Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

297 results · Clear filters · Feed

Low

ELSA-2024-9689 1 CVE

Low: binutils security update (Oracle Linux 8)

[2.30-125.0.1] - Forward port Oracle patches from 2.30-125 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Oracle history:

Nov 15, 2024
Low max 2.8

ELSA-2024-9187 1 CVE

Low: bcc security update (Oracle Linux 9)

[0.30.0-6] - Rebuild with LLVM 18 (RHEL-28684) [0.30.0-5] - Drop python3-pyelftools dependency on s390x until it is available [0.30.0-4] - Exclude btrfs and f2fs libbpf tools (RHEL-36579) [0.30.0-3] - Really prevent the loading of compromised headers (RHEL-28…

Nov 14, 2024
Low max 2.8

ELSA-2024-9188 1 CVE

Low: bpftrace security update (Oracle Linux 9)

[0.21.1-1] - Rebase on bpftrace 0.21.1 - Add LLVM 18 support (RHEL-28685) [0.20.4-3] - Fix latest build (not built in side tag) [0.20.4-2] - Rebuild for bcc 0.30.0-4 [0.20.4-1] - Rebase on bpftrace 0.20.4 - Fix CVE allowing unprivileged users loading of compr…

Nov 14, 2024
Low max 3.1

ELSA-2024-9317 1 CVE

Low: NetworkManager security update (Oracle Linux 9)

[1.48.10-2.0.1] - disable MPTCP handling by default [Orabug: 34801142] - add connectivity check via Oracle servers [Orabug: 32051972] [1:1.48.10-2] - cloud-setup: Allow bigger restart bursts (RHEL-56740) - cloud-setup: Fix Azure swap of primary and secondary …

Nov 14, 2024
Low max 3.2

ELSA-2024-9325 1 CVE

Low: cockpit security update (Oracle Linux 9)

[323.1-1.0.1] - Replaced upstream urls in documentation with oracle links [Orabug: 36528753] - Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110] - Remove duplicate reference to server in cockpit [Orabug: 34030494] - Update documentation …

Nov 14, 2024
Low max 9.8

ELSA-2024-9333 4 CVEs

Low: openssl and openssl-fips-provider security update (Oracle Linux 9)

openssl [1:3.2.2-6.0.1] - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177] [1:3.2.2-6] - rebuilt Related: RHEL-55339 [1:3.2.2-5]…

Nov 14, 2024
Low max 7.3

ELSA-2024-9405 1 CVE

Low: vim security update (Oracle Linux 9)

[8.2.2637-21.0.1] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-21] - RHEL-40602 CVE-2021-3903 vim: heap-based buffer overflow vulnerability

Nov 14, 2024
Low max 9.1

ELSA-2024-9424 2 CVEs

Low: tpm2-tools security update (Oracle Linux 9)

[5.2-4] - Backport upstream fixes. - tpm2_checkquote: Fix check of magic number. (CVE-2024-29038) - tpm2_checkquote: Add comparison of pcr selection. (CVE-2024-29039) - Fix check of magic number. Resolves: RHEL-23198 Resolves: RHEL-41031 Resolves: RHEL-41035

Nov 14, 2024
Low max 6.7

ELSA-2024-9430 1 CVE

Low: nano security update (Oracle Linux 9)

[5.6.1-6] - fix emergency file replacement vulnerability (RHEL-35237)

Nov 14, 2024
Low max 9.8

ELSA-2024-8922 1 CVE

Low: bzip2 security update (Oracle Linux 8)

[1.0.6-27.0.1] - CVE-2019-12900: Accept as many selectors as the file format allows [Orabug: 37266061] [1.0.6-27] - Fixes out of bounds access in BZ2_decompress (RHEL-64929)

Nov 11, 2024
Low max 2.8

ELSA-2024-8830 1 CVE

Low: bpftrace security update (Oracle Linux 8)

[0.16.0-6] - Fix security hole checking unpacked kernel headers (CVE-2024-2313) - Resolves: RHEL-28764

Nov 5, 2024
Low max 2.8

ELSA-2024-8831 1 CVE

Low: bcc security update (Oracle Linux 8)

[0.25.0-9] - Really prevent the loading of compromised headers (RHEL-28768, CVE-2024-2314) [0.25.0-8] - Check header ownership (RHEL-28768)

Nov 5, 2024
Low max 5.4

ELSA-2024-8680 1 CVE

Low: mod_http2 security update (Oracle Linux 9)

[2.0.26-2.1] - Resolves: RHEL-45803 - mod_http2: DoS by null pointer in websocket over HTTP/2 (CVE-2024-36387)

