Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

  • Medium max 7.5
    ELSA-2026-68266 1 CVE

    Moderate: libsoup security update (Oracle Linux 8)

    [2.62.3-15] - Backport patch for CVE-2026-15711

  • Medium max 6.5
    ELSA-2026-68316 1 CVE

    Moderate: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [8.0.131-1.0.1] - Add support for Oracle Linux [8.0.131-1] - Update to .NET SDK 8.0.131 and Runtime 8.0.31 - Resolves: RHEL-252244

  • Medium max 9.8
    ELSA-2026-68660 8 CVEs

    Moderate: tomcat security, bug fix, and enhancement update (Oracle Linux 9)

    [1:9.0.120-1] - Resolves: RHEL-192825 HTTP/2 request headers not validated (CVE-2026-41293) - Resolves: RHEL-192659 Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) - Resolves: RHEL-219565 Security constraint bypass via improper …

  • Medium max 5.7
    ELSA-2026-68291 1 CVE

    Moderate: unbound security update (Oracle Linux 10)

    [1.24.2-20] - Backport additional fix of locks during initialization [1.24.2-19] - Fix CVE-2026-50252: prevent cache poisoning via shared ports [1.24.2-18] - Add unit tests for CVE-2026-{44690,55973} [1.24.2-17] - Fix CVE-2026-55973: dns-error-reporting stack…

  • Medium max 5.5
    ELSA-2026-67585 1 CVE

    Moderate: firewalld security update (Oracle Linux 9)

    [1.3.4-20.0.1] - Red Hat Satellite and Red Hat high availaibility reference found in cockpit UI [Orabug: 30257573] - discard empty RH-Satellite-6.xml [Orabug: 30328734] - Remove capsule file as well, since it references removed config [Orabug: 33513329] [1.3.…

  • Medium max 7.5
    ELSA-2026-68234 2 CVEs

    Moderate: libsoup security update (Oracle Linux 9)

    [2.72.0-16.3] - Fix CVE-2026-15711: Reject oversized WebSocket control frames [2.72.0-16.2] - Backport patch for CVE-2026-15709

  • Medium max 5.7
    ELSA-2026-68292 1 CVE

    Moderate: unbound security update (Oracle Linux 9)

    [1.24.2-3.6] - Backport additional fix from 1.26.0 (CVE-2026-50252) [1.24.2-3.5] - Fix CVE-2026-50252 (RHEL-243479)

  • Medium max 4.6
    ELSA-2026-67886 2 CVEs

    Moderate: coreutils security update (Oracle Linux 10)

    [9.5-8.0.1.el10_2.1] - clean up empty file if cp is failed [Orabug 15973168] [9.5-8.1] - uniq: fix CVE-2026-56391 (RHEL-216794) - fix read overrun with -w - unexpand: fix CVE-2026-56392 and related crashes (RHEL-216784) - fix direct.sh and unexpand/mb.sh test…

  • Medium max 7.5
    ELSA-2026-27746 1 CVE

    Moderate: openssl-fips-provider security update (Oracle Linux 10)

    [3.0.7-11.0.1] - Add bundle with Oracle Linux 9 OpenSSL FIPS module packages [Orabug: 40015480] - Update extract-src.sh script to support non-hobbled openssl tarball [Orabug: 40015480] [3.0.7-11] - Update sources and scripts for new build, to address CVE-2026…

  • Medium max 6.5
    ELSA-2026-67524 1 CVE

    Moderate: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [8.0.131-1.0.1] - Add support for Oracle Linux [8.0.131-1] - Update to .NET SDK 8.0.131 and Runtime 8.0.31 - Resolves: RHEL-252247

  • Medium max 6.5
    ELSA-2026-67525 1 CVE

    Moderate: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [8.0.131-1.0.1] - Add support for Oracle Linux [8.0.131-1] - Update to .NET SDK 8.0.131 and Runtime 8.0.31 - Resolves: RHEL-252248

  • Medium max 7.5
    ELSA-2026-67584 1 CVE

    Moderate: rsyslog security update (Oracle Linux 10)

    [8.2510.0-5.1] - Backport: guard regex-framing match against iCurrLine == 0 to fix crash Resolves: RHEL-212700

  • Medium max 7.5
    ELSA-2026-42694 3 CVEs

    Moderate: glibc security update (Oracle Linux 10)

    [2.39-128.0.1] - Forward port Oracle changes to 2.39-128. - Reviewed-by: Elena Zannoni <elena.zannoni@oracle.com> Oracle history: Jul-15-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.39-126.0.1 - Forward port Oracle changes to 2.39-126. - Reviewed…

  • Medium max 7.5
    ELSA-2026-27744 1 CVE

    Moderate: openssl-fips-provider security update (Oracle Linux 9)

