Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

45 results · Clear filters · Feed

  • Medium max 10.0
    ELSA-2026-96235 4 CVEs 1 exploited

    Moderate: ruby security, bug fix, and enhancement update (Oracle Linux 10)

    [3.3.13-16] - Rebase to Ruby 3.3.13. Resolves: RHEL-300972 - Fix: integer overflow issue in regular expression compiler (CVE-2026-110264) Resolves: RHEL-292066 - Fix: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229) Resolves: RHEL-…

  • Medium max 10.0
    ELSA-2026-96233 3 CVEs 1 exploited

    Moderate: ruby4.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [4.0.9-38] - Upgrade to ruby 4.0.9. Resolves: RHEL-300942 - Fix: integer overflow issue in regular expression compiler (CVE-2026-110264) Resolves: RHEL-292062 - Fix: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229) Resolves: RHEL-2…

  • Medium max 9.8
    ELSA-2025-16904 6 CVEs 1 exploited

    Moderate: kernel security update (Oracle Linux 10)

    [6.12.0-55.37.1.0.1] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Di…

  • Medium max 9.8
    ELSA-2025-16880 5 CVEs 1 exploited

    Moderate: kernel security update (Oracle Linux 9)

    [5.14.0-570.49.1.0.1_6.OL9] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • Medium max 10.0
    ELSA-2025-7494 1 CVE 1 exploited

    Moderate: tomcat9 security update (Oracle Linux 10)

    [1:9.0.87-5] - Resolves: RHEL-82927 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

  • Medium max 10.0
    ELSA-2025-7497 3 CVEs 1 exploited

    Moderate: tomcat security update (Oracle Linux 10)

    [1:10.1.36-1] - Rebase tomcat to 10.1.36 - Resolves: RHEL-82925 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) - Resolves: RHEL-87272 tomcat: DoS in examples web application (CVE-2024-54677)…

  • Medium max 7.1
    ELSA-2025-3937 1 CVE 1 exploited

    Moderate: kernel security update (Oracle Linux 9)

    - [5.14.0-503.38.1_5.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_ke…

  • Medium max 7.1
    ELSA-2025-3893 2 CVEs 1 exploited

    Moderate: kernel security update (Oracle Linux 8)

    [4.18.0-553.50.1_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.ge…

  • Medium max 10.0
    ELSA-2025-3683 2 CVEs 1 exploited

    Moderate: tomcat security update (Oracle Linux 8)

    [1:9.0.87-1.el8_10.3] - Resolves: RHEL-82934 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) - Resolves: RHEL-71708 tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)

  • Medium max 10.0
    ELSA-2025-3645 2 CVEs 1 exploited

    Moderate: tomcat security update (Oracle Linux 9)

    [1:9.0.87-2.el9_5.1] - Resolves: RHEL-82946 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) - Resolves: RHEL-71719 tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)

  • Medium max 6.9
    ELSA-2025-1601 1 CVE 1 exploited

    Moderate: gcc security update (Oracle Linux 7)

    [4.8.5-45.0.1] - [Orabug: 37603707] ELSA-2025-1601 Moderate: gcc security update CVE-2020-11023 rebuild for CVE-2020-11023 - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> [4.8.5-44.0.5] - fix arm cross building inline issue. gcc48-cfns-fix-protos.p…

  • Medium max 6.9
    ELSA-2025-1255 1 CVE 1 exploited

    Moderate: doxygen security update (Oracle Linux 7)

    [1:1.8.5-4.0.1] - Fix CVE-2020-11022 and CVE-2022-11023 in vendored jQuery [Orabug: 37577394]

  • Medium max 6.9
    ELSA-2025-1329 1 CVE 1 exploited

    Moderate: doxygen security update (Oracle Linux 9)

    [1:1.9.1-12] - Resolves: RHEL-78146, CVE-2020-11023, CVE-2020-11022

  • Medium max 6.9
    ELSA-2025-1338 1 CVE 1 exploited

    Moderate: gcc-toolset-14-gcc security update (Oracle Linux 8)

    [14.2.1-7.1] - disable jQuery use, don't ship jquery.js (CVE-2020-11023, RHEL-78284) [14.2.1-7] - update from releases/gcc-14 branch (RHEL-74062) - PRs ada/113036, ada/113868, ada/115917, ada/117328, ada/117996, analyzer/115724, c/117641, c/117745, c/117802, …