Oct 30, 2024
Low max 6.0

ELSA-2024-12791 1 CVE

Low: virt:kvm_utils1 security update (Oracle Linux 8)

hivex [1.3.18-21] - Bounds check for block exceeding page length (CVE-2021-3504) resolves: rhbz#1950501 [1.3.18] - Resolves: bz#1810193 (Upgrade components in virt:rhel module:stream for RHEL-8.3 release) [1.3.18] - Resolves: bz#1810193 (Upgrade components in…

Oct 23, 2024
Low max 9.1

ELSA-2024-7848 1 CVE

Low: openssl security update (Oracle Linux 8)

[1:1.1.1k-14] - Backport fix SSL_select_next proto from OpenSSL 3.2 Fix CVE-2024-5535 Resolves: RHEL-45654

Oct 9, 2024
Low max 6.7

ELSA-2024-6986 1 CVE

Low: nano security update (Oracle Linux 8)

[2.9.8-3] - fix incomplete backport of the fix for the emergency file replacement vulnerability (RHEL-35236) [2.9.8-2] - fix emergency file replacement vulnerability (RHEL-35236)

Sep 24, 2024
Low max 5.3

ELSA-2024-5338 1 CVE

Low: pcs security update (Oracle Linux 8)

[0.10.18-2.0.1] - Replace HAM-logo.png with a generic one [0.10.18-2] - Updated rubygem rexml Resolves: RHEL-37883

Aug 16, 2024
Low max 7.5

ELSA-2024-4766 1 CVE

Low: python3 security update (Oracle Linux 9)

[3.11.7-1.3] - Security fix for CVE-2024-4032 Resolves: RHEL-44097 [3.11.7-1.2] - Enable importing of hash-based .pyc files under FIPS mode Resolves: RHEL-40785

Jul 23, 2024
Low max 7.5

ELSA-2024-4779 1 CVE

Low: python3 security update (Oracle Linux 9)

[3.9.18-3.3] - Security fix for CVE-2024-4032 Resolves: RHEL-44106 [3.9.18-3.2] - Enable importing of hash-based .pyc files under FIPS mode Resolves: RHEL-40767

Jul 23, 2024
Low max 7.5

ELSA-2024-4264 1 CVE

Low: openldap security update (Oracle Linux 8)

[2.4.46-19] - Bump version to 2.4.46-19 - Resolves: RHEL-34283 - openldap: null pointer dereference in ber_memalloc_x function

Jul 2, 2024
Low max 4.4

ELSA-2024-4249 1 CVE

Low: c-ares security update (Oracle Linux 8)

[1.13.0-11] - Resolves: RHEL-26525 - c-ares: Out of bounds read in ares__read_line() [rhel-8]

Jul 2, 2024
Low max 4.4

ELSA-2024-3842 1 CVE

Low: c-ares security update (Oracle Linux 9)

[1.19.1-2] - Resolves: RHEL-26529 - Out of bounds read in ares__read_line() [rhel-9]

Jun 11, 2024
Low max 7.5

ELSA-2024-3268 2 CVEs

Low: krb5 security update (Oracle Linux 8)

[1.18.2-27.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767] [1.18.2-27] - Fix memory leak in GSSAPI interface Resolves: RHEL-27250 - Fix memory leak in PMAP RPC interface Resolves: RHEL-27244 - Make TCP waiting time configurable Resolves:…

May 29, 2024
Low max 4.8

ELSA-2024-3233 2 CVEs

Low: libssh security update (Oracle Linux 8)

[0.9.6-14] - Fix CVE-2023-48795 Prefix truncation attack on Binary Packet Protocol (BPP) - Fix CVE-2023-6918 Missing checks for return values for digests - Fix CVE-2023-6004 ProxyCommand/ProxyJump features allow injection of malicious code through hostname - …

May 23, 2024
Low

ELSA-2024-2966 1 CVE

Low: ghostscript security update (Oracle Linux 8)

[9.27-12] - fix to prevent divison by zero in devices - Resolves: rhbz#2235009

May 23, 2024
Low max 5.5

ELSA-2024-2528 4 CVEs

Low: mingw-glib2 security update (Oracle Linux 9)

[2.78.0-1] - Bump glib2 version 2.78.0 - Drop DesktopQE gating - Fix CVEs: CVE-2023-32636, CVE-2023-29499, CVE-2023-32611, CVE-2023-32665, DoS - Resolves: RHEL-5019 - Resolves: RHEL-5020 - Resolves: RHEL-5092 - Resolves: RHEL-5093 - Resolves: RHEL-5094

May 3, 2024
Low max 6.5

ELSA-2024-2447 7 CVEs

Low: openssl and openssl-fips-provider security update (Oracle Linux 9)

openssl [1:3.0.7-27.0.3] - Enable openssl-fips-provider dependency [Orabug: 36504822] [1:3.0.7-27.0.2] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] [1:3.0.7-27.0.1] - Replace upstream references [Orabug: 34340177] [1:3.0.7-27] - Use…