    [3.0.7-11.0.1] - Drop OpenELA branding [Orabug: 37274593] - Add bundle with Oracle Linux 9 OpenSSL FIPS module packages [Orabug: 39910507] - Update extract-src.sh script to support non-hobbled openssl tarball [Orabug: 39910507] [3.0.7.openela.0.1] - Add OpenE…

  • Medium max 5.5
    ELSA-2026-59997 1 CVE

    Moderate: polkit security update (Oracle Linux 10)

    [125-4.0.1.el10_2.1] - Increase timeout to avoid defunct processes [Orabug: 26930744] [125-4.1] - NOTICE (jrybar): the record 125-4 below was added in manually after Ymir's initial - commit 125-3.1. For some reason, 125-3.1 for rhel-10.2 was based on contents…

  • Medium max 8.2
    ELSA-2026-59372 1 CVE

    Moderate: assertj-core security update (Oracle Linux 10)

    [3.24.2-9.1] - Fix CVE-2026-24400: add XXE protection to XmlStringPrettyFormatter - Resolves: RHEL-183469

  • Medium max 7.3
    ELSA-2026-59387 2 CVEs

    Moderate: mod_http2 security, bug fix, and enhancement update (Oracle Linux 9)

    [2.0.26-6.2] - Resolves: RHEL-190583 - address CVE-2026-43951 and CVE-2026-48913 in mod_http2

  • Medium max 5.9
    ELSA-2026-59379 1 CVE

    Moderate: pam security update (Oracle Linux 10)

    [1.6.1-9.1] - pam_userdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191704

  • Medium max 7.1
    ELSA-2026-59380 1 CVE

    Moderate: attr security update (Oracle Linux 10)

    [2.6.0-1] - rebase to 2.6.0 to fix the following CVEs: - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr (RHEL-186128)

  • Medium max 6.7
    ELSA-2026-58555 1 CVE

    Moderate: NetworkManager security update (Oracle Linux 8)

    [1.40.16-21.0.1] - Add support for DAD_CONFLICT to nm-dispatcher - Drop 777 permissions from Networkmanager-dispatcher drop-in directory [Orabug: 37581862] - Add a dropin file to make Networkmanager-dispatcher persistent [Orabug: 36989910] - disable MPTCP han…

  • Medium max 7.5
    ELSA-2026-58560 1 CVE

    Moderate: cups-filters security update (Oracle Linux 9)

    [1.28.7-27.0.1] - header/footer not being printed in banner page. [Orabug: 28265099] (isaac.chen@oracle.com) - Fixes [Orabug: 29163824] source indentation not following convention (isaac.chen@oracle.com) [1.28.7-27] - CVE-2026-64612 cups-filters: handle libpn…

  • Medium max 6.7
    ELSA-2026-58572 1 CVE

    Moderate: NetworkManager security update (Oracle Linux 9)

    [1.54.3-5.0.1] - Introduce always-ignore-carrier setting [Orabug: 39663315] - disable MPTCP handling by default [Orabug: 34801142] - add connectivity check via Oracle servers [Orabug: 32051972] - Add a dropin file to make Networkmanager-dispatcher persistent …

  • Medium max 7.4
    ELSA-2026-58982 2 CVEs

    Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 9)

    [10.2.6-23] - Resolves RHEL-183803: CVE-2026-39821 - Resolves RHEL-188280

  • Medium max 6.7
    ELSA-2026-58571 1 CVE

    Moderate: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 10)

    [10.1.0-16.el10_2.5] - kvm-file-posix-populate-pwrite_zeroes_alignment.patch [RHEL-207389] - kvm-block-use-pwrite_zeroes_alignment-when-writing-first.patch [RHEL-207389] - kvm-iotests-add-Linux-loop-device-image-creation-test.patch [RHEL-207389] - Resolves: R…

  • Medium max 7.5
    ELSA-2026-57451 1 CVE

    Moderate: cups-filters security update (Oracle Linux 8)

    [1.20.0-36.0.1.el8_10.1] - header/footer not being printed in banner page. [Orabug: 28265099] (isaac.chen@oracle.com) - Fixes [Orabug: 29163824] source indentation not following convention (isaac.chen@oracle.com) [1.20.0-36.1] - CVE-2026-64612 cups-filters: H…

  • Medium max 6.8
    ELSA-2026-55775 3 CVEs

    Moderate: java-1.8.0-openjdk security update (Oracle Linux 8)

    [1.8.0.504.b01-1.1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:1.8.0.504.b01-1.1] - Update to 8u504-b01 (GA). - Update release notes for 8u504-b01. - Bump FreeType version to 2.14.3 following JDK-8385390 - Sync the copy of the portable specfile wit…

  • Medium max 6.8
    ELSA-2026-55781 3 CVEs

    Moderate: java-17-openjdk security update (Oracle Linux 8)

