Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

Medium max 7.5

ELSA-2023-4233 6 CVEs

Moderate: java-11-openjdk security and bug fix update (Oracle Linux 7)

[1:11.0.20.0.8-1.0.1] - link atomic for ix86 build [1:11.0.20.0.8-1] - Update to jdk-11.0.20.0+8 (GA) - Update release notes to 11.0.20.0+8 - Switch to GA mode for release - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. ** - Resolves: rhbz#2221106 […

Jul 21, 2023
Medium max 3.7

ELSA-2023-4166 2 CVEs

Moderate: java-1.8.0-openjdk security and bug fix update (Oracle Linux 7)

[1:1.8.0.382.b05-1] - Update to shenandoah-jdk8u372-b05 (GA) - Update release notes for shenandoah-8u372-b05. - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. ** - Resolves: rhbz#2221106 [1:1.8.0.382.b04-0.1.ea] - Update to shenandoah-jdk8u382-b04 (E…

Jul 21, 2023
Medium max 7.8

ELSA-2023-3837 1 CVE

Moderate: systemd security and bug fix update (Oracle Linux 8)

[239-74.0.4.2] - Fix CVE-2023-26604 - pager: set whenver we invoke a pager (lukas.lipinsky@oracle.com) (#2175624) - pager: make pager secure when under euid is changed or explicitly requested (lukas.lipinsky@oracle.com) (#2175624) - pager: lets check SYSTEMD_…

Jul 20, 2023
Medium max 8.8

ELSA-2023-3821 3 CVEs

Moderate: ruby:2.7 security, bug fix, and enhancement update (Oracle Linux 8)

ruby [2.7.8-139] - Upgrade to Ruby 2.7.8. Resolves: rhbz#2149262 - Fix HTTP response splitting in CGI. Resolves: CVE-2021-33621 - Fix ReDoS vulnerability in URI. Resolves: CVE-2023-28755 - Fix ReDoS vulnerability in Time. Resolves: CVE-2023-28756 rubygem-abrt…

Jul 8, 2023
Medium max 5.5

ELSA-2023-3840 1 CVE

Moderate: sqlite security update (Oracle Linux 8)

[3.26.0-18.0.1] - Bumped release to add correct changelog entry. Version 3.26.0-18 fixes CVE-2020-24736 [3.26.0-18] - Fixed CVE-2022-24736

Jun 30, 2023
Medium

ELSA-2023-3839 2 CVEs

Moderate: libssh security update (Oracle Linux 8)

[0.9.6-10] - Add missing ci.fmf file - Related: rhbz#2182251, rhbz#2189742 [0.9.6-9] - Fix covscan errors found at gating - Related: rhbz#2182251, rhbz#2189742 [0.9.6-8] - Backport test fixing commits to make the build pass - Related: rhbz#2182251, rhbz#21897…

Jun 29, 2023
Medium max 5.5

ELSA-2023-3827 1 CVE

Moderate: libtiff security update (Oracle Linux 8)

[4.0.9-28] - Fix CVE-2022-48281 - Resolves: CVE-2022-48281

Jun 29, 2023
Medium max 5.5

ELSA-2023-3715 1 CVE

Moderate: libvirt security update (Oracle Linux 9)

[9.0.0-10.2.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] [9.0.0-10.2.el9_2] - virpci: Resolve leak in virPCIVirtualFunctionList cleanup (CVE-2023-2700, rhbz#2208596)

Jun 22, 2023
Medium max 7.2

ELSA-2023-3714 2 CVEs

Moderate: postgresql security update (Oracle Linux 9)

[13.11-1.0.1] - Fixed postgresql port binding issue during bootup [Orabug: 35420628] [13.11-1] - Update to 13.11 - Resolves: #2207935

Jun 22, 2023
Medium max 7.5

ELSA-2023-3722 5 CVEs

Moderate: openssl security and bug fix update (Oracle Linux 9)

[3.0.7-16.0.1] - Replace upstream references [Orabug: 34340177] [1:3.0.7-16] - Fix possible DoS translating ASN.1 object identifiers Resolves: CVE-2023-2650 - Release the DRBG in global default libctx early Resolves: rhbz#2211396 [1:3.0.7-15.1] - Re-enable DH…

Jun 22, 2023
Medium max 6.8

ELSA-2023-3711 11 CVEs

Moderate: libtiff security update (Oracle Linux 9)

[4.4.0-8] - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804 CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799 CVE-2022-48281 - Resolves: CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804 CVE-20…

Jun 21, 2023
Medium max 7.5

ELSA-2023-3725 1 CVE

Moderate: less security update (Oracle Linux 9)

[590-2] - Fix CVE-2022-46663 - Resolves: CVE-2022-46663

Jun 21, 2023
Medium max 8.6

ELSA-2023-0752 2 CVEs

Moderate: grub2 security update (Oracle Linux 9)

[2.06-46.0.4.el9_1.3] - Bump SBAT metadata for grub to 3 [Orabug: 34872719] - Fix CVE-2022-3775 [Orabug: 34871953] - Enable signing for aarch64 EFI - Fix signing certificate names - Enable back btrfs grub module for EFI pre-built image [Orabug: 34360986] - Re…

