Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

Medium max 5.4

ELSA-2024-4231 1 CVE

Moderate: python-jinja2 security update (Oracle Linux 8)

[2.10.1-5] - Security fix for CVE-2024-34064 Resolves: RHEL-35651

Jul 3, 2024
Medium max 6.2

ELSA-2024-4260 1 CVE

Moderate: python-idna security update (Oracle Linux 8)

[2.5-7] - Fix patch application for security fix for CVE-2024-3651 Resolves: RHEL-32703 [2.5-6] - Security fix for CVE-2024-3651 Resolves: RHEL-32703

Jul 3, 2024
Medium max 7.5

ELSA-2024-4246 1 CVE

Moderate: container-tools security update (Oracle Linux 8)

aardvark-dns [2:1.10.0-1] - update to https://github.com/containers/aardvark-dns/releases/tag/v1.10.0 - Related: Jira:RHEL-2110 [2:1.9.0-1] - update to https://github.com/containers/aardvark-dns/releases/tag/v1.9.0 - Related: Jira:RHEL-2110 [2:1.8.0-1] - upda…

Jul 3, 2024
Medium max 9.8

ELSA-2024-4237 2 CVEs

Moderate: go-toolset security update (Oracle Linux 8)

delve [1.21.2-3.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.21.2-3] - Skip an additional test as it's breaking in the CI system. - Modify the name of the patch. - Resolves: RHEL-22820 [1.21.2-2] - Fix: Remove architectures from exclu…

Jul 3, 2024
Medium max 6.3

ELSA-2024-4244 1 CVE

Moderate: python3.11-PyMySQL security update (Oracle Linux 8)

[1.0.2-2] - Security fix for CVE-2024-36039 Resolves: RHEL-38365

Jul 2, 2024
Medium max 7.3

ELSA-2024-4247 1 CVE

Moderate: libuv security update (Oracle Linux 8)

[1:1.41.1-2] - Backport fixes for CVE-2024-24806 Resolves: RHEL-24790

Jul 2, 2024
Medium max 6.7

ELSA-2024-4227 1 CVE

Moderate: python-pillow security update (Oracle Linux 8)

[5.1.1-21] - Security fix for CVE-2024-28219 Resolves: RHEL-31071

Jul 2, 2024
Medium max 5.3

ELSA-2024-4252 1 CVE

Moderate: nghttp2 security update (Oracle Linux 8)

[1.33.0-6.1] - fix CONTINUATION frames DoS (CVE-2024-27316) [1.33.0-6] - fix CONTINUATION frames DoS (CVE-2024-28182)

Jul 2, 2024
Medium max 4.4

ELSA-2024-4265 1 CVE

Moderate: cups security update (Oracle Linux 8)

[ - 1:2.2.6-60] - RHEL-40386 cups: Cupsd Listen arbitrary chmod 0140777 - Delete the domain socket file after stopping the cups.socket service - Fix cupsd Listener checks [1:2.2.6-59] - RHEL-40386 cups: Cupsd Listen arbitrary chmod 0140777 - Require cups.sock…

Jul 2, 2024
Medium max 7.5

ELSA-2024-4259 1 CVE

Moderate: xmlrpc-c security and bug fix update (Oracle Linux 8)

[1.51.0-9] - Address segfault found in CVE-2023-52425 (RHEL-24226)

Jul 2, 2024
Medium max 9.8

ELSA-2024-4212 2 CVEs

Moderate: golang security update (Oracle Linux 9)

[1.21.11-1] - Update to Go 1.21.11 that fixes CVE-2024-24789 and CVE-2024-24790 - Resolves: RHEL-40275

Jul 2, 2024
Medium max 7.3

ELSA-2024-4197 1 CVE

Moderate: httpd:2.4/httpd security update (Oracle Linux 8)

httpd [2.4.37-65.0.1] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-65] - Resolves: RHEL-31857 - httpd:2.4/httpd: HTTP response splitting (CVE-2023-38709) mod_http2 mod_md

Jul 1, 2024
Medium max 6.5

ELSA-2024-4050 1 CVE

Moderate: libreswan security update (Oracle Linux 9)

[4.12-2.0.1.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.12-2.1] - Fix CVE-2024-3652 (RHEL-40102)

Jun 24, 2024
Medium max 5.3

ELSA-2024-3501 1 CVE

Moderate: nghttp2 security update (Oracle Linux 9)

[1.43.0-5.2] - fix CONTINUATION frames DoS (CVE-2024-28182, CVE-2024-27316)

Jun 20, 2024
Medium max 4.9

ELSA-2024-3968 2 CVEs

Moderate: container-tools:ol8 bug fix and enhancement update (Oracle Linux 8)

aardvark-dns [2:1.10.0-1] - update to https://github.com/containers/aardvark-dns/releases/tag/v1.10.0 - Related: Jira:RHEL-2110 [2:1.9.0-1] - update to https://github.com/containers/aardvark-dns/releases/tag/v1.9.0 - Related: Jira:RHEL-2110 [2:1.8.0-1] - upda…