  • Medium max 6.9
    ELSA-2025-1346 1 CVE 1 exploited

    Moderate: gcc security update (Oracle Linux 9)

    [11.5.0-5.0.1] - Merge Oracle patches to 11.5.0-5. Oracle history:

  • Medium max 6.9
    ELSA-2025-1301 1 CVE 1 exploited

    Moderate: gcc security update (Oracle Linux 8)

    [8.5.0-23.0.1] - Merge Oracle patches to 8.5.0-23. Oracle history: May-22-2024 Qing Zhao <qing.zhao@oracle.com> 8.5.0-22.0.1 - Merge Oracle patches to 8.5.0-22. Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> March-27-2024 Qing Zhao <qing.zhao@oracle…

  • Medium max 6.9
    ELSA-2025-1306 1 CVE 1 exploited

    Moderate: gcc-toolset-13-gcc security update (Oracle Linux 8)

    [13.3.1-2.2.0.1] - Merge Oracle patches to 13.3.1-2.2. gfortran needs install-info at installation time. Orabug: 36472775 [13.3.1-2.2] - disable jQuery use, don't ship jquery.js (CVE-2020-11023, RHEL-78279)

  • Medium max 6.9
    ELSA-2025-1300 1 CVE 1 exploited

    Moderate: gcc-toolset-14-gcc security update (Oracle Linux 9)

    [14.2.1-1.3] - disable jQuery use, don't ship jquery.js (CVE-2020-11023, RHEL-78383)

  • Medium max 6.9
    ELSA-2025-1309 1 CVE 1 exploited

    Moderate: gcc-toolset-13-gcc security update (Oracle Linux 9)

    [13.3.1-2.2.0.1] - Merge Oracle patches to 13.3.1-2.2. Oracle history: November-20-2024 Qing Zhao <qing.zhao@oracle.com> 13.3.1-2.1.0.1 - gfortran needs install-info at installation time. Orabug: 36472775 [13.3.1-2.2] - disable jQuery use, don't ship jquery.j…

  • Medium max 6.9
    ELSA-2025-1215 1 CVE 1 exploited

    Moderate: tbb security update (Oracle Linux 8)

    [2018.2-10.1] - Remove jQuery from Doxygen files (RHEL-77669) [2018.2-10] - Apply patches from (BZ #1907561) - Bump release

  • Medium max 6.9
    ELSA-2025-1210 1 CVE 1 exploited

    Moderate: tbb security update (Oracle Linux 9)

    [2020.3-8.1] - Remove jQuery from Doxygen output (RHEL-77693)

  • Medium max 7.5
    ELSA-2023-6120 1 CVE 1 exploited

    Moderate: nginx:1.22 security update (Oracle Linux 9)

    [1:1.22.1-3.0.1.1] - Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (CVE-2023-44487)

  • Medium max 7.5
    ELSA-2023-5863 2 CVEs 1 exploited

    Moderate: grafana security update (Oracle Linux 8)

    [7.5.15-5] - Resolve CVE-2023-44487 Rapid Reset Attack - Resolve CVE-2023-39325 rapid stream resets can cause excessive work

  • Medium max 7.5
    ELSA-2023-5867 2 CVEs 1 exploited

    Moderate: grafana security update (Oracle Linux 9)

    [9.0.9-4] - Resolve CVE-2023-44487 Rapid Reset Attack - Resolve CVE-2023-39325 rapid stream resets can cause excessive work

  • Medium max 7.5
    ELSA-2023-5712 1 CVE 1 exploited

    Moderate: nginx:1.20 security update (Oracle Linux 8)

    [1:1.20.1-1.0.1.1] - Resolves: RHEL-12732 - nginx:1.20/nginx: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

  • Medium max 7.5
    ELSA-2023-5713 1 CVE 1 exploited

    Moderate: nginx:1.22 security update (Oracle Linux 8)

    [1:1.22.1-1.0.1.1] - Resolves: RHEL-12728 - nginx:1.22/nginx: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)(CVE-2023-44487)

  • Medium max 7.5
    ELSA-2023-5711 1 CVE 1 exploited

    Moderate: nginx security update (Oracle Linux 9)

