Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

297 results · Clear filters · Feed

  • Low max 3.7
    ELSA-2023-7016 1 CVE

    Low: libpq security update (Oracle Linux 8)

    [13.11-1] - Rebase to 13.11 Resolves: #2171369

  • Low max 2.5
    ELSA-2023-7187 1 CVE

    Low: procps-ng security update (Oracle Linux 8)

    [3.3.15-14.0.1] - ps: remove uptime integer conversion [Orabug: 35909165] - ps: improved three elapsed 'jiffies/tics' calculations [Orabug: 35909165] - Set TZ to avoid repeated stat('/etc/localtime') [Orabug: 32769816] [3.3.15-14] - CVE-2023-4016: ps: possibl…

  • Low max 7.1
    ELSA-2023-7160 1 CVE

    Low: opensc security and bug fix update (Oracle Linux 8)

    [0.20.0-6] - Fix introduced issues tagged by coverity (RHEL-765) [0.20.0-5] - Avoid potential crash because of missing list terminator (#2196234) - Fix CVE-2023-2977: potential buffer overrun in pkcs15 cardos_have_verifyrc_package (#2211093) - Backport upstre…

  • Low max 7.5
    ELSA-2023-6316 1 CVE

    Low: pcs (Oracle Linux 9)

    [0.11.6-3] - Refreshing any page in pcs-web-ui no longer causes it to display a blank page - Resolves: rhbz#2222788 [0.11.6-2] - Added BuildRequires: debugedit - for generating MiniDebugInfo - triggered by removing find-debuginfo.sh from rpm - Make use of fil…

  • Low max 6.4
    ELSA-2023-6685 1 CVE

    Low: tpm2-tss security and enhancement update (Oracle Linux 9)

    [3.2.2-2] - Remove misapplied license Resolves: rhbz#2160307 [3.2.2-1] - Rebase to 3.2.2 - Use systemd-sysusers to create user Resolves: CVE-2023-22745 Resolves: rhbz#2095479 Resolves: rhbz#2160307 Resolves: rhbz#2162613

  • Low max 2.5
    ELSA-2023-6705 1 CVE

    Low: procps-ng security and bug fix update (Oracle Linux 9)

    [3.3.17-13.0.1] - ps: remove uptime integer conversion [Orabug: 35909347] - ps: improved three elapsed 'jiffies/tics' calculations [Orabug: 35909347] [3.3.17-13] - ps: mitigation of possible buffer overflow - Resolves: rhbz#2228504 [3.3.17-12] - sysctl: '-N' …

  • Low
    ELSA-2023-6661 1 CVE

    Low: gmp security and enhancement update (Oracle Linux 9)

    [1:6.2.0-13] - Fix: previous commit removed one function from the library and thus broke the ABI - function gmpn_preinv_divrem_1 should now not be removed Related: rhbz#2044216 [1:6.2.0-12] - Add SIMD optimization patches for s390x (provided by the IBM) Resol…

  • Low max 3.7
    ELSA-2023-6429 1 CVE

    Low: libpq security update (Oracle Linux 9)

    [13.11-1] - Update to 13.11 Resolves: #2171370

  • Low
    ELSA-2023-6372 1 CVE

    Low: gdb security update (Oracle Linux 9)

    [10.2.11.0.1] - Merge Oracle patches for ol9 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> [10.2-11.el9] - Backport 'libiberty: prevent buffer overflow when decoding user input' (Luis Ferreira, RHBZ2132600) * Mon Mar 27 2023 Bruno Larsen <blarsen@r…

  • Low max 4.7
    ELSA-2023-6632 1 CVE

    Low: shadow-utils security and bug fix update (Oracle Linux 9)

    [2:4.9-8] - gpasswd: fix password leak. Resolves: #2215948 [2:4.9-7] - useradd: check if subid range exists for user. Resolves: #2179987 - find_new_[gu]id: Skip over IDs that are reserved for legacy reasons. Resolves: #2179988

  • Low max 7.1
    ELSA-2023-6587 1 CVE

    Low: opensc security update (Oracle Linux 9)

    [0.23.0-2] - Fix regression in handling OpenPGP cards - Fix CVE-2023-2977: buffer overrun in pkcs15init for cardos [0.23.0-1] - Rebase to latest 0.23.0 release (#2100409) - Use separate OpenSSL context to work better from inside of OpenSSL providers

  • Low max 5.5
    ELSA-2023-6631 3 CVEs

    Low: glib2 security and bug fix update (Oracle Linux 9)