May 3, 2024
Low max 4.8

ELSA-2024-2504 2 CVEs

Low: libssh security update (Oracle Linux 9)

[0.10.4-13] - Bump up the version so that the version in 9.3 is lower. - Resolves: RHEL-19310, RHEL-19691, RHEL-17245

May 2, 2024
Low

ELSA-2024-2137 1 CVE

Low: LibRaw security update (Oracle Linux 9)

[0.21.1-1] - 0.21.1 - Include the fix for CVE-2023-1729 from Fedora Resolves: RHEL-768

May 2, 2024
Low

ELSA-2024-2512 1 CVE

Low: file security update (Oracle Linux 9)

[5.39-16] - Fix stack-based buffer over-read in file_copystr() (CVE-2022-48554) [5.39-15] - Fix segfault in python3-file-magic concurrent method calls

May 2, 2024
Low max 3.7

ELSA-2024-1940 1 CVE

Low: owO: thunderbird security update (Oracle Linux 9)

[115.10.0-2.0.1] - Add Oracle prefs - Add OpenELA debranding [115.10.0-2] - Update to 115.10.0 build2 [115.10.0-1] - Update to 115.10.0 build1 - Revert expat CVE-2023-52425 fix

Apr 23, 2024
Low max 3.7

ELSA-2024-1935 1 CVE

Low: thunderbird security update (Oracle Linux 7)

[115.10.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [115.10.0-2] - Update to 115.10.0 build2 [115.10.0-1] - Update to 115.10.0 build1 - Revert expat CVE-2023-52425 fix

Apr 22, 2024
Low max 3.7

ELSA-2024-1939 1 CVE

Low: thunderbird security update (Oracle Linux 8)

[115.10.0-2.0.1] - Add Oracle prefs [115.10.0] - Add OpenELA debranding [115.10.0-2] - Update to 115.10.0 build2 [115.10.0-1] - Update to 115.10.0 build1 - Revert expat CVE-2023-52425 fix

Apr 22, 2024
Low max 2.3

ELSA-2024-1139 1 CVE

Low: keylime security update (Oracle Linux 9)

[7.3.0-13] - Backport fix for CVE-2023-3674 Resolves: RHEL-21013

Mar 6, 2024
Low max 5.3

ELSA-2024-0888 1 CVE

Low: edk2 security update (Oracle Linux 8)

[20220126gitbb1bba3d77-6.el8_9.3] - edk2-Bumped-openssl-submodule-version-to-cf317b2bb227.patch [RHEL-7560] - Resolves: RHEL-7560 (CVE-2023-3446 edk2: openssl: Excessive time spent checking DH keys and parameters [rhel-8])

Feb 20, 2024
Low max 5.3

ELSA-2023-7877 3 CVEs

Low: openssl security update (Oracle Linux 8)

[1:1.1.1k-12] - Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series (a proper fix for CVE-2020-25659) Resolves: RHEL-17696 [1:1.1.1k-11] - Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking excessively long X9.42 D…

Dec 18, 2023
Low max 5.9

ELSA-2023-7743 1 CVE

Low: curl security update (Oracle Linux 7)

[7.29.0-59.0.3.el7_9.2] - load CA certificates even with --insecure [Orabug: 32836997] - Fix TFTP small blocksize heap buffer overflow (https://curl.haxx.se/docs/CVE-2019-5482.html)[CVE-2019-5482][Orabug: 30568724] - Security Fixes [OraBug: 28939992] - CVE-20…

Dec 12, 2023
Low max 6.5

ELSA-2023-6961 1 CVE

Low: qt5-qtsvg security update (Oracle Linux 8)

[5.15.3-2] - Fix uninitialized variable usage in m_unitsPerEm (CVE-2023-32573) Resolves: bz#2208141

Nov 17, 2023
Low max 4.7

ELSA-2023-7112 1 CVE

Low: shadow-utils security and bug fix update (Oracle Linux 8)

[2:4.6-19] - gpasswd: fix password leak. Resolves: #2215947 [2:4.6-18] - Update patch to close label to reset libselinux state. Resolves: #1984740 - useradd: check if subid range exists for user. Resolves: #2012929 - find_new_[gu]id: Skip over IDs that are re…

Nov 17, 2023
Low max 6.4

ELSA-2023-7166 1 CVE

Low: tpm2-tss security and enhancement update (Oracle Linux 8)

[2.3.2-5] - Ensure layer number is in bounds Resolves: rhbz#2160302 Resolves: rhbz#2162611

Nov 17, 2023