Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

  • Medium max 6.2
    ELSA-2025-4244 1 CVE

    Moderate: glibc security update (Oracle Linux 9)

    [2.34-125.0.1.8] - Forward-port Oracle patches for ol9-u5 (glibc-2.34-125.0.1.8) Reviewed by: David Faust <david.faust@oracle.com> Oracle history:

  • Medium max 5.3
    ELSA-2025-20284 1 CVE

    Moderate: gnutls security update (Oracle Linux 8)

    [3.6.16-8.3_fips] - Allow RSA keygen with modulus sizes bigger than 3072 bits and validate the seed length as defined in FIPS 186-4 section B.3.2 [Orabug: 33200526] - Allow bigger known RSA modulus sizes when calling rsa_generate_fips186_4_keypair directly [O…

  • Medium max 5.9
    ELSA-2025-4063 7 CVEs

    Moderate: ruby:3.1 security update (Oracle Linux 8)

    ruby [3.1.7-145] - Upgrade to Ruby 3.1.7. Resolves: RHEL-55408 - Fix DoS vulnerability in REXML. (CVE-2024-39908) Resolves: RHEL-57051 - Fix DoS vulnerability in REXML. (CVE-2024-43398) Resolves: RHEL-56002 [3.1.5-144] - Fix REXML ReDoS vulnerability. (CVE-20…

  • Medium max 7.1
    ELSA-2025-4043 2 CVEs

    Moderate: bluez security update (Oracle Linux 8)

    [5.63-5] + bluez-5.63-5 - Resolves: RHEL-35371 - Fixing CVE-2023-27349 - Resolves: RHEL-35492 - Fixing CVE-2023-51589 [5.63-4] + bluez-5.63-4 - Resolves: RHEL-35501 - Fixing CVE-2023-50230 - Resolves: RHEL-35504 - Fixing CVE-2023-50229

  • Medium max 7.5
    ELSA-2025-4048 1 CVE

    Moderate: xmlrpc-c security update (Oracle Linux 8)

    [1.51.0-11] - Restrict XML Entity Expansion Depth in libexpat CVE-2024-8176

  • Medium max 5.3
    ELSA-2025-4049 1 CVE

    Moderate: libtasn1 security update (Oracle Linux 8)

    [4.13.0-5] - Backport the fix for CVE-2024-12133

  • Medium max 5.3
    ELSA-2025-4051 1 CVE

    Moderate: gnutls security update (Oracle Linux 8)

    [3.6.16-8.3] - Backport the fix for CVE-2024-12243

  • Medium max 7.4
    ELSA-2025-3845 3 CVEs

    Moderate: java-1.8.0-openjdk security update (Oracle Linux 8)

    [1:1.8.0.452.b09-2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:1.8.0.452.b09-1] - Update to 8u452-b09 (GA) - Update release notes for 8u452-b09. - Remove long option documentation from JDK-8335912/JDK-8337499 as not present in 8u - Require tzdata 2…

  • Medium max 7.4
    ELSA-2025-3852 3 CVEs

    Moderate: java-17-openjdk security update (Oracle Linux 8)

    [1:17.0.15.0.6-2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:17.0.15.0.6-2] - Update to jdk-17.0.15+6 (GA) - Add to .gitignore openjdk-17.0.15+6.tar.xz - Set updatever to 15 - Set buildver to 6 - Set rpmrelease to 2 - Update sources to openjdk-17.0…

  • Medium max 7.4
    ELSA-2025-3855 3 CVEs

    Moderate: java-21-openjdk security update (Oracle Linux 8)

    [1:21.0.7.0.6-1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:21.0.7.0.6-1] - Update to jdk-21.0.7+6 (GA) - Update release notes to 21.0.7+6 - Rebase FIPS support against 21.0.7+5 - Require tzdata 2025a due to upstream inclusion of JDK-8347965 - Sync…

  • Medium max 7.1
    ELSA-2025-3937 1 CVE 1 exploited

    Moderate: kernel security update (Oracle Linux 9)

    - [5.14.0-503.38.1_5.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_ke…

  • Medium max 7.5
    ELSA-2025-3913 1 CVE

    Moderate: expat security update (Oracle Linux 8)

    [2.2.5-17.0.1] - lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910314] [2.2.5-17] - Fix CVE-2024-8176 - Resolves: RHEL-57477

  • Medium max 7.1
    ELSA-2025-3893 2 CVEs 1 exploited

    Moderate: kernel security update (Oracle Linux 8)

    [4.18.0-553.50.1_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.ge…

  • Medium max 6.2
    ELSA-2025-3828 1 CVE

    Moderate: glibc security update (Oracle Linux 8)

