Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

  • Medium max 6.5
    ELSA-2026-0605 1 CVE

    Moderate: vsftpd security update (Oracle Linux 9)

    [3.0.5-6.2] - Rebuild to test with proper configuration - Related: RHEL-134169 [3.0.5-6.1] - Fix CVE-2025-14242 - Resolves: RHEL-134169

  • Medium max 7.8
    ELSA-2026-0700 1 CVE

    Moderate: transfig security update (Oracle Linux 9)

    [1:3.2.7b-11] - Detect nan in spline control values - CVE-2025-46397

  • Medium max 6.5
    ELSA-2026-0606 1 CVE

    Moderate: vsftpd security update (Oracle Linux 10)

    [3.0.5-10.1] - Fix CVE-2025-14242 - Resolves: RHEL-134158

  • Medium max 5.9
    ELSA-2026-0523 2 CVEs

    Moderate: postgresql:13 security update (Oracle Linux 8)

    pgaudit pg_repack postgres-decoderbufs postgresql [13.23-1] - Update to 13.23 - Resolves: RHEL-128818 (CVE-2025-12818)

  • Medium max 5.9
    ELSA-2026-0524 2 CVEs

    Moderate: postgresql:15 security update (Oracle Linux 8)

    pgaudit pg_repack postgres-decoderbufs postgresql [15.15-1] - Update to 15.15 - Resolves: RHEL-128819 (CVE-2025-12818)

  • Medium max 6.0
    ELSA-2026-0596 2 CVEs

    Moderate: cups security update (Oracle Linux 8)

    [1:2.2.6-66] - fix use-after-free reported by OSH [1:2.2.6-65] - RHEL-129729 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack - RHEL-129720 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues

  • Medium max 5.9
    ELSA-2026-0491 2 CVEs

    Moderate: postgresql security update (Oracle Linux 9)

    [13.23-1] - Update to 13.23 - Resolves: RHEL-128812 (CVE-2025-12818) [13.22-3] - Add sysusers configuration and complete tmpfiles.d dynamically - Related: RHEL-94905 [13.22-2] - Define tmpfiles.d to enable ostree and bootc support

  • Medium max 5.9
    ELSA-2026-0492 2 CVEs

    Moderate: postgresql:15 security update (Oracle Linux 9)

    pgaudit [1.7.0-1] - Initial import for postgresql 15 module - Update to 1.7.0 - Support postgresql 15 - Related: #2128410 pg_repack [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47350 [1.4.8-1] - Update to version 1.4.8 …

  • Medium max 5.9
    ELSA-2026-0594 1 CVE

    Moderate: libpq security update (Oracle Linux 10)

    [16.11-3] - Release bump [16.11-1] - Rebase to upstream release 16.11

  • Medium max 5.9
    ELSA-2026-0519 2 CVEs

    Moderate: postgresql:16 security update (Oracle Linux 8)

    pgaudit pg_repack postgres-decoderbufs postgresql [16.11-1] - Update to 16.11 - Resolves: RHEL-128820 (CVE-2025-12818)

  • Medium max 5.9
    ELSA-2026-0525 1 CVE

    Moderate: postgresql16 security update (Oracle Linux 10)

    [16.11-1.0.1] - Replace upstream reference [Orabug: 37044148] [16.11-1] - Update to 16.11 [16.10-3] - Add tmpfiles.d configuration for PostgreSQL 16 - Ensures proper directory permissions for /var/lib/pgsql [16.10-2] - Add OpenSSL support to upgrade_configure…

  • Medium max 5.9
    ELSA-2026-0458 1 CVE

    Moderate: libpq security update (Oracle Linux 9)

    [13.23-1] - Rebase to upstream release 13.23 - Resolves: RHEL-131279 (CVE-2025-12818)

  • Medium max 8.8
    ELSA-2026-0445 4 CVEs

    Moderate: kernel security update (Oracle Linux 9)

    [5.14.0-611.20.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • Medium max 6.0
    ELSA-2026-0464 2 CVEs

    Moderate: cups security update (Oracle Linux 10)

    [1:2.4.10-12.2] - fix use-after-free reported by OSH [1:2.4.10-12.1] - RHEL-129721 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack - RHEL-129715 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues

