Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

Medium max 8.8

ELSA-2022-1777 30 CVEs 2 exploited

Moderate: webkit2gtk3 security, bug fix, and enhancement update (Oracle Linux 8)

[2.34.6-1] - Update to 2.34.6 Related: #1985042 [2.34.5-1] - Update to 2.34.5 - Related: #1985042 [2.34.4-1] - Update to 2.34.4 - Resolves: #1985042 [2.32.4-1] - Update to 2.32.4 - Related: #1985042 - Resolves: #2006429

May 17, 2022
Medium

ELSA-2022-1950 1 CVE

Moderate: dovecot security update (Oracle Linux 8)

[1:2.3.16-2] - do not disable xz/lzma for now despite being deprecated [1:2.3.16-1] - dovecot updated to 2.3.16, pigeonhole to 0.5.16 - fix CVE-2021-33515 plaintext commands injection (#1980014)

May 17, 2022
Medium max 5.2

ELSA-2022-1766 3 CVEs

Moderate: libreoffice security, bug fix, and enhancement update (Oracle Linux 8)

[1:6.4.7.2-10.0.1] - Replace colors with Oracle colors [Orabug: 32120093] - Build with --with-vendor='Oracle America, Inc.' - Added the --with-hamcrest option to configure. [1:6.4.7.2-10] - Related: rhbz#2029810 bump n-v-r [1:6.4.7.2-9] - Related: rhbz#202981…

May 17, 2022
Medium

ELSA-2022-1934 1 CVE

Moderate: mod_auth_mellon security update (Oracle Linux 8)

[0.14.0-12.1] - Resolves: rhbz#1986805 - CVE-2021-3639 mod_auth_mellon: Open Redirect vulnerability in logout URLs [rhel-8]

May 17, 2022
Medium

ELSA-2022-2120 1 CVE

Moderate: zsh security update (Oracle Linux 8)

[5.5.1-9] - do not perform PROMPT_SUBST evaluation on file.file/%K arguments (CVE-2021-45444) [5.5.1-8] - improve printing of error messages introduced by the fix of CVE-2019-20044 [5.5.1-7] - drop privileges securely when unsetting PRIVILEGED option (CVE-201…

May 17, 2022
Medium

ELSA-2022-1808 1 CVE

Moderate: aspell security update (Oracle Linux 8)

[12:0.60.6.1-22] - resolves: #1988497 fix CVE-2019-25051

May 17, 2022
Medium

ELSA-2022-1819 7 CVEs

Moderate: go-toolset:ol8 security and bug fix update (Oracle Linux 8)

delve [1.7.2-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.7.2-1] - Rebase to 1.7.2 - Related: rhbz#2014088 golang [1.17.7-1] - Rebase to Go 1.17.7 - Remove fips memory leak patch (fixed in tree) - Resolves: rhbz#2015930 go-toolset […

May 17, 2022
Medium max 7.3

ELSA-2022-1894 1 CVE

Moderate: rust-toolset:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

rust [1.58.1-1] - Update to 1.58.1. [1.58.0-1] - Update to 1.58.0. [1.57.0-1] - Update to 1.57.0. [1.56.1-2] - Add rust-std-static-wasm32-wasi Resolves: rhbz#1980080 [1.56.0-1] - Update to 1.56.1. [1.55.0-1] - Update to 1.55.0. - Backport support for LLVM 13.…

May 17, 2022
Medium

ELSA-2022-1915 4 CVEs

Moderate: httpd:2.4 security and bug fix update (Oracle Linux 8)

mod_http2 [1.15.7-5] - Resolves: #2035030 - CVE-2021-44224 httpd:2.4/httpd: possible NULL dereference or SSRF in forward proxy configurations [1.15.7-4] - Resolves: #1966728 - CVE-2021-33193 httpd:2.4/mod_http2: httpd: Request splitting via HTTP/2 method inje…

May 17, 2022
Medium max 8.2

ELSA-2022-1821 5 CVEs

Moderate: python27:2.7 security update (Oracle Linux 8)

babel [9.0.3-19] - Remove bundled windows executables - Resolves: rhbz#2006792 python2 [2.7.18-10.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [2.7.18-10] - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing A…

May 17, 2022
Medium

ELSA-2022-1964 2 CVEs

Moderate: fetchmail security update (Oracle Linux 8)

