Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

Medium max 5.3

ELSA-2026-86981 1 CVE

Moderate: fetchmail security update (Oracle Linux 9)

[6.4.24-1.1] - Fix CVE-2026-94184: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) Resolves: RHEL-265195

Oct 21, 2026
Medium max 5.5

ELSA-2026-86971 3 CVEs

Moderate: cockpit-machines security update (Oracle Linux 10)

[348.1-1.0.1] - Replace upstream references [Orabug: 34340088] [348.1-1] - CVE-2026-92768 (RHEL-263124) - CVE-2026-92747 (RHEL-263120) - CVE-2026-92745 (RHEL-263113)

Oct 21, 2026
Medium max 4.8

ELSA-2026-85847 3 CVEs

Moderate: openssh security update (Oracle Linux 10)

[9.9p1-29.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-29] - CVE-2026-59998: Document caveat regarding GSSAPIStrictAcceptorCheck Resolves: RHEL-276225 - CVE-2026-59997: Fix internal-sftp server argument parsing limit Resolves: …

Oct 20, 2026
Medium max 5.3

ELSA-2026-85959 1 CVE

Moderate: fetchmail security update (Oracle Linux 10)

[6.4.38-3.1] - Fix CVE-2026-94184: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) Resolves: RHEL-265187

Oct 20, 2026
Medium max 6.5

ELSA-2026-84590 1 CVE

Moderate: perl-URI security update (Oracle Linux 8)

[1.73-4] - CVE-2026-19953 perl-URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization incorrect hostname encoding via missing Unicode normalization

Oct 19, 2026
Medium max 6.5

ELSA-2026-84588 1 CVE

Moderate: perl-URI security update (Oracle Linux 9)

[5.09-3.1] - CVE-2026-19953 perl-URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization incorrect hostname encoding via missing Unicode normalization Resolves: RHEL-275730

Oct 19, 2026
Medium max 7.3

ELSA-2026-84594 1 CVE

Moderate: environment-modules security update (Oracle Linux 9)

[5.3.0-2.1] - fix command injection in bash Tab completion (CVE-2026-85013)

Oct 19, 2026
Medium max 6.5

ELSA-2026-85277 1 CVE

Moderate: hostapd security update (Oracle Linux 9)

[2.11-3] - Fix OOB memory access in Multi-Link Operation element parsing Resolves: RHEL-194042

Oct 19, 2026
Medium max 6.1

ELSA-2026-84595 2 CVEs

Moderate: cockpit-files security update (Oracle Linux 9)

[36.1-1] - CVE-2026-91202 - Don't de-reference a symlink when creating a directory (RHEL-263134) - CVE-2026-91205 - Don't de-reference a symlink when creating a directory (RHEL-263141)

Oct 19, 2026
Medium max 6.5

ELSA-2026-84587 1 CVE

Moderate: perl-URI security update (Oracle Linux 10)

[5.27-3.1] - CVE-2026-19953 perl-URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization hostname encoding via missing Unicode normalization Resolves: RHEL-274901

Oct 19, 2026
Medium max 6.5

ELSA-2026-85276 1 CVE

Moderate: hostapd security update (Oracle Linux 10)

[2.11-3] - Fix OOB memory access in Multi-Link Operation element parsing Resolves: RHEL-194049

Oct 19, 2026
Medium max 7.3

ELSA-2026-82919 1 CVE

Moderate: environment-modules security update (Oracle Linux 8)

[4.5.2-5] - Fix command injection in bash Tab completion via compgen -W expansion (CVE-2026-85013)

Oct 15, 2026
Medium max 8.1

ELSA-2026-83657 4 CVEs

Moderate: wireshark security update (Oracle Linux 8)

[1:2.6.2-21] - Fix DoS vulnerability in H.245 protocol dissector (CVE-2026-76927) - Resolves: RHEL-257649 [1:2.6.2-20] - Fix DoS vulnerability in ESS protocol dissector (CVE-2026-76919) - Resolves: RHEL-257614 [1:2.6.2-19] - Fix DoS via C12.22 protocol dissec…

Oct 15, 2026
Medium max 7.5

ELSA-2026-82280 1 CVE

Moderate: tftp security update (Oracle Linux 10)