  • Medium max 9.8
    ELSA-2026-0337 1 CVE

    Moderate: openssl security update (Oracle Linux 8)

    [1:1.1.1k-14] - Backport fix for Out-of-bounds read & write in RFC 3211 KEK Unwrap Fix CVE-2025-9230 Resolves: RHEL-128613 - Fix bug for ticket_lifetime_hint exceed issue Resolves: RHEL-119891

  • Medium max 6.0
    ELSA-2026-0312 2 CVEs

    Moderate: cups security update (Oracle Linux 9)

    [1:2.3.3op2-34.2] - fix use-after-free reported by OSH [1:2.3.3op2-34.1] - RHEL-129746 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack - RHEL-129738 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related i…

  • Medium max 4.0
    ELSA-2026-0130 1 CVE

    Moderate: poppler security update (Oracle Linux 8)

    [20.11.0-13] - Check bitmap in combine() - Resolves: RHEL-131786

  • Medium max 6.3
    ELSA-2026-0123 2 CVEs

    Moderate: python3.12 security update (Oracle Linux 8)

    [3.12.12-1] - Update to 3.12.12 - Security fix for CVE-2025-8291 and CVE-2025-12084 Resolves: RHEL-128364, RHEL-135391

  • Medium max 4.0
    ELSA-2026-0126 1 CVE

    Moderate: poppler security update (Oracle Linux 9)

    [21.01.0-23] - Bump release for build inheritance - Resolves: RHEL-131792 [21.01.0-22] - Check bitmap in combine() - Resolves: RHEL-131795, RHEL-131792

  • Medium max 5.3
    ELSA-2026-0108 1 CVE

    Moderate: gcc-toolset-15-binutils security update (Oracle Linux 10)

    [2.44-7.1] - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-130616)

  • Medium max 4.0
    ELSA-2026-0128 1 CVE

    Moderate: poppler security update (Oracle Linux 10)

    [24.02.0-7] - Check bitmap in combine() - Resolves: RHEL-131783, RHEL-131782

  • Medium max 6.5
    ELSA-2025-23415 1 CVE

    Moderate: rsync security update (Oracle Linux 7)

    [3.1.2-12.0.3] - Fix CVE-2024-12087 [Orabug: 38771262] [3.1.2-12.0.1] * Back port fix for CVE-2024-12085 [Orabug: 37524229]

  • Medium max 7.5
    ELSA-2025-23457 1 CVE

    Moderate: audiofile security update (Oracle Linux 7)

    [1:0.3.6-9.0.1] - Fix null pointer dereference [CVE-2025-50950][Orabug: 38777980] [1:0.3.6-9] - Apply security patches. CVE-2018-17095, CVE-2018-13440 - Resolves: rhbz#1600369, rhbz#1601014, rhbz#1637128 [1:0.3.6-8] - Escape macros in %changelog [1:0.3.6-7] -…

  • Medium max 5.3
    ELSA-2026-0052 1 CVE

    Moderate: gcc-toolset-14-binutils security update (Oracle Linux 9)

    [2.41-5.1] - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-130669)

  • Medium max 4.1
    ELSA-2026-0067 1 CVE

    Moderate: tar security update (Oracle Linux 9)

    [2:1.34-9] - Fix the last patch to solve a regression with -x and --xattrs: RHEL-136277 also, fix another tiny mistake in the patch (w/o visible consequences) [2:1.34-8] - Backport upstream changes to jailify extraction directory Includes related gnulib chang…

  • Medium max 4.1
    ELSA-2026-0002 1 CVE

    Moderate: tar security update (Oracle Linux 10)

    [2:1.35-9] - Fix a tiny mistake in the last patch affecting hardling extraction (w/o visible consequences) [2:1.35-8] - Backport upstream changes to jailify extraction directory Includes related gnulib changes to add openat2 Fixes CVE-2025-45582

  • Medium max 4.3
    ELSA-2025-23948 1 CVE

    Moderate: grafana security update (Oracle Linux 8)

    [9.2.10-26.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-26] - Resolves RHEL-125664: CVE-2025-58183 - Resolves RHEL-132759: Grafana-selinux prevents plugins from searching cgroups

  • Medium max 4.3
    ELSA-2025-23940 1 CVE

    Moderate: python3.12 security update (Oracle Linux 10)