    [1:1.20.1-14.0.1.1] - Resolves: RHEL-12518 - nginx: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

  • Medium max 7.8
    ELSA-2022-8267 31 CVEs 1 exploited

    Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-162.6.1_1.OL9] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genk…

  • Medium max 8.6
    ELSA-2022-7683 26 CVEs 1 exploited

    Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-425.3.1.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey…

  • Medium max 7.8
    ELSA-2022-7340 3 CVEs 2 exploited

    Moderate: php-pear security update (Oracle Linux 7)

    [1:1.9.4-23] - update Archive_Tar to 1.4.14 CVE-2020-36193 CVE-2020-28948 CVE-2020-28949

  • Medium max 8.8
    ELSA-2022-6540 1 CVE 1 exploited

    Moderate: webkit2gtk3 security update (Oracle Linux 8)

    [2.36.7-1] - Update to 2.36.7 Related: #2123429

  • Medium max 8.8
    ELSA-2022-6634 1 CVE 1 exploited

    Moderate: webkit2gtk3 security update (Oracle Linux 9)

    [2.36.7-1] - Update to 2.36.7 Related: #2123430

  • Medium max 7.8
    ELSA-2022-6542 3 CVEs 2 exploited

    Moderate: php:7.4 security update (Oracle Linux 8)

    php-pear [1:1.10.13-1] - update PEAR to 1.10.13 - update Archive_Tar to 1.4.14

  • Medium max 8.8
    ELSA-2022-1777 30 CVEs 2 exploited

    Moderate: webkit2gtk3 security, bug fix, and enhancement update (Oracle Linux 8)

    [2.34.6-1] - Update to 2.34.6 Related: #1985042 [2.34.5-1] - Update to 2.34.5 - Related: #1985042 [2.34.4-1] - Update to 2.34.4 - Resolves: #1985042 [2.32.4-1] - Update to 2.32.4 - Related: #1985042 - Resolves: #2006429

  • Medium max 8.8
    ELSA-2022-0059 1 CVE 1 exploited

    Moderate: webkitgtk4 security update (Oracle Linux 7)

    [2.28.2-3] - Fix CVE-2021-30858 - Resolves: #2006421

  • Medium max 9.8
    ELSA-2021-4381 29 CVEs 5 exploited

    Moderate: GNOME security, bug fix, and enhancement update (Oracle Linux 8)

    accountsservice [0.6.55-2] - Add support for user templates so user can specify default session Resolves: #1812788 gdm [40.0-14] - Fix XDMCP Resolves: #2004170 - Fix crash at shutdown Related: #2004170 [40.0-13] - Disable Wayland on HyperV - Fix Xorg fallback…

  • Medium max 8.8
    ELSA-2021-4097 1 CVE 1 exploited

    Moderate: webkit2gtk3 security and bug fix update (Oracle Linux 8)

    [2.30.4-3] - Fix crashing on aarch64 - Resolves: #2010825 [2.30.4-2] - Fix CVE-2021-30858 - Resolves: #2006427

  • Medium max 6.9
    ELSA-2021-1846 1 CVE 1 exploited

    Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update (Oracle Linux 8)

    bind-dyndb-ldap [11.6-2] - Rebuild against bind 9.11.26 - Resolves: rhbz#1904612 [11.6-1] - New upstream release - Resolves: rhbz#1891735 ipa [4.9.2-3.0.1] - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674] [4.9.2-3] - ipa-client-install dis…

  • Medium max 5.5
    ELSA-2021-1647 3 CVEs 1 exploited

    Moderate: samba security, bug fix, and enhancement update (Oracle Linux 8)

    openchange [2.3-27.0.1] - Use ldconfig_scriptlets [2.3-27] - Rebuild for newer samba samba [4.13.3-3] - resolves: #1924615 - Fix a memcache bug when cache is full - resolves: #1924571 - Ensure that libwbclient has been updated before restarting services [4.13…

  • Medium max 6.9
    ELSA-2021-0860 1 CVE 1 exploited

    Moderate: ipa security and bug fix update (Oracle Linux 7)

    [4.6.8-5.0.1] - Blank out header-logo.png product-name.png - Replace login-screen-logo.png [Orabug: 20362818] [4.6.8-5.el7_9.4] - Resolves: #1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing - wgi/plugins.py: ignore e…