Jun 13, 2023
Medium max 7.8

ELSA-2023-3481 1 CVE

Moderate: emacs security update (Oracle Linux 7)

[1:24.3-23.1] - Fix htmlfontify.el command injection vulnerability (#2175177)

Jun 7, 2023
Medium max 7.5

ELSA-2023-3082 2 CVEs

Moderate: pcs security update (Oracle Linux 8)

[0.10.15-4.0.1.el8_8.1] - Replace HAM-logo.png with a generic one [0.10.15-4.el8_8.1] - Fix displaying differences between configuration checkpoints in pcs config checkpoint diff command - Fix pcs stonith update-scsi-devices command which was broken since Pac…

May 29, 2023
Medium

ELSA-2023-3083 2 CVEs

Moderate: go-toolset:ol8 security and bug fix update (Oracle Linux 8)

delve [1.9.1-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.9.1-1] - Rebase to 1.9.1 - Related: rhbz#2131026 golang [1.19.6-1] - Rebase to Go 1.19.6 - Resolves: rhbz#2174430 [1.19.4-2] - Fix memory leaks in EVP_{sign,verify}_raw - Res…

May 25, 2023
Medium max 5.9

ELSA-2023-3106 1 CVE

Moderate: curl security and bug fix update (Oracle Linux 8)

[7.61.1-30.el8_8.2] - sftp: do not specify O_APPEND when not in append mode (#2187717) [7.61.1-30.el8_8.1] - fix FTP too eager connection reuse (CVE-2023-27535)

May 25, 2023
Medium max 7.5

ELSA-2023-2785 1 CVE

Moderate: grafana-pcp security update (Oracle Linux 8)

[3.2.0-3] - resolve CVE-2022-27664 grafana-pcp: golang: net/http: handle server errors after sending GOAWAY

May 24, 2023
Medium max 6.5

ELSA-2023-3000 2 CVEs

Moderate: dhcp security and bug fix update (Oracle Linux 8)

[12:4.3.6-49] - Fix for CVE-2022-2928 - Fix for CVE-2022-2929 - send back dhcp6.vendor-opts again (#2142024)

May 24, 2023
Medium max 7.5

ELSA-2023-3097 5 CVEs

Moderate: gssntlmssp security update (Oracle Linux 8)

[1.2.0-1] - New release 1.2.0 - Fix CVE-2023-25563: multiple out-of-bounds read when decoding NTLM fields - Fix CVE-2023-25564: memory corruption when decoding UTF16 strings - Fix CVE-2023-25565: incorrect free when decoding target information - Fix CVE-2023-…

May 24, 2023
Medium

ELSA-2023-2948 1 CVE

Moderate: device-mapper-multipath security and bug fix update (Oracle Linux 8)

[0.8.4-37] - Fix bugzilla linked to the changes (was previously linked to the wrong bug, 2162537) - Resolves: bz #2166468 [0.8.4-36] - Add 0129-libmultipath-select-resize-action-even-if-reload-is-.patch - Add 0130-libmultipath-cleanup-ACT_CREATE-code-in-selec…

May 24, 2023
Medium max 7.5

ELSA-2023-2860 1 CVE

Moderate: python27:2.7 security update (Oracle Linux 8)

babel [2.5.1-10] - Fix CVE-2021-20095 Resolves: rhbz#1955615 [2.5.1-9] - Bumping due to problems with modular RPM upgrade path - Resolves: rhbz#1695587 [2.5.1-8] - Fix unversioned requires/buildrequires - Resolves: rhbz#1628242 [2.5.1-7] - Remove unversioned …

May 24, 2023
Medium max 6.3

ELSA-2023-2883 2 CVEs

Moderate: libtiff security update (Oracle Linux 8)

[4.0.9-27] - Fix various CVEs - Resolves: CVE-2022-3627 CVE-2022-3970

May 24, 2023
Medium max 4.7

ELSA-2023-2867 1 CVE

Moderate: postgresql-jdbc security update (Oracle Linux 8)

[42.2.14-2] - Fix CVE-2022-41946

May 24, 2023
Medium max 5.3

ELSA-2023-2866 3 CVEs

Moderate: git-lfs security and bug fix update (Oracle Linux 8)

[3.2.0-2] - Rebuild with Golang-1.19.4 - Resolves: #2163744 [3.2.0-1] - Update to version 3.2.0 - Resolves: #2139382 [2.13.3-2] - Define %gobuild macro with proper ldflags - Related: rhbz#2021549 [2.13.3-1] - Update to version 2.13.3 - Fixed round brackets in…

May 24, 2023
Medium max 5.9

ELSA-2023-2851 9 CVEs

Moderate: freerdp security update (Oracle Linux 8)

[2:2.2.0-10] - Fix 'implicit declaration of function' errors (#2136153, #2145139) [- 2:2.2.0-9] - CVE-2022-39282: Fix length checks in parallel driver (#2136151) - CVE-2022-39283: Add missing length check in video channel (#2136153) - CVE-2022-39316, CVE-2022…