[6.4.24-1] - Update to fetchmail-6.4.24 (fixes CVE-2021-36386 and CVE-2021-39272) Resolves: #1999275, #2002698

May 17, 2022
Medium max 5.9

ELSA-2022-1823 4 CVEs

Moderate: mod_auth_openidc:2.3 security update (Oracle Linux 8)

cjose [0.6.1-2] - fix concatkdf big endian architecture problem. Upstream issue #77. [0.6.1-1] - upgrade to latest upstream 0.6.1 [0.5.1-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild [0.5.1-2] - Rebuilt for https://fedoraproject.org/w…

May 17, 2022
Medium

ELSA-2022-1797 1 CVE

Moderate: compat-exiv2-026 security update (Oracle Linux 8)

[0.26-7] - Fix stack exhaustion issue in the printIFDStructure function Resolves: bz#2003669

May 17, 2022
Medium

ELSA-2022-1793 1 CVE

Moderate: container-tools:3.0 security and bug fix update (Oracle Linux 8)

buildah [1.19.9-3] - update to the latest content of https://github.com/containers/buildah/tree/release-1.19 (https://github.com/containers/buildah/commit/3808e27) - Resolves: #2067540 container-selinux [2:2.178.0-2] - remove conflict on udica - we still ship…

May 17, 2022
Medium max 8.2

ELSA-2022-1764 4 CVEs

Moderate: python38:3.8 and python38-devel:3.8 security update (Oracle Linux 8)

numpy [1.17.3-6] - Adjusted the postun scriptlets to enable upgrading to RHEL 9 - Resolves: rhbz#1933055 python38 [3.8.12-1] - Update to 3.8.12 Resolves: rhbz#2004587 [3.8.11-1] - Update to 3.8.11 - Fix for CVE-2021-3733 and CVE-2021-3737 Resolves: rhbz#19952…

May 17, 2022
Medium max 8.2

ELSA-2022-1763 1 CVE

Moderate: python39:3.9 and python39-devel:3.9 security update (Oracle Linux 8)

mod_wsgi [4.7.1-4] - Convert from Fedora to the python39 module in RHEL8 - Resolves: rhbz#1877430 [4.7.1-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild [4.7.1-2] - Rebuilt for Python 3.9 [4.7.1-1] - update to 4.7.1 (#1721376) python39 …

May 17, 2022
Medium max 6.7

ELSA-2022-1759 29 CVEs

Moderate: virt:ol and virt-devel:ol security, bug fix, and enhancement update (Oracle Linux 8)

hivex [1.3.18-23] - Limit recursion in ri-records (CVE-2021-3622) resolves: rhbz#1976194 [1.3.18-22.el8] - Resolves: bz#2000225 (Rebase virt:rhel module:stream based on AV-8.6) libguestfs [1.44.0-5.0.1] - Replace upstream references from description tag - Con…

May 17, 2022
Medium max 5.9

ELSA-2022-1557 10 CVEs

Moderate: mariadb:10.5 security, bug fix, and enhancement update (Oracle Linux 8)

galera [26.4.9-4] - Use downstream garbd-wrapper and garbd.service to ensure compatibility - Add upstream versions of garbd-wrapper (called garbd-systemd) and garbd.service in case user want's to use them [26.4.9-3] - Explicitly require the 'procps-ng' packag…

May 3, 2022
Medium max 7.8

ELSA-2022-1552 1 CVE

Moderate: vim security update (Oracle Linux 8)

[8.0.1763-16.0.1] - - Remove upstream references [Orabug: 31197557] [2:8.0.1763-16.13] - CVE-2022-1154 vim: use after free in utf_ptr2char

Apr 30, 2022
Medium max 7.5

ELSA-2022-1565 2 CVEs

Moderate: container-tools:3.0 security and bug fix update (Oracle Linux 8)

buildah [1.19.9-2] - update to the latest content of https://github.com/containers/buildah/tree/release-1.19 (https://github.com/containers/buildah/commit/7c6701d) - fixes CVE-2022-27651 - Resolves: #2067539 podman [3.0.1-8] - update to the latest content of …

