Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

Medium max 7.8

ELSA-2024-8798 1 CVE

Moderate: xorg-x11-server and xorg-x11-server-Xwayland security update (Oracle Linux 8)

xorg-x11-server [1.20.11-25] - CVE fix for CVE-2024-9632 xorg-x11-server-Xwayland [21.1.3-17] - Fix for CVE-2024-9632 - (RHEL-61995)

Nov 4, 2024
Medium max 9.8

ELSA-2024-8793 10 CVEs

Moderate: thunderbird security update (Oracle Linux 9)

[128.4.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [128.4.0] - Add OpenELA debranding [128.4.0-1] - Update to 128.4.0 build1

Nov 4, 2024
Medium max 9.8

ELSA-2024-8729 10 CVEs

Moderate: firefox security update (Oracle Linux 8)

[128.4.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] [128.4.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [128.4.0-1] - Update to 128.4.0 build1

Nov 1, 2024
Medium max 9.8

ELSA-2024-8726 10 CVEs

Moderate: firefox security update (Oracle Linux 9)

[128.4.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [128.4.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Ab…

Nov 1, 2024
Medium max 7.8

ELSA-2024-8617 22 CVEs

Moderate: kernel security update (Oracle Linux 9)

[5.14.0-427.42.1_4.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.…

Oct 30, 2024
Medium max 7.5

ELSA-2024-8359 1 CVE

Moderate: python39:3.9 and python39-devel:3.9 security update (Oracle Linux 8)

mod_wsgi numpy python39 [3.9.20-1] - Update to 3.9.20 Resolves: RHEL-60007 python3x-pip python3x-setuptools python3x-six python-cffi python-chardet python-cryptography python-idna python-lxml python-ply python-psutil python-psycopg2 python-pycparser python-Py…

Oct 24, 2024
Medium max 7.5

ELSA-2024-8446 1 CVE

Moderate: python3.9 security update (Oracle Linux 9)

[3.9.18-3.6] - Fix: CVE-2024-6232 - Resolves: RHEL-57421

Oct 24, 2024
Medium max 7.5

ELSA-2024-8447 1 CVE

Moderate: python3.12 security update (Oracle Linux 9)

[3.12.1-4.4] - Security fix for CVE-2024-6232 Resolves: RHEL-57416

Oct 24, 2024
Medium max 7.5

ELSA-2024-8374 1 CVE

Moderate: python3.11 security update (Oracle Linux 9)

[3.11.7-1.6] - Security fix for CVE-2024-6232 Resolves: RHEL-57411

Oct 23, 2024
Medium max 5.3

ELSA-2024-12797 2 CVEs

Moderate: linux-firmware security update (Oracle Linux 7)

[20241003-999.35.git95bfe086.el8] - Rebase to latest upstream [Orabug: 37132142] - Fix build error in ol7 due to linking in copy-firmware.sh [Orabug: 37132515] - Bring back drirectory structure qcom/sc8280xp [Orabug: 37132142]

Oct 22, 2024
Medium max 7.5

ELSA-2024-12792 1 CVE

Moderate: virt:kvm_utils3 security update (Oracle Linux 8)

hivex libguestfs [1.44.0-9.0.2] - libguestfs.spec: Add btrfs-progs RPM to appliance [Orabug: 35634755] libguestfs-winsupport libiscsi libnbd [1.6.0-6.el8] - Fix CVE-2024-7383 NBD server improper certificate validation resolves: RHEL-52728 [1.6.0-5.el8] - Fix …

Oct 21, 2024
Medium max 5.7

ELSA-2024-7434 1 CVE

Moderate: 389-ds-base security update (Oracle Linux 7)

[1.3.11.1-5.0.3] - Security fix for CVE-2024-8445 [Orabug: 37119399][CVE-2024-8445]

Oct 18, 2024
Medium max 6.5

ELSA-2024-12793 4 CVEs

Moderate: edk2 security update (Oracle Linux 7)

[1.7.1] - Create new 1.7.1 release for OL7 which includes the following fixed CVEs: - EDK2: EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access [Orabug: 36990130] {C…

Oct 18, 2024
Medium max 6.5

ELSA-2024-12794 4 CVEs

Moderate: edk2 security update (Oracle Linux 7)

[1.7.1] - Create new 1.7.1 release for OL7 which includes the following fixed CVEs: - EDK2: EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access [Orabug: 36990130] {C…

