process: Don't require a hugetlbfs mount for memfd (rhbz#2132176) - qemu_namespace: Toler…

  Feb 16, 2026
• Low
  ELSA-2022-0886 1 CVE

  Low: virt:ol and virt-devel:ol security update (Oracle Linux 8)

  qemu-kvm [4.2.0-59.el8_5.2] - kvm-virtiofsd-Drop-membership-of-all-supplementary-group.patch [bz#2048627] - Resolves: bz#2048627 (CVE-2022-0358 virt:rhel/qemu-kvm: QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405 [rhel-8.5.0.z])

  Feb 16, 2026
• Low
  ELSA-2021-5238 2 CVEs

  Low: virt:ol and virt-devel:ol security update (Oracle Linux 8)

  qemu-kvm [4.2.0-59.el8_5] - kvm-hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch [bz#2025605] - kvm-e1000-fix-tx-re-entrancy-problem.patch [bz#2025011] - Resolves: bz#2025605 (CVE-2021-3930 virt:rhel/qemu-kvm: QEMU: off-by-one error in mode_sense_pa…

  Feb 16, 2026
• Low
  ELSA-2021-3061 5 CVEs

  Low: virt:ol and virt-devel:ol security and bug fix update (Oracle Linux 8)

  hivex [1.3.18-21] - Bounds check for block exceeding page length (CVE-2021-3504) resolves: rhbz#1950501 libvirt [6.0.0-35.1.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] - Add runtime deps for pkg librbd1 >= 1:10.2.5 (Keshav Sharma) - Disable…

  Feb 16, 2026
• Low
  ELSA-2021-1064 1 CVE

  Low: virt:ol and virt-devel:ol security update (Oracle Linux 8)

  libvirt [6.0.0-28.1.0.1] - Add runtime deps for pkg librbd1 >= 1:10.2.5 (Keshav Sharma) qemu-kvm [4.2.0-34.el8_3.5] - kvm-Drop-bogus-IPv6-messages.patch [bz#1939493] - Resolves: bz#1939493 (CVE-2020-10756 virt:rhel/qemu-kvm: QEMU: slirp: networking out-of-bou…

  Feb 16, 2026
• Low max 7.3
  ELSA-2025-22040 3 CVEs

  Low: xorg-x11-server security update (Oracle Linux 7)

  [1.20.4-29.0.5] - Security update for CVE-2025-62229 CVE-2025-62230 CVE-2025-62231 [Orabug: 38691191] [1.20.4-29.0.3] - Fix CVE-2025-49175, CVE-2025-49176, CVE-2025-49178, CVE-2025-49179, CVE-2025-49180 [Orabug: 38157695] [1.20.4-29.0.1] - Fixed CVE-2025-2659…

  Dec 12, 2025
• Low max 3.7
  ELSA-2025-19720 1 CVE

  Low: libsoup3 security update (Oracle Linux 10)

  [3.6.5-9] - Revert 'Fix handling of invalid dates in cookie expires attribute (CVE-2025-11021)' [3.6.5-8] - Fix integer overflow in date/time parsing [3.6.5-7] - Fix handling of invalid dates in cookie expires attribute (CVE-2025-11021) [3.6.5-6] - Add patch …

  Nov 4, 2025
• Low max 7.1
  ELSA-2025-12876 1 CVE

  Low: ncurses security update (Oracle Linux 9)

  [6.2-10.20210508.el9_6.2] - remove execute permissions from ANNOUNCE file (RHEL-102738) [6.2-10.20210508.el9_6.1] - guard against corrupt terminfo data in string conversion (CVE-2022-29458 RHEL-100139)

  Aug 5, 2025
• Low max 4.7
  ELSA-2025-8419 1 CVE

  Low: python36:3.6 security update (Oracle Linux 8)

  python36 python-distro python-docs python-docutils python-nose python-pygments python-pymongo [3.7.0-2] - Backport CVE-2024-5629

  Jun 3, 2025
• Low
  ELSA-2025-8395 1 CVE

  Low: rsync security update (Oracle Linux 8)

  [3.1.3-23] - Resolves: RHEL-52004 - Slowness in rsync due to extra validation steps [3.1.3-22] - Resolves: RHEL-91519 - Improper Pointer Arithmetic in pcl

  Jun 2, 2025
• Low max 7.8
  ELSA-2025-7440 1 CVE

  Low: vim security update (Oracle Linux 9)

  [8.2.2637-22.0.1] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-22] - RHEL-2159 vim: Heap Use After Free in function ins_compl_get_exp in vim/vim

  May 22, 2025
• Low
  ELSA-2025-7427 1 CVE

  Low: xterm security update (Oracle Linux 9)

  [366-10] - Fix CVE-2022-45063 - Resolves: RHEL-87485

  May 21, 2025
• Low max 7.5
  ELSA-2025-3631 1 CVE

  Low: python3.12 security update (Oracle Linux 9)

  [3.12.5-2.3] - Security fix for CVE-2024-7592 Resolves: RHEL-85300

  Apr 7, 2025
• Low max 7.5
  ELSA-2025-3634 1 CVE

  Low: python3.11 security update (Oracle Linux 9)

  [3.11.9-7.3] - Security fix for CVE-2024-7592 Resolves: RHEL-85299

  Apr 7, 2025
• Low max 8.6
  ELSA-2025-0083 1 CVE

  Low: cups security update (Oracle Linux 8)

  [1:2.2.6-62] - RHEL-60338 CVE-2024-47175 cups: remote command injection via attacker controlled data in PPD file

  Jan 9, 2025
• Low max 8.6
  ELSA-2024-9470 1 CVE

  Low: cups security update (Oracle Linux 9)

  [1:2.3.3op2-31] - RHEL-60343 CVE-2024-47175 cups: remote command injection via attacker controlled data in PPD file

  Nov 20, 2024