Jun 18, 2024
Medium max 5.5

ELSA-2024-12435 2 CVEs

Moderate: virt:kvm_utils1 security update (Oracle Linux 8)

hivex libguestfs libguestfs-winsupport libiscsi libnbd libvirt [5.7.0-42] - Document CVEs as fixed (Karl Heubaum) {CVE-2023-2700} - Fix off-by-one error in udevListInterfacesByStatus (Martin Kletzander) [Orabug: 36364474] {CVE-2024-1441} - libvirt-<module>: C…

Jun 13, 2024
Medium max 9.8

ELSA-2024-3838 6 CVEs

Moderate: ruby security update (Oracle Linux 9)

[3.0.7-162] - Upgrade to Ruby 3.0.7. Resolves: RHEL-35740 - Fix HTTP response splitting in CGI. Resolves: RHEL-35741 - Fix ReDoS vulnerability in URI. Resolves: RHEL-35742 - Fix ReDoS vulnerability in Time. Resolves: RHEL-35743 - Fix buffer overread vulnerabi…

Jun 13, 2024
Medium max 6.2

ELSA-2024-3846 1 CVE

Moderate: python-idna security update (Oracle Linux 9)

[2.10-7.0.1.1] - Rebuild with release bump [2.10-7.1] - Security fix for CVE-2024-3651 Resolves: RHEL-33464

Jun 13, 2024
Medium max 6.5

ELSA-2024-3830 1 CVE

Moderate: gvisor-tap-vsock security and bug fix update (Oracle Linux 9)

[6:0.7.3-3] - rebuild for CVE-2023-45290 - Resolves: RHEL-28388

Jun 12, 2024
Medium max 6.2

ELSA-2024-3823 1 CVE

Moderate: rpm-ostree security update (Oracle Linux 9)

[2024.3-3] - Backport https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6 Resolves: #RHEL-31852 [2024.3-2] - Backport https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6 Resolves: #RHEL-31852

Jun 12, 2024
Medium max 8.8

ELSA-2024-3783 6 CVEs

Moderate: firefox security update (Oracle Linux 8)

[115.11.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding OpenELA file [115.11.0-1] - Update to 115.11.0 build1

Jun 11, 2024
Medium max 8.8

ELSA-2024-3784 6 CVEs

Moderate: thunderbird security update (Oracle Linux 8)

[115.11.0-1.0.1] - Add Oracle prefs file [115.11.0-1] - Update to 115.11.0 build2

Jun 11, 2024
Medium max 7.3

ELSA-2024-3843 1 CVE

Moderate: cockpit security update (Oracle Linux 9)

[311.2-1.0.1] - Replaced upstream urls in documentation with oracle links [Orabug: 36528753] - Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110] - Remove duplicate reference to server in cockpit [Orabug: 34030494] - Update documentation …

Jun 11, 2024
Medium max 6.5

ELSA-2024-3827 3 CVEs

Moderate: buildah security and bug fix update (Oracle Linux 9)

[1.33.7-2.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.33.7-2] - update to the latest content of https://github.com/containers/buildah/tree/release-1.33 (https://github.com/containers/buildah/commit/997beea) - Res…

Jun 11, 2024
Medium max 7.8

ELSA-2024-3834 1 CVE

Moderate: gdk-pixbuf2 security update (Oracle Linux 9)

[2.42.6-4] - Backport fixes for CVE-2022-48622 - Resolves: RHEL-36432

Jun 11, 2024
Medium max 6.5

ELSA-2024-3826 3 CVEs

Moderate: podman security and bug fix update (Oracle Linux 9)

[4.9.4-4.0.1] - Improved saving remote build context to tarfile in Podman daemon [Orabug: 36495655] - Add devices on container startup, not on creation - Backport fast gzip for compression [Orabug: 36420418] - overlay: Put should ignore ENINVAL for Unmount [O…

Jun 11, 2024
Medium max 6.5

ELSA-2024-3831 1 CVE

Moderate: containernetworking-plugins security and bug fix update (Oracle Linux 9)

[1:1.4.0-3] - rebuild for CVE-2023-45290 - Resolves: RHEL-28384

Jun 11, 2024
Medium max 5.4

ELSA-2024-3820 1 CVE

Moderate: fence-agents security update (Oracle Linux 9)

[4.10.0-62.3] - bundled jinja2: fix CVE-2024-34064 Resolves: RHEL-36482 [4.10.0-62.2] - fence_eps: add fence_epsr2 for ePowerSwitch R2 and newer Resolves: RHEL-35273 [4.10.0-62.1] - ha-cloud-support: upgrade bundled pyroute2 libs to fix issue in gcp-vpc-move-…