Oct 18, 2024
Medium max 6.5

ELSA-2024-28600 4 CVEs

Moderate: edk2 security update (Oracle Linux 8)

Oct 18, 2024
Medium max 6.5

ELSA-2024-12795 4 CVEs

Moderate: edk2 security update (Oracle Linux 8)

[20240909] - Create new 20240909 release for OL8 which includes the following fixed CVEs: - EDK2: EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT32 overflow via local access [Orabug: 369901…

Oct 18, 2024
Medium max 4.8

ELSA-2024-8117 5 CVEs

Moderate: java-1.8.0-openjdk security update (Oracle Linux 8)

[1.8.0.432.b06-2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:1.8.0.432.b06-1] - Update to shenandoah-jdk8u432-b06 (GA) - Update release notes for shenandoah-8u432-b06. - Drop JDK-828109{6,7,8}/PR3836 patch following integration of upstream version …

Oct 18, 2024
Medium max 4.8

ELSA-2024-8124 5 CVEs

Moderate: java-17-openjdk security update (Oracle Linux 8)

[17.0.13.0.11-3.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:17.0.13.0.11-3] - Correct version suffix in 'Update to jdk-17.0.13+11 (GA)' changelog entry - Related: RHEL-58781 [1:17.0.13.0.11-2] - Update to jdk-17.0.13+11 (GA) - Update .gitignore to …

Oct 18, 2024
Medium max 4.8

ELSA-2024-8127 5 CVEs

Moderate: java-21-openjdk security update (Oracle Linux 8)

[1:21.0.5.0.10-3.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:21.0.5.0.10-3] - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. ** - Related: RHEL-61346 [1:21.0.5.0.10-2] - Updat…

Oct 18, 2024
Medium max 4.8

ELSA-2024-8121 5 CVEs

Moderate: java-11-openjdk security update (Oracle Linux 8)

[1:11.0.25.0.9-2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:11.0.25.0.9-2] - Update to jdk-11.0.25+9 (GA) - Update release notes to 11.0.25+9 - Switch to GA mode for release - Related: RHEL-58772 - ** This tarball is embargoed until 2024-10-15 @ 1…

Oct 17, 2024
Medium max 9.1

ELSA-2024-8162 14 CVEs

Moderate: kernel security update (Oracle Linux 9)

[5.14.0-427.40.1_4.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.…

Oct 16, 2024
Medium max 5.0

ELSA-2024-8037 1 CVE

Moderate: OpenIPMI security update (Oracle Linux 9)

[2.0.32-5.0.1] - IPMI SMB kernel module name is ipmi_ssif in all modern kernels. openipmi-helper script fixed. [Orabug: 27093288] (alexey.petrenko@oracle.com) [2.0.32-5] - Update the patch for CVE-2024-42934 to add a missing upstream commit from 2.0.36: 663e3…

Oct 14, 2024
Medium max 7.8

ELSA-2024-12730 1 CVE

Moderate: e2fsprogs security update (Oracle Linux 7)

[1.45.4-3.0.7.el7] - libext2fs: add sanity check to extent manipulation (Srivathsa Dara) [Orabug: 37095032] {CVE-2022-1304} [1.45.4-3.0.5.el7] - e2fsprogs: bump version to 1.45.4-3.0.5 [1.45.4-3.0.5] - Fix missing changelog entries to match the latest RHEL8 p…

Oct 10, 2024
Medium max 7.8

ELSA-2024-12731 1 CVE

Moderate: e2fsprogs security update (Oracle Linux 7)

[1.45.4-3.0.7.el7] - libext2fs: add sanity check to extent manipulation (Srivathsa Dara) [Orabug: 37095032] {CVE-2022-1304}

Oct 10, 2024
Medium max 7.8

ELSA-2024-7705 1 CVE

Moderate: systemd security update (Oracle Linux 7)

[219-78.0.17] - Backport secure pager invocation for CVE-2023-26604 [Orabug: 37139943]

Oct 9, 2024
Medium max 7.8

ELSA-2024-12704 1 CVE

Moderate: e2fsprogs security update (Oracle Linux 7)

[1.45.4-3.0.7] - libext2fs: add sanity check to extent manipulation (Srivathsa Dara) [Orabug: 37095032] {CVE-2022-1304}

Oct 4, 2024
Medium max 6.5

ELSA-2024-7502 1 CVE

Moderate: go-toolset:ol8 security update (Oracle Linux 8)

delve golang [1.21.13-3] - Add evp-digest-sign-final.patch - Resolves: RHEL-61109 go-toolset