Apr 28, 2022
Medium max 5.9

ELSA-2022-1556 10 CVEs

Moderate: mariadb:10.3 security and bug fix update (Oracle Linux 8)

galera [25.3.34-4] - Explicitly require the 'procps-ng' package - Otherwise it will not require it in the lightweight systems (e.g. containers) - and Galera won't work properly [25.3.34-3] - Use downstream garbd-wrapper and garbd.service to ensure compatibili…

Apr 28, 2022
Medium max 7.5

ELSA-2022-1566 2 CVEs

Moderate: container-tools:2.0 security update (Oracle Linux 8)

buildah [1.11.6-10.0.1] - Handling redirect from the docker registry [Orabug: 29874238] (Nikita Gerasimov) - Reduce unnecessary writable mounts in NaiveDiffDriver [Orabug: 31025483] [1.11.6-10] - update to the latest content of https://github.com/containers/b…

Apr 28, 2022
Medium

ELSA-2022-1546 1 CVE

Moderate: polkit security update (Oracle Linux 8)

[0.115-13.0.1.el8_5.2] - Increase timeout to avoid defunct processes [Orabug: 26930744] [0.115-13.el8_5.2] - necessary version bump due to build versioning - Resolves: CVE-2021-4115

Apr 27, 2022
Medium max 7.5

ELSA-2022-9263 1 CVE

Moderate: libgcrypt security update (Oracle Linux 8)

[1.8.5-6_fips] - Add API to provide hash calculation in RSA/DSA/ECDSA signature operations [Orabug: 33081130] - Change Epoch from 1 to 10 [1.8.5-6] - Fix for CVE-2021-33560 (#1971421) - Enable HW optimizations in FIPS (#1976137) - Performance enchancements fo…

Apr 6, 2022
Medium max 9.8

ELSA-2022-9221 3 CVEs

Moderate: gnutls security update (Oracle Linux 8)

[3.6.16-4.0.1_fips] - Allow RSA keygen with modulus sizes bigger than 3072 bits and validate the seed length as defined in FIPS 186-4 section B.3.2 [Orabug: 33200526] - Allow bigger known RSA modulus sizes when calling rsa_generate_fips186_4_keypair directly …

Mar 17, 2022
Medium max 9.8

ELSA-2022-0896 3 CVEs

Moderate: glibc security update (Oracle Linux 8)

[2.28-164.0.5.3] - Merge external errata patches. - Siddhesh Poyarekar <siddhesh@redhat.com> - 2.28-164.3 - CVE-2021-3999: getcwd: align stack on clone in aarch64 and fix a memory leak (#2032280) - Siddhesh Poyarekar <siddhesh@redhat.com> - 2.28-164.2 - CVE-2…

Mar 16, 2022
Medium

ELSA-2022-0892 2 CVEs

Moderate: libarchive security update (Oracle Linux 8)

[3.3.3-3] - Do not follow symlinks when processing the fixup list (CVE-2021-31566) [3.3.3-2] - Fix handling of symbolic link ACLs (CVE-2021-23177)

Mar 16, 2022
Medium max 7.5

ELSA-2022-0899 1 CVE

Moderate: libxml2 security update (Oracle Linux 8)

[2.9.7-12] - Fix CVE-2022-23308 (#2057663) [2.9.7-11] - Fix CVE-2021-3541 (#1958783) [2.9.7-10] - Fix CVE-2021-3516 (#1956976) - Fix CVE-2021-3517 (#1957001) - Fix CVE-2021-3518 (#1957028) - Fix CVE-2021-3537 (#1957284)

Mar 16, 2022
Medium

ELSA-2022-0891 2 CVEs

Moderate: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-43.0.2.2] - Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-43.2] - Resolves: #2059256 - CVE-2021-34798 httpd:2.4/httpd: NULL pointer dereference via malformed req…

Mar 16, 2022
Medium max 8.4

ELSA-2022-0894 6 CVEs

Moderate: vim security update (Oracle Linux 8)

[8.0.1763-16.0.1] - - Remove upstream references [Orabug: 31197557] [2:8.0.1763-16.12] - CVE-2022-0361 vim: Heap-based Buffer Overflow in GitHub repository [2:8.0.1763-16.11] - CVE-2022-0413 vim: use after free in src/ex_cmds.c - Fix specfile problems - Resol…