[5.2-50.1] - fix buffer overflow in remap genmatchstring() with inverse rules (CVE-2026-85234) (RHEL-260604)

Oct 13, 2026
Medium max 7.3

ELSA-2026-80664 1 CVE

Moderate: environment-modules security update (Oracle Linux 10)

[5.6.1-2.1] - fix command injection in bash Tab completion (CVE-2026-85013) (RHEL-260562)

Oct 12, 2026
Medium max 6.9

ELSA-2026-80675 1 CVE

Moderate: libxml2 security update (Oracle Linux 8)

[2.9.7-21.10] - Fix CVE-2026-86144 (RHEL-269184)

Oct 11, 2026
Medium max 8.2

ELSA-2026-80514 2 CVEs

Moderate: compat-openssl11 security update (Oracle Linux 9)

[1:1.1.1k-5.6] - Fixes CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset Resolves: RHEL-265517 [1:1.1.1k-5.5] - Fixes CVE-2026-63072: Heap buffer overflow in CMS key unwrapping Resolves: RHEL-246280

Oct 11, 2026
Medium max 7.5

ELSA-2026-80663 1 CVE

Moderate: tftp security update (Oracle Linux 9)

[5.2-40.1] - fix buffer overflow in remap genmatchstring() with inverse rules (CVE-2026-85234) (RHEL-260629)

Oct 11, 2026
Medium max 9.8

ELSA-2026-80511 2 CVEs

Moderate: curl security update (Oracle Linux 9)

[7.76.1-40.el9_8.8] - fix cookie injection via trailing dot super cookies (CVE-2026-8924) - fix digest auth state leak on origin or credential change (CVE-2026-11856)

Oct 11, 2026
Medium max 9.8

ELSA-2026-80512 5 CVEs

Moderate: curl security update (Oracle Linux 10)

[8.12.1-4.el10_2.7] - fix http2 stream dependency tracking security issue (CVE-2026-10536) - fix negotiate state check on connection reuse (CVE-2026-5545) - fix proxy auth not cleared on proxy change (CVE-2026-7168) - fix credentials not cleared on redirect (…

Oct 11, 2026
Medium max 7.5

ELSA-2026-78952 1 CVE

Moderate: tftp security update (Oracle Linux 8)

[5.2-28] - fix buffer overflow in remap genmatchstring() with inverse rules (CVE-2026-85234) (RHEL-260620)

Oct 8, 2026
Medium max 7.8

ELSA-2026-78951 1 CVE

Moderate: kbd security update (Oracle Linux 8)

[2.0.4-11.1] - Fix CVE-2026-72693: openvt -u process matching more conservative Resolves: RHEL-235979

Oct 8, 2026
Medium max 7.5

ELSA-2026-77534 1 CVE

Moderate: sssd security update (Oracle Linux 10)

[2.12.0-3.0.1.el10_2.2] - Restore default debug level for sss_cache [Orabug: 32810448] [2.12.0-3.2] - Resolves: RHEL-257112 - CVE-2026-87853 sssd: IDP prefix-match bypass in eval_access_token_buf() [2.12.0-3.1] - Resolves: RHEL-192056 - CVE-2026-14474 sssd: s…

Oct 8, 2026
Medium max 9.8

ELSA-2026-76877 1 CVE

Moderate: ghostscript security update (Oracle Linux 8)

[9.27-18] - RHEL-264919 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 output adapter via component subsampling mismatch

Oct 6, 2026
Medium max 6.5

ELSA-2026-73954 1 CVE

Moderate: openssh security update (Oracle Linux 10)

[9.9p1-28.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-28] - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258463

Oct 5, 2026
Medium max 9.8

ELSA-2026-74133 4 CVEs

Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.170.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 2, 2026
Medium max 9.8

ELSA-2026-74457 1 CVE

Moderate: ghostscript security update (Oracle Linux 9)

[9.54.0-19.1] - RHEL-264921 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 (JPXDecode) output adapter

Oct 2, 2026
Medium max 7.1

ELSA-2026-74438 3 CVEs

Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.54.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Oct 2, 2026
Medium max 6.5

ELSA-2026-73955 1 CVE

Moderate: openssh security update (Oracle Linux 9)