    [2.68.4-11] - Really fix authentication failures when sd-bus clients connect to GDBus servers - Resolves: #2217771 [2.68.4-10] - Fix authentication failures when sd-bus clients connect to GDBus servers - Resolves: #2217771 [2.68.4-9] - Resolve s390x crashes i…

  • Low max 7.8
    ELSA-2023-6167 1 CVE

    Low: libguestfs-winsupport security update (Oracle Linux 9)

    [9.2-2] - Rebase to ntfs-3g 2022.10.3 - Fixes: CVE-2022-40284 - resolves: rhbz#2236130

  • Low max 4.8
    ELSA-2023-28766 1 CVE

    Low: cross-gcc security update (Oracle Linux 8)

    [11.2.1-5.0.2] - CVE-2023-4039 mitigation. Orabug 35752004. - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

  • Low max 6.5
    ELSA-2023-12788 2 CVEs

    Low: gcc security update (Oracle Linux 8)

    gcc [el8] [8.5.0-18.0.5] - CVE-2023-4039 GCC mitigation. Orabug 35751743. Includes removal of aarch64-preserve-args.patch. - CVE-2022-40982 'Intel Downfall' mitigation. Orabug 35751810. Add two patches originally from GCC upstream releases/gcc-11 branch. with…

  • Low max 4.8
    ELSA-2023-28765 1 CVE

    Low: cross-gcc security update (Oracle Linux 8)

    [12.1.1-2.0.4] - CVE-2023-4039 mitigation. Orabug 35752028. - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

  • Low max 7.5
    ELSA-2023-12709 2 CVEs

    Low: python-werkzeug security update (Oracle Linux 8)

    [0.12.2-4.0.1] - Fix CVE-2023-23934 [Orabug: 35662419] - Fix CVE-2023-25577 [Orabug: 35662419] - enable tests [Orabug: 35662419]

  • Low max 3.9
    ELSA-2023-3949 1 CVE 1 exploited

    Low: open-vm-tools security update (Oracle Linux 8)

    [12.1.5-1.0.2] - [CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module

  • Low max 3.9
    ELSA-2023-3948 1 CVE 1 exploited

    Low: open-vm-tools security update (Oracle Linux 9)

    [12.1.5-1.0.2] - [CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module

  • Low max 3.9
    ELSA-2023-3944 1 CVE 1 exploited

    Low: open-vm-tools security and bug fix update (Oracle Linux 7)

    [11.0.5-3.0.1] - fix spaces in vmware udev rule for scsi devices [Orabug: 24461968] - Fix vmware udev rule in 99-vmware-scsi-timeout.rules file. [Orabug: 22815019] - Increase timeout for scsi devices on VMWare guests by adding a udev rule. - Created a new fil…

  • Low max 5.9
    ELSA-2023-2963 2 CVEs

    Low: curl security and bug fix update (Oracle Linux 8)

    [7.61.1-30] - fix HTTP multi-header compression denial of service (CVE-2023-23916) [7.61.1-29] - h2: lower initial window size to 32 MiB (#2166254) [7.61.1-28] - smb/telnet: fix use-after-free when HTTP proxy denies tunnel (CVE-2022-43552) [7.61.1-27] - upon …

  • Low
    ELSA-2023-3018 1 CVE

    Low: libarchive security update (Oracle Linux 8)

    [3.3.3-5] - Fix for CVE-2022-36227

  • Low
    ELSA-2023-2987 1 CVE

    Low: samba security, bug fix, and enhancement update (Oracle Linux 8)

  • Low
    ELSA-2023-2582 1 CVE

    Low: lua security update (Oracle Linux 9)

    [5.4.4-3] - Apply upstream patch for CVE-2022-28805

  • Low max 7.5
    ELSA-2023-2523 1 CVE

    Low: openssl security and bug fix update (Oracle Linux 9)

    [3.0.7-6.0.1] - Replace upstream references [Orabug: 34340177] [1:3.0.7-6] - Fixes RNG slowdown in FIPS mode Resolves: rhbz#2168224 [1:3.0.7-5] - Fixed X.509 Name Constraints Read Buffer Overflow Resolves: CVE-2022-4203 - Fixed Timing Oracle in RSA Decryption…

  • Low max 5.9
    ELSA-2023-2478 2 CVEs

    Low: curl security update (Oracle Linux 9)

    [7.76.1-23] - fix HTTP multi-header compression denial of service (CVE-2023-23916) [7.76.1-22] - smb/telnet: fix use-after-free when HTTP proxy denies tunnel (CVE-2022-43552) [7.76.1-21] - fix POST following PUT confusion (CVE-2022-32221) [7.76.1-20] - contro…