    [3.12.12-1.0.1] - Remove upstream URL reference [3.12.12-1] - Update to 3.12.12 - Security fix for CVE-2025-8291 Resolves: RHEL-128361

  • Medium max 4.3
    ELSA-2025-23374 1 CVE

    Moderate: container-tools:ol8 security update (Oracle Linux 8)

    aardvark-dns buildah cockpit-podman conmon containernetworking-plugins containers-common container-selinux criu crun fuse-overlayfs libslirp netavark oci-seccomp-bpf-hook podman [4.9.4-24.0.1] - Fixes issue of container created in cgroupv2 not start in cgroup…

  • Medium max 5.9
    ELSA-2025-23309 3 CVEs

    Moderate: php:8.3 security update (Oracle Linux 9)

    php [8.3.26-1] - rebase to 8.3.26 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 [5.1.21-1] - update to 5.1.21 for PHP 8.1 #2070040 php-pecl-redis6 [6.1.0-2] - ignore 1 ONLINE test [6.1.0-1] - RHEL build [6.1.0-1] - update to 6.1.0 - drop …

  • Medium max 5.3
    ELSA-2025-23306 2 CVEs

    Moderate: binutils security update (Oracle Linux 10)

    [2.41-58.0.1.2] - Forward-port Oracle patches to 2.41-58.2 - CVE-2025-11082 - CVE-2025-11083 Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: September-29-2025 David Faust <david.faust@oracle.com> - 2.41-58.0.1 - Forward-port Oracle patches t…

  • Medium max 3.6
    ELSA-2025-23481 2 CVEs

    Moderate: openssh security update (Oracle Linux 8)

    [8.0p1-27.0.1] - Update upstream references [Orabug: 36587718] [8.0p1-27] - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-128400 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-128390

  • Medium max 5.3
    ELSA-2025-23382 1 CVE

    Moderate: binutils security update (Oracle Linux 8)

    [2.30-128.0.1] - Forward port Oracle patches to 2.30-128 - CVE-2025-11083 Reviewed-by: TBD Oracle history: October-8-2025 Bruce McCulloch <bruce.mcculloch@oracle.com> - 2.30-127.0.1 - Forward port Oracle patches to 2.30-127. - Muting some failing ld-ctf tests…

  • Medium max 7.5
    ELSA-2025-23383 1 CVE

    Moderate: curl security update (Oracle Linux 8)

    [7.61.1-34.el8_10.9] - cookie: don't treat the leading slash as trailing (CVE-2025-9086) Resolves: RHEL-121655

  • Medium max 8.1
    ELSA-2025-23483 1 CVE

    Moderate: libssh security update (Oracle Linux 9)

    [0.10.4-17] - Bump spec to resolve build tagging issues [0.10.4-16] - Fix CVE-2025-5987 Resolves: RHEL-130051 - Workaround sshd failure rate limiting in tests Resolves: RHEL-135506

  • Medium max 3.6
    ELSA-2025-23480 2 CVEs

    Moderate: openssh security update (Oracle Linux 9)

    [8.7p1-47.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626] [8.7p1-47] - CVE-2025-61984: Reject usern…

  • Medium max 4.3
    ELSA-2025-23323 1 CVE

    Moderate: python3.12 security update (Oracle Linux 9)

    [3.12.12-1.0.1] - Remove upstream URL reference [3.12.12-1] - Update to 3.12.12 Resolves: RHEL-125856

  • Medium max 4.3
    ELSA-2025-23325 1 CVE

    Moderate: podman security update (Oracle Linux 9)

    [5.6.0-9.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.6.0-9] - update to the latest content o…

  • Medium max 4.3
    ELSA-2025-23326 1 CVE

    Moderate: skopeo security update (Oracle Linux 9)

    [1:1.20.0-2] - rebuild for CVE-2025-58183 - Resolves: RHEL-125717

  • Medium max 5.3
    ELSA-2025-23336 1 CVE

    Moderate: gcc-toolset-13-binutils security update (Oracle Linux 9)

    [2.40-21.0.1.1] - Forward-port Oracle patches to 2.40-21.1. - CVE-2025-11083 - Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: April-02-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.40-21.0.1 - Forward-port Oracle patchs to 2.40-21. -…