[9.9p1-12.0.1] - Restore pam_ssh_agent_rel values that were used for initial release - Fix PerSourcePenalties grace-exceeded using the crash penalty value [Orabug: 39825354] - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM…

Oct 1, 2026
Medium max 9.8

ELSA-2026-74464 1 CVE

Moderate: ghostscript security update (Oracle Linux 10)

[10.02.1-16.1] - RHEL-264925 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 JPXDecode output adapter

Oct 1, 2026
Medium max 5.1

ELSA-2026-73511 2 CVEs

Moderate: gawk security update (Oracle Linux 8)

[4.2.1-5] - Fix use-after-free in do_getline_redir() (CVE-2026-40467) Resolves: RHEL-222601 [4.2.1-4.1] - Fix integer overflow in do_sub() and parse_escape() (CVE-2026-40468) Resolves: RHEL-222771

Sep 30, 2026
Medium max 5.1

ELSA-2026-73512 3 CVEs

Moderate: gawk security update (Oracle Linux 9)

[5.1.0-6.1] - Fix use after free in io.c - Fix buffer overflow in extensions/readdir.c - Fix integer overflow in buildin.c Resolves: CVE-2026-40467 Resolves: CVE-2026-40468 Resolves: CVE-2026-40553

Sep 30, 2026
Medium max 5.1

ELSA-2026-73429 3 CVEs

Moderate: gawk security update (Oracle Linux 10)

[5.3.0-6.1] - Fix use after free in io.c - Fix buffer overflow in extensions/readdir.c - Fix integer overflow in buildin.c Resolves: CVE-2026-40467 Resolves: CVE-2026-40468 Resolves: CVE-2026-40553

Sep 30, 2026
Medium max 9.1

ELSA-2026-69113 4 CVEs

Moderate: apr-util security update (Oracle Linux 8)

[1.6.1-9.1] - Resolves: RHEL-236630 - apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506) - Resolves: RHEL-236267 - apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR …

Sep 23, 2026
Medium max 5.7

ELSA-2026-69120 1 CVE

Moderate: unbound security update (Oracle Linux 8)

[1.16.2-5.14.2] - Backport additional fix from 1.26.0 (CVE-2026-50252) - Correct new warning in previous change (CVE-2026-44690) [1.16.2-5.14.1] - Fix CVE-2026-50252 (cache poisoning via source port prediction)

Sep 23, 2026
Medium max 7.0

ELSA-2026-69655 1 CVE

Moderate: libxml2 security, bug fix, and enhancement update (Oracle Linux 8)

[2.9.7-21.8] - Lower xpath recursion limits (RHEL-249282) [2.9.7-21.8] - Fix CVE-2026-6653 (RHEL-215616)

Sep 23, 2026
Medium max 4.4

ELSA-2026-69964 1 CVE

Moderate: coreutils security update (Oracle Linux 8)

[8.30-21.0.1] - clean up empty file if cp is failed [Orabug 15973168] - df --local: recognize afs, auristorfs, and smb3 as remote fs (#1798030) - fix formatting of sha512sum(1) man page (#1688744) [8.30-21] - sort: fix buffer under-read CVE-2025-5278 (RHEL-21…

Sep 23, 2026
Medium max 5.0

ELSA-2026-70390 4 CVEs

Moderate: tar security, bug fix, and enhancement update (Oracle Linux 8)

[2:1.30-13] - Backport upstream fix for CVE-2026-5704 (file injection hidden from -t) - Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix) Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks). - Upstream fix for build w…

Sep 23, 2026
Medium max 9.8

ELSA-2026-69259 6 CVEs

Moderate: tomcat update (Oracle Linux 10)

[1:10.1.49-4] - Resolves: RHEL-192817 tomcat: HTTP/2 request headers not validated (CVE-2026-41293) - Resolves: RHEL-192648 tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) - Resolves: RHEL-238208 tomcat: Information disc…

Sep 21, 2026
Medium max 9.8

ELSA-2026-68651 8 CVEs

Moderate: tomcat9 security update (Oracle Linux 10)

[1:9.0.120-1] - Resolves: RHEL-192649 Tomcat9: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) - Resolves: RHEL-192818 Tomcat9: HTTP/2 request headers not validated (CVE-2026-41293) - Resolves: RHEL-219582 Tomcat9: Insufficient …

Sep 18, 2026