Jun 11, 2024
Medium max 9.8

ELSA-2024-3670 3 CVEs

Moderate: ruby:3.3 security, bug fix, and enhancement update (Oracle Linux 8)

ruby [3.3.1-2] - Upgrade to Ruby 3.3.1. Resolves: RHEL-37446 - Fix buffer overread vulnerability in StringIO. (CVE-2024-27280) Resolves: RHEL-37448 - Fix RCE vulnerability with .rdoc_options in RDoc. (CVE-2024-27281) Resolves: RHEL-37449 - Fix Arbitrary memor…

Jun 7, 2024
Medium max 7.3

ELSA-2024-3667 1 CVE

Moderate: cockpit security update (Oracle Linux 8)

[310.4-1.0.1] - Update documentation links [Orabug: 34706402] - Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110] - Remove duplicate reference to server in cockpit [Orabug: 33862832] - Update documentation links [Orabug: 32795691] - Make…

Jun 6, 2024
Medium

ELSA-2024-3619 2 CVEs

Moderate: kernel security and bug fix update (Oracle Linux 9)

- [5.14.0-427.20.1_4.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_ke…

Jun 6, 2024
Medium max 9.8

ELSA-2024-3671 3 CVEs

Moderate: ruby:3.3 security, bug fix, and enhancement update (Oracle Linux 9)

ruby [3.3.1-2] - Upgrade to Ruby 3.3.1. Resolves: RHEL-37697 - Fix buffer overread vulnerability in StringIO. (CVE-2024-27280) Resolves: RHEL-37699 - Fix RCE vulnerability with .rdoc_options in RDoc. (CVE-2024-27281) Resolves: RHEL-37696 - Fix Arbitrary memor…

Jun 6, 2024
Medium max 9.8

ELSA-2024-3668 3 CVEs

Moderate: ruby:3.1 security, bug fix, and enhancement update (Oracle Linux 9)

ruby [3.1.5-144] - Upgrade to Ruby 3.1.5. Resolves: RHEL-33978 - Fix buffer overread vulnerability in StringIO. Resolves: RHEL-34129 - Fix RCE vulnerability with .rdoc_options in RDoc. Resolves: RHEL-34121 - Fix arbitrary memory address read vulnerability wit…

Jun 6, 2024
Medium max 7.5

ELSA-2024-3626 1 CVE

Moderate: libxml2 security update (Oracle Linux 8)

[2.9.7-18.1] - Fix CVE-2024-25062 (RHEL-31056)

Jun 5, 2024
Medium max 9.8

ELSA-2024-3618 57 CVEs

Moderate: kernel update (Oracle Linux 8)

[4.18.0-553.5.1.el8_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509…

Jun 5, 2024
Medium max 9.8

ELSA-2024-3546 3 CVEs

Moderate: ruby:3.1 security, bug fix, and enhancement update (Oracle Linux 8)

ruby [3.1.5-143] - Upgrade to Ruby 3.1.5. Resolves: RHEL-35748 - Fix buffer overread vulnerability in StringIO. Resolves: RHEL-35749 - Fix RCE vulnerability with .rdoc_options in RDoc. Resolves: RHEL-35750 - Fix arbitrary memory address read vulnerability wit…

Jun 3, 2024
Medium max 8.8

ELSA-2024-12407 7 CVEs

Moderate: qemu-kvm security update (Oracle Linux 9)

[7.2.0-11.el9] - vfio/migration: Add a note about migration rate limiting (Avihai Horon) [Orabug: 36329758] - vfio/migration: Refactor vfio_save_state() return value (Avihai Horon) [Orabug: 36329758] - migration: Don't serialize devices in qemu_savevm_state_i…

Jun 3, 2024
Medium max 5.5

ELSA-2024-12406 1 CVE

Moderate: libvirt security update (Oracle Linux 9)

libvirt [9.0.0-5.el9] - Fix off-by-one error in udevListInterfacesByStatus (Martin Kletzander) [Orabug: 36364464] {CVE-2024-1441} libvirt-python [9.0.0-5.el9] - Update to libvirt 9.0.0-5 (Karl Heubaum)

Jun 3, 2024
Medium max 9.8

ELSA-2024-3500 6 CVEs

Moderate: ruby:3.0 security update (Oracle Linux 8)

ruby [3.0.7-143] - Fix Zlib test failures on s390x due to HW acceleration Related: RHEL-36189 [3.0.7-142] - Upgrade to Ruby 3.0.7. Resolves: RHEL-36189 - Fix HTTP response splitting in CGI. Resolves: RHEL-36193 - Fix ReDoS vulnerability in URI. Resolves: RHEL…

May 31, 2024
Medium max 6.2

ELSA-2024-3253 1 CVE

Moderate: virt:ol and virt-devel:ol security update (Oracle Linux 8)

hivex libguestfs libguestfs-winsupport libiscsi libnbd libtpms libvirt [8.0.0-23.1.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] - Add runtime deps for pkg librbd1 >= 1:10.2.5 (Keshav Sharma) [8.0.0-23.1.el8] - remote: check for negative arra…

May 30, 2024