    [2.28-251.0.3.16] - Forward port of Oracle patches Reviewed-by: Elena Zannoni <elena.zannoni@oracle.com> Oracle history: March-26-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.3.14 - OraBug: 36625686 Add MTE support on string functions Re…

  • Medium max 6.1
    ELSA-2025-3772 2 CVEs

    Moderate: go-toolset:ol8 security update (Oracle Linux 8)

    delve [1.24.1-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.24.1-1] - Rebase to 1.24.1 - Skip unsupported tests - Resolves: RHEL-83451 golang [1.23.6-1] - Update to Go 1.23.6 - Resolves: RHEL-83824 [1.22.11-1] - Rebase to Go1.22.11 t…

  • Medium max 10.0
    ELSA-2025-3683 2 CVEs 1 exploited

    Moderate: tomcat security update (Oracle Linux 8)

    [1:9.0.87-1.el8_10.3] - Resolves: RHEL-82934 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) - Resolves: RHEL-71708 tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)

  • Medium max 10.0
    ELSA-2025-3645 2 CVEs 1 exploited

    Moderate: tomcat security update (Oracle Linux 9)

    [1:9.0.87-2.el9_5.1] - Resolves: RHEL-82946 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) - Resolves: RHEL-71719 tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)

  • Medium max 7.5
    ELSA-2025-3531 1 CVE

    Moderate: expat security update (Oracle Linux 9)

    [2.5.0-3.3] - Improve fix for CVE-2024-8176 - Resolves: RHEL-57488 [2.5.0-3.2] - Fix CVE-2024-8176 - Resolves: RHEL-57488

  • Medium
    ELSA-2025-3506 1 CVE

    Moderate: kernel security update (Oracle Linux 9)

    [5.14.0-503.35.1_5.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.…

  • Medium max 4.7
    ELSA-2025-3261 1 CVE

    Moderate: nginx:1.22 security update (Oracle Linux 9)

    [1.22.1-8.0.1.1] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] [1:1.22.1-8.1] - Resolves: RHEL-84486 - nginx:1.22/nginx: specially crafted MP4 file may cause denial of service (CVE-2024-7347) [1…

  • Medium max 4.7
    ELSA-2025-3262 1 CVE

    Moderate: nginx:1.24 security update (Oracle Linux 9)

    [1.24.0-4.0.1.1] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-4.1] - Resolves: RHEL-84480 - nginx:1.24/nginx: specially crafted MP4 file may cause denial of service (CVE-2024-7347) [1…

  • Medium max 7.5
    ELSA-2025-1750 1 CVE

    Moderate: python3 security update (Oracle Linux 7)

    [3.6.8-21.0.3] - Fix DoS parsing crafted tarfile headers [Orabug: 37626372][CVE-2024-6232] - Disable test_socket in the PGO profile task.

  • Medium max 7.1
    ELSA-2025-2722 1 CVE

    Moderate: krb5 security update (Oracle Linux 8)

    [1.18.2-31.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767] [1.18.2-31] - Prevent overflow when calculating ulog block size (CVE-2025-24528) Resolves: RHEL-78248 - kdb5_util: fix DB entry flags on modification Resolves: RHEL-56060

  • Medium max 6.9
    ELSA-2025-1601 1 CVE 1 exploited

    Moderate: gcc security update (Oracle Linux 7)

    [4.8.5-45.0.1] - [Orabug: 37603707] ELSA-2025-1601 Moderate: gcc security update CVE-2020-11023 rebuild for CVE-2020-11023 - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> [4.8.5-44.0.5] - fix arm cross building inline issue. gcc48-cfns-fix-protos.p…

  • Medium max 6.5
    ELSA-2025-2600 3 CVEs

    Moderate: rsync security update (Oracle Linux 8)

    [3.1.3-21] - Resolves: RHEL-70207 - Path traversal vulnerability in rsync

  • Medium max 7.1
    ELSA-2025-1352 1 CVE

    Moderate: krb5 security update (Oracle Linux 7)

    [1.15.1-55.0.9] - Fixes CVE-2025-24528 , Prevent overflow when calculating ulog block size [Orabug: 37587301]

  • Medium max 5.4
    ELSA-2025-1250 1 CVE

    Moderate: python-jinja2 security update (Oracle Linux 7)

    [2.7.2-4.0.1] - Fix for CVE-2024-56326 [Orabug: 37576737]

  • Medium max 6.9
    ELSA-2025-1255 1 CVE 1 exploited

    Moderate: doxygen security update (Oracle Linux 7)