  • Low
    ELSA-2023-2519 1 CVE

    Low: samba security, bug fix, and enhancement update (Oracle Linux 9)

    evolution-mapi [3.40.1-5] - Related: #2131993 (Rebuild against samba 4.17) openchange [2.3-40] - Related: #2131993 (Rebuild against samba 4.17) samba [4.17.5-102.0.1] - Fix memleak in _nss_winbind_initgroups_dyn [Orabug: 34994509] [4.17.5-102] - resolves: rhb…

  • Low
    ELSA-2023-2532 1 CVE

    Low: libarchive security update (Oracle Linux 9)

    [3.5.3-4] - Resolves: CVE-2022-36227

  • Low max 7.1
    ELSA-2022-8431 2 CVEs

    Low: podman security, bug fix, and enhancement update (Oracle Linux 9)

    [4.2.0-7.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [2:4.2.0-7] - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel (https://github.com/containers/podman/commit/35c0df3) - Resolves…

  • Low max 7.1
    ELSA-2022-7822 2 CVEs

    Low: container-tools:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

    aardvark-dns [2:1.1.0-5] - fix 'Two aardvark-dns instances trying to use the same port on the same interface' - Resolves: #2130234 buildah [1:1.27.2-2] - update to the latest content of https://github.com/containers/buildah/tree/release-1.27 (https://github.c…

  • Low
    ELSA-2022-7979 1 CVE

    Low: speex security update (Oracle Linux 9)

    [1.2.0-11] - CVE-2020-23903 speex: divide by zero in read_samples() via crafted WAV file - Resolves: CVE-2020-23903

  • Low
    ELSA-2022-8207 1 CVE

    Low: openjpeg2 security update (Oracle Linux 9)

    [2.4.0-7] - Fix CVE-2022-1122

  • Low
    ELSA-2022-8415 1 CVE

    Low: mingw-gcc security and bug fix update (Oracle Linux 9)

    [12.0.1-11.2] - Bump release and rebuild resolves: rhbz#2096010 [12.0.1-11.1] - Rebase to Fedora Rawhide resolves: rhbz#2080170

  • Low max 3.9
    ELSA-2022-8096 2 CVEs

    Low: redis security and bug fix update (Oracle Linux 9)

    [6.2.7-1] - rebase to 6.2.7 #2083151

  • Low max 7.5
    ELSA-2022-8299 1 CVE

    Low: curl security update (Oracle Linux 9)

    [7.76.1-19] - fix unpreserved file permissions (CVE-2022-32207) - fix HTTP compression denial of service (CVE-2022-32206) - fix FTP-KRB bad message verification (CVE-2022-32208) [7.76.1-18] - fix too eager reuse of TLS and SSH connections (CVE-2022-27782) [7.…

  • Low
    ELSA-2022-7958 1 CVE

    Low: libguestfs security, bug fix, and enhancement update (Oracle Linux 9)

    [1.48.4-2.0.1] - Add btrfs-progs to the packages installed in the appliance [Orabug: 34137448] - Replace upstream references from a description tag - Fix build on Oracle Linux [Orabug: 29319324] - Set DISTRO_ORACLE_LINUX correspeonding to ol [1:1.48.4-2] - Re…

  • Low
    ELSA-2022-7968 1 CVE

    Low: virt-v2v security, bug fix, and enhancement update (Oracle Linux 9)

    [2.0.7-6.0.1] - Replaced bugzilla.oracle.com references [Orabug: 34202300] - replaced upstream references [Orabug:34089586] [1:2.0.7-6] - Install qemu-ga package during conversion resolves: rhbz#2028764 [1:2.0.7-5] - Remove LVM2 devices file during conversion…

  • Low max 6.2
    ELSA-2022-8100 1 CVE

    Low: swtpm security and bug fix update (Oracle Linux 9)

    [0.7.0-3.20211109gitb79fd91] - Disable OpenSSL FIPS mode to avoid libtpms failures Resolves: rhbz#2090219 [0.7.0-2.20211109gitb79fd91] - Add fix for CVE-2022-23645. Resolves: rhbz#2056518

  • Low
    ELSA-2022-8418 1 CVE

    Low: mingw-glib2 security and bug fix update (Oracle Linux 9)

    [2.70.1-2] - Rebuild for mingw-zlib update resolves: rhbz#2116278

  • Low
    ELSA-2022-8003 1 CVE

    Low: libvirt security, bug fix, and enhancement update (Oracle Linux 9)

    [8.5.0-7.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] [8.5.0-7] - security_selinux: Dont ignore NVMe disks when setting image label (rhbz#2121441) [8.5.0-6] - qemu_process: Destroy domains namespace after killing QEMU (rhbz#2121141) [8.5.0-5…