Mar 16, 2022
Medium max 7.0

ELSA-2022-0672 3 CVEs

Moderate: ruby:2.5 security update (Oracle Linux 8)

ruby [2.5.9-109] - Properly fix command injection vulnerability in Rdoc. Related: CVE-2021-31799 [2.5.9-108] - Fix command injection vulnerability in RDoc. Resolves: CVE-2021-31799 - Fix StartTLS stripping vulnerability in Net::IMAP Resolves: CVE-2021-32066 -…

Feb 28, 2022
Medium

ELSA-2022-0621 2 CVEs

Moderate: openldap security update (Oracle Linux 7)

[2.4.44-25] - Fix CVE-2020-25709 openldap: assertion failure in Certificate List syntax validation (#2040539) - Fix CVE-2020-25710 openldap: assertion failure in CSN normalization with invalid input (#2040538)

Feb 23, 2022
Medium max 7.8

ELSA-2022-0366 5 CVEs

Moderate: vim security update (Oracle Linux 8)

[8.0.1763-16.0.1.4] - - Remove upstream references [Orabug: 31197557] [2:8.0.1763-16.4] - CVE-2021-4193 vim: vulnerable to Out-of-bounds Read - CVE-2021-4192 vim: vulnerable to Use After Free [2:8.0.1763-16.3] - 2028341 - CVE-2021-3984 vim: illegal memory acc…

Feb 3, 2022
Medium

ELSA-2022-0368 1 CVE

Moderate: rpm security update (Oracle Linux 8)

[4.14.3-19.2] - Address covscan issues in binding sigs validation patch (#2022537) [4.14.3-19.1] - Validate and require subkey binding sigs on PGP pubkeys (#2022537) - Fixes CVE-2021-3521

Feb 2, 2022
Medium

ELSA-2022-0370 1 CVE

Moderate: cryptsetup security update (Oracle Linux 8)

[2.3.3-4.1] - patch: fix CVE-2021-4122. - Resolves: #2036906

Feb 2, 2022
Medium max 9.8

ELSA-2022-0350 9 CVEs

Moderate: nodejs:14 security, bug fix, and enhancement update (Oracle Linux 8)

nodejs [1:14.18.2-2] - Add missing fixes - Resolves: RHBZ#2027642, RHBZ#2027635 [1:14.18.2-1] - Resolves: RHBZ#2027609 - Resolves: RHBZ#2027649, RHBZ#2027646, RHBZ#2027642, RHBZ#2027635 - Rebase to new version to fix CVEs

Feb 2, 2022
Medium max 5.3

ELSA-2022-0306 12 CVEs

Moderate: java-1.8.0-openjdk security update (Oracle Linux 7)

[1:1.8.0.322.b06-1] - Update to aarch64-shenandoah-jdk8u322-b06 (EA) - Update release notes for 8u322-b06. - Switch to GA mode for final release. - Require tzdata 2021e as of JDK-8275766. - Update tarball generation script to use git following shenandoah-jdk8…

Jan 27, 2022
Medium max 5.3

ELSA-2022-0307 12 CVEs

Moderate: java-1.8.0-openjdk security and bug fix update (Oracle Linux 8)

[1:1.8.0.322.b06-2] - Fix FIPS issues in native code and with initialisation of java.security.Security - Related: rhbz#2039366 [1:1.8.0.322.b06-1] - Update to aarch64-shenandoah-jdk8u322-b06 (EA) - Update release notes for 8u322-b06. - Switch to GA mode for f…

Jan 27, 2022
Medium max 5.3

ELSA-2022-0204 15 CVEs

Moderate: java-11-openjdk security update (Oracle Linux 7)

[1:11.0.14.0.9-1.0.1] - link atomic for ix86 build [1:11.0.14.0.9-1] - Update to jdk-11.0.14.0+9 - Update release notes to 11.0.14.0+9 - Switch to GA mode for final release. - This tarball is embargoed until 2022-01-18 @ 1pm PT. - Resolves: rhbz#2039366 [1:11…

Jan 24, 2022
Medium max 5.3

ELSA-2022-0185 15 CVEs

Moderate: java-11-openjdk security update (Oracle Linux 8)

[1:11.0.14.0.9-2] - Fix FIPS issues in native code and with initialisation of java.security.Security - Related: rhbz#2039366 [1:11.0.14.0.9-1] - Update to jdk-11.0.14.0+9 - Update release notes to 11.0.14.0+9 - Switch to GA mode for final release. - This tarb…

Jan 24, 2022