May 24, 2023
Medium max 7.5

ELSA-2023-2771 1 CVE

Moderate: unbound security and bug fix update (Oracle Linux 8)

[1.16.2-5] - Stop creating wrong devel manual pages (#2135322) [1.16.2-4] - Apply correctly previous change (CVE-2022-3204) [1.16.2-3] - Fix NRDelegation attack leading to uncontrolled resource consumption (CVE-2022-3204)

May 24, 2023
Medium max 7.5

ELSA-2023-2784 4 CVEs

Moderate: grafana security update (Oracle Linux 8)

[7.5.15-4] - resolve CVE-2022-39229 grafana: using email as a username can block other users from signing in - resolve CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY - resolve CVE-2022-41715 golang: regexp/syntax: limit memory used…

May 24, 2023
Medium max 8.8

ELSA-2023-2805 9 CVEs

Moderate: xorg-x11-server-Xwayland security update (Oracle Linux 8)

[21.1.3-10] - Fix CVE-2023-0494 (#2166972) [21.1.3-9] - Follow-up fix for CVE-2022-46340 (#2151777) [21.1.3-8] - CVE fix for: CVE-2022-4283 (#2151802), CVE-2022-46340 (#2151777), CVE-2022-46341 (#2151782), CVE-2022-46342 (#2151785), CVE-2022-46343 (#2151792),…

May 24, 2023
Medium max 7.5

ELSA-2023-2780 5 CVEs

Moderate: Image Builder security, bug fix, and enhancement update (Oracle Linux 8)

cockpit-composer [45-1.0.1] - Make per page documentation links point to Oracle Linux [Orabug: 32013095] [45-1] - New upstream release [44-1] - New upstream release [43-1] - New upstream release [42-1] - New upstream release [40-1] - New upstream release [39-…

May 24, 2023
Medium max 6.6

ELSA-2023-2786 1 CVE

Moderate: wayland security, bug fix, and enhancement update (Oracle Linux 8)

[1.21.0-1] - wayland 1.21.0 (rhbz#2137625)

May 24, 2023
Medium

ELSA-2023-2810 1 CVE

Moderate: poppler security update (Oracle Linux 8)

[20.11.0-6] - Check for overflow when computing number of symbols - in JBIG2 text region - Resolves: #2126361

May 24, 2023
Medium max 8.8

ELSA-2023-2830 6 CVEs

Moderate: tigervnc security and bug fix update (Oracle Linux 8)

[1.12.0-15] - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability Resolves: bz#2180305 [1.12.0-14] - SELinux: allow vncsession create .vnc directory Resolves: bz#2164704 [1.12.0-13] - Add sanity check when clea…

May 24, 2023
Medium max 9.8

ELSA-2023-2903 5 CVEs

Moderate: php:7.4 security update (Oracle Linux 8)

libzip [1.6.1-1] - update to 1.6.1 - enable lzma support [1.5.2-1] - update to 1.5.2 - add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available [1.5.1-1] - update to 1.5.1 - drop dependency on zlib-devel and…

May 24, 2023
Medium max 7.0

ELSA-2023-2800 1 CVE

Moderate: sysstat security and bug fix update (Oracle Linux 8)

[11.7.3-9.0.1] - add mpstat -H option to also display physically hotplugged vCPUs [Orabug: 34683071] [11.7.3-9] - add -f flag to force fdatasync() after sa file update (#2153192) [11.7.3-8] - arithmetic overflow in allocate_structures() on 32 bit systems (CVE…

May 24, 2023
Medium max 5.5

ELSA-2023-2873 1 CVE

Moderate: gcc-toolset-12-binutils security update (Oracle Linux 8)

[2.38-17] - Fix an illegal memory access parsing a corrupt ELF file. (#2153220)

May 24, 2023
Medium max 7.5

ELSA-2023-2893 1 CVE

Moderate: python-mako security update (Oracle Linux 8)

[1.0.6-14] - Fix CVE-2022-40023 (#2128977)

May 24, 2023
Medium max 7.5

ELSA-2023-2870 3 CVEs

Moderate: freeradius:3.0 security update (Oracle Linux 8)

[3.0.20-14] - Fix defect found by Covscan Resolves: #2151704 [3.0.20-13] - Fix multiple CVEs - Add rpminspect configuration Resolves: #2151702 Resolves: #2151704 Resolves: #2151706

May 24, 2023
Medium max 6.5

ELSA-2023-2898 4 CVEs

Moderate: libtar security update (Oracle Linux 8)

[1.2.20-17] - fix use-after-free bugs introduced by incorrect memleak fixes (CVE-2021-33640) [1.2.20-16] - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646) - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33…

May 24, 2023
Medium max 5.3

ELSA-2023-3002 1 CVE

Moderate: bind security and bug fix update (Oracle Linux 8)

[32:9.11.36-8] - Correct regression preventing bind-dyndb-ldap build (#2133889) [32:9.11.36-7] - Prevent excessive resource use while processing large delegations. (CVE-2022-2795) [32:9.11.36-6] - Prevent freeing zone during statistics rendering (#2101712)

May 24, 2023