Oct 2, 2024
Medium max 6.5

ELSA-2024-7550 1 CVE

Moderate: golang security update (Oracle Linux 9)

[1.21.13-4] - Fix CVE-2024-9355 - Resolves: RHEL-61046

Oct 2, 2024
Medium max 4.4

ELSA-2024-12709 1 CVE

Moderate: python-urllib3 security update (Oracle Linux 7)

[1.10.2-7.0.1] - CVE-2024-37891 fix [Orabug: 37085188]

Oct 1, 2024
Medium max 9.1

ELSA-2024-5076 2 CVEs

Moderate: krb5 security update (Oracle Linux 7)

[1.15.1-55.0.3] - Length check when parsing GSS token encapsulation [Orabug: 36927256] - Add a simple DER support header [Orabug: 36927256] - Fix vulnerabilities in GSS message token handling [Orabug: 36927256] [1.15.1-55.0.1] - Add recursion limit for ASN.1 …

Sep 30, 2024
Medium max 4.9

ELSA-2024-12701 1 CVE

Moderate: ovirt-engine security update (Oracle Linux 8)

[4.4.10.7-1.0.33] - Fix external providers properties observability [4.4.10.7-1.0.32] - Upgrade bundled frontend dependency of jquery-ui [4.4.10.7-1.0.31] - Allow enrolling certificates in non-responsive state and Extend the lifetime of non-web certificates […

Sep 30, 2024
Medium max 7.5

ELSA-2024-7349 1 CVE

Moderate: grafana security update (Oracle Linux 8)

[9.2.10-18] - Resolves RHEL-47191

Sep 30, 2024
Medium max 5.7

ELSA-2024-6153 1 CVE

Moderate: 389-ds-base security update (Oracle Linux 7)

[1.3.11.1-5.0.1] - Security fix for CVE-2024-5953 [Orabug: 37016708][CVE-2024-5953]

Sep 28, 2024
Medium

ELSA-2024-12698 0 CVEs

Moderate: ovirt-engine security update (Oracle Linux 8)

[4.5.5-1.21] - Fix external providers properties observability

Sep 26, 2024
Medium max 6.5

ELSA-2024-7260 6 CVEs

Moderate: net-snmp security update (Oracle Linux 9)

[5.9.1-13.0.1] - fix error index value when snmpget is used a proxy pass [Orabug: 35010262] [1:5.9.1-13.3] - fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808, CVE-2022-24809 and CVE-2022-24810 (RHEL-32062)

Sep 26, 2024
Medium max 9.8

ELSA-2024-6987 3 CVEs

Moderate: emacs security update (Oracle Linux 8)

[1:26.1-12] - org-file-contents: Consider all remote files unsafe (CVE-2024-30205) - org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331) - Make Gnus treats inline MIME contents as untrusted (CVE-2024-30203) - Disable xwidgets …

Sep 24, 2024
Medium max 7.0

ELSA-2024-6963 1 CVE

Moderate: gtk3 security update (Oracle Linux 8)

[3.22.30-12] - Stop loading modules from cwd (CVE-2024-6655) - Resolves: RHEL-46988

Sep 24, 2024
Medium max 7.5

ELSA-2024-6973 2 CVEs

Moderate: dovecot security update (Oracle Linux 8)

[1:2.3.16-6] - fix CVE-2024-23185: very large headers can cause resource exhaustion when parsing message (RHEL-55219) - fix CVE-2024-23184: using a large number of address headers may trigger a denial of service (RHEL-55206)

Sep 24, 2024
Medium max 7.5

ELSA-2024-6975 3 CVEs

Moderate: python3 security update (Oracle Linux 8)

[3.6.8-67.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8-67] - Security fix for CVE-2024-6232 Resolves: RHEL-57399 [3.6.8-66] - Security fix for CVE-2024-6923 Resolves: RHEL-53065 [3.6.8-65] - Build Python with -O3 - https://fed…

Sep 24, 2024
Medium max 9.8

ELSA-2024-6989 3 CVEs

Moderate: expat security update (Oracle Linux 8)

[2.2.5-15.0.1] - lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910314] [2.2.5-15] - Rebuild for test reconfiguration [2.2.5-14] - Fix multiple CVEs - Fix CVE-2024-45492 integer overflow - Fix CVE-2024-45491 Integer Overflow or Wraparoun…

Sep 24, 2024