    [1:1.8.5-4.0.1] - Fix CVE-2020-11022 and CVE-2022-11023 in vendored jQuery [Orabug: 37577394]

  • Medium max 5.5
    ELSA-2025-1659 1 CVE

    Moderate: kernel security update (Oracle Linux 9)

    - [5.14.0-503.26.1_5.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_ke…

  • Medium max 6.8
    ELSA-2025-1582 2 CVEs

    Moderate: nodejs:18 security update (Oracle Linux 8)

    nodejs [1:18.20.6-1] - Update to version 18.20.6 Resolves: RHEL-78326 Fixes: CVE-2025-23085 CVE-2025-22150 nodejs-nodemon nodejs-packaging

  • Medium max 9.8
    ELSA-2025-0936 1 CVE

    Moderate: mingw-glib2 security update (Oracle Linux 9)

    [2.78.6-2] - Resolves: RHEL-67088 - CVE-2024-52533 mingw-glib2: buffer overflow in set_connect_msg()

  • Medium max 6.9
    ELSA-2025-1329 1 CVE 1 exploited

    Moderate: doxygen security update (Oracle Linux 9)

    [1:1.9.1-12] - Resolves: RHEL-78146, CVE-2020-11023, CVE-2020-11022

  • Medium max 8.1
    ELSA-2025-1517 1 CVE

    Moderate: libxml2 security update (Oracle Linux 8)

    [2.9.7-18.2] - Fix CVE-2022-49043 (RHEL-76289) [2.9.7-18.1] - Fix CVE-2024-25062 (RHEL-31056)

  • Medium max 6.8
    ELSA-2025-1446 2 CVEs

    Moderate: nodejs:18 security update (Oracle Linux 9)

    nodejs [1:18.20.6-1] - Update to version 18.20.6 Resolves: RHEL-76801 Fixes: CVE-2025-23085 [1:18.20.4-1] - Update to 18.20.4 Fixes: CVE-2024-22020 CVE-2024-28863 nodejs-nodemon nodejs-packaging

  • Medium max 6.9
    ELSA-2025-1338 1 CVE 1 exploited

    Moderate: gcc-toolset-14-gcc security update (Oracle Linux 8)

    [14.2.1-7.1] - disable jQuery use, don't ship jquery.js (CVE-2020-11023, RHEL-78284) [14.2.1-7] - update from releases/gcc-14 branch (RHEL-74062) - PRs ada/113036, ada/113868, ada/115917, ada/117328, ada/117996, analyzer/115724, c/117641, c/117745, c/117802, …

  • Medium max 6.9
    ELSA-2025-1346 1 CVE 1 exploited

    Moderate: gcc security update (Oracle Linux 9)

    [11.5.0-5.0.1] - Merge Oracle patches to 11.5.0-5. Oracle history:

  • Medium max 6.9
    ELSA-2025-1301 1 CVE 1 exploited

    Moderate: gcc security update (Oracle Linux 8)

    [8.5.0-23.0.1] - Merge Oracle patches to 8.5.0-23. Oracle history: May-22-2024 Qing Zhao <qing.zhao@oracle.com> 8.5.0-22.0.1 - Merge Oracle patches to 8.5.0-22. Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> March-27-2024 Qing Zhao <qing.zhao@oracle…

  • Medium max 6.9
    ELSA-2025-1306 1 CVE 1 exploited

    Moderate: gcc-toolset-13-gcc security update (Oracle Linux 8)

    [13.3.1-2.2.0.1] - Merge Oracle patches to 13.3.1-2.2. gfortran needs install-info at installation time. Orabug: 36472775 [13.3.1-2.2] - disable jQuery use, don't ship jquery.js (CVE-2020-11023, RHEL-78279)

  • Medium max 6.9
    ELSA-2025-1300 1 CVE 1 exploited

    Moderate: gcc-toolset-14-gcc security update (Oracle Linux 9)

    [14.2.1-1.3] - disable jQuery use, don't ship jquery.js (CVE-2020-11023, RHEL-78383)

  • Medium max 6.9
    ELSA-2025-1309 1 CVE 1 exploited

    Moderate: gcc-toolset-13-gcc security update (Oracle Linux 9)

    [13.3.1-2.2.0.1] - Merge Oracle patches to 13.3.1-2.2. Oracle history: November-20-2024 Qing Zhao <qing.zhao@oracle.com> 13.3.1-2.1.0.1 - gfortran needs install-info at installation time. Orabug: 36472775 [13.3.1-2.2] - disable jQuery use, don't ship jquery.j…