    [17.0.20.1.1-1.1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:17.0.20.1.1-1.1] - Update to jdk-17.0.20.1+1 (GA) - Add to .gitignore openjdk-17.0.20.1+1.tar.xz - Set patchver to 1 - Set buildver to 1 - Update sources to openjdk-17.0.20.1+1.tar.xz - *…

  • Medium max 7.8
    ELSA-2026-57610 1 CVE

    Moderate: kbd security update (Oracle Linux 9)

    [2.4.0-12] - Fix CVE-2026-72693: openvt -u process matching made more conservative Resolves: RHEL-235988

  • Medium max 7.5
    ELSA-2026-55798 4 CVEs

    Moderate: java-25-openjdk security update (Oracle Linux 9)

    [1:25.0.4.1.1-1.1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:25.0.4.1.1-1.1] - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - *…

  • Medium max 7.8
    ELSA-2026-57597 1 CVE

    Moderate: kbd security update (Oracle Linux 10)

    [2.6.4-8] - Fix openvt -u process matching to be more conservative (CVE-2026-72693) Resolves: RHEL-235987

  • Medium max 6.8
    ELSA-2026-55787 3 CVEs

    Moderate: java-21-openjdk security update (Oracle Linux 8)

    [1:21.0.12.1.1-1.2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:21.0.12.1.1-1.2] - Bump release for PQC build - Related: RHEL-235625 [1:21.0.12.1.1-1.1] - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the po…

  • Medium max 7.5
    ELSA-2026-56966 3 CVEs

    Moderate: gstreamer1-plugins-good security update (Oracle Linux 8)

    [1.16.1-7.3] - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239048 [1.16.1-7.2] - Fix CVE-2026-18649 in H.264/H.265 RTP depayloaders Resolves: RHEL-224145 [1.16.1-7.1] - Fix multiple security issues in AVI demuxer (CVE-20…

  • Medium max 8.2
    ELSA-2026-500220 3 CVEs

    Moderate: qemu-kvm security update (Oracle Linux 9)

    [7.2.0-42.el9] - migration: Enable multifd VFIO device state transfer by default for Exadata (Maciej S. Szmigiero) [Orabug: 39783645] - vfio/migration: Add x-migration-load-config-after-iter VFIO property (Maciej S. Szmigiero) [Orabug: 39783615] - tests/9p: a…

  • Medium max 7.3
    ELSA-2026-57015 7 CVEs

    Moderate: glib2 security update (Oracle Linux 10)

    [2.80.4-21] - Fix CVE-2026-15588: limit D-Bus auth line read length [2.80.4-20] - Fix CVE-2026-58011: range validation in g_date_time_add_full() [2.80.4-19] - Fix CVE-2026-58012: buffer overflow in gregex.c with G_REGEX_RAW [2.80.4-18] - Fix CVE-2026-58010: o…

  • Medium max 7.5
    ELSA-2026-56965 2 CVEs

    Moderate: libcupsfilters security update (Oracle Linux 10)

    [1:2.0.0-13] - RHEL-214027 CVE-2026-64611 libcupsfilters: Fix infinite loop and empty device_ids in ieee1284 [1:2.0.0-12] - RHEL-212655 CVE-2026-64612 libcupsfilters: Handle libpng errors via longjmp()/setjmp() to prevent process abort on malformed PNG

  • Medium max 5.4
    ELSA-2026-55804 1 CVE

    Moderate: nghttp2 security update (Oracle Linux 8)

    [1.33.0-6.3] - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

  • Medium max 5.9
    ELSA-2026-56131 1 CVE

    Moderate: pam security update (Oracle Linux 8)

    [1.3.1-40.0.1] - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36272695] [1.3.1-40] - pam_userdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191699

  • Medium max 7.1
    ELSA-2026-56133 1 CVE

    Moderate: attr security update (Oracle Linux 8)

    [2.6.0-1] - rebase to 2.6.0 to fix the following CVEs: - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr (RHEL-186121) - fix couple of rpminspect warnings

  • Medium max 6.6
    ELSA-2026-55436 2 CVEs

    Moderate: gstreamer1-plugins-good security update (Oracle Linux 9)

    [1.22.12-7.4] - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239042 [1.22.12-7.3] - Fix CVE-2026-73433: add bounds checks to FUJIFILM strd metadata parsing in avidemux to prevent unsigned integer underflow Resolves: RHEL-…

  • Medium max 7.3
    ELSA-2026-55440 7 CVEs

    Moderate: glib2 security update (Oracle Linux 9)

    [2.68.4-19.9] - Fix CVE-2026-15588: limit D-Bus auth line read length [2.68.4-19.8] - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Resolves: RHEL-212157 [2.68.4-19.7] - Fix CVE-2026-58012: buffer overflow in gregex.c with G_REGEX_RAW - R…