Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

Medium

ELSA-2021-1762 10 CVEs

Moderate: virt:ol and virt-devel:rhel security, bug fix, and enhancement update (Oracle Linux 8)

libvirt [6.0.0-35.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] - Add runtime deps for pkg librbd1 >= 1:10.2.5 (Keshav Sharma) - Disable parallel builds (Karl Heubaum) libvirt-dbus [1.3.0] - Resolves: bz#1810193 (Upgrade components in virt:rh…

May 25, 2021
Medium

ELSA-2021-1384 1 CVE

Moderate: nss security and bug fix update (Oracle Linux 7)

[3.53.1-7] - Fix HSM load failure because of CKO_Profile - Allow builds with strict-proto [3.53.1-6] - Update to CVE 2020-256423 TLS flood DOS attack patch. [3.53.1-5] - Fix CVE 2020-256423 TLS flood DOS Attack. [3.53.1-4] - Fix deadlock issue - Fix 3 FTBS is…

Apr 28, 2021
Medium

ELSA-2021-1389 1 CVE

Moderate: openldap security update (Oracle Linux 7)

[2.4.44-23] - Fix CVE-2020-25692 openldap: NULL pointer dereference for unauthenticated packet in slapd (#1895328)

Apr 28, 2021
Medium max 5.3

ELSA-2021-1297 1 CVE

Moderate: java-11-openjdk security and bug fix update (Oracle Linux 7)

[1:11.0.11.0.9-1.0.1] - link atomic for ix86 build [1:11.0.11.0.9-1] - Add backport of JDK-8187450 from 11.0.12 to fix RH1937736 - Resolves: rhbz#1937736 [1:11.0.11.0.9-0] - Update to jdk-11.0.11.0+9 - Update release notes to 11.0.11.0+9 - Switch to GA mode f…

Apr 21, 2021
Medium max 5.3

ELSA-2021-1298 1 CVE

Moderate: java-1.8.0-openjdk security update (Oracle Linux 7)

[1:1.8.0.292.b10-1] - Add CVE numbers. - Require tzdata 2021a due to JDK-8260356 - Resolves: rhbz#1938201 [1:1.8.0.292.b10-0] - Update to aarch64-shenandoah-jdk8u292-b10 (GA) - Update release notes for 8u292-b10. - This tarball is embargoed until 2021-04-20 @…

Apr 21, 2021
Medium max 5.3

ELSA-2021-1301 1 CVE

Moderate: java-1.8.0-openjdk security update (Oracle Linux 8)

[1:1.8.0.292.b10-0] - Update to aarch64-shenandoah-jdk8u292-b10 (GA) - Update release notes for 8u292-b10. - Update tarball generation script to use PR3822 which handles JDK-8233228 & JDK-8035166 changes - Remove RH1868759 patch as this is now resolved upstre…

Apr 21, 2021
Medium max 5.3

ELSA-2021-1307 1 CVE

Moderate: java-11-openjdk security update (Oracle Linux 8)

[1:11.0.11.0.9-0] - Update to jdk-11.0.11.0+9 - Update release notes to 11.0.11.0+9 - Require tzdata 2020f to match upstream change JDK-8259048 - Require tzdata 2021a to match upstream change JDK-8260356 - Remove RH1868754 patch as this is now resolved upstre…

Apr 21, 2021
Medium

ELSA-2021-1192 3 CVEs

Moderate: thunderbird security update (Oracle Linux 7)

[78.9.1-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [78.9.1-1] - Update to 78.9.1

Apr 15, 2021
Medium

ELSA-2021-1193 3 CVEs

Moderate: thunderbird security update (Oracle Linux 8)

[78.9.1-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [78.9.1-1] - Update to 78.9.1

Apr 15, 2021
Medium

ELSA-2021-1086 1 CVE

Moderate: 389-ds:1.4 security and bug fix update (Oracle Linux 8)

[1.4.3.8-7] - Bump version to 1.4.3.8-7 - Resolves: Bug 1908705 - CVE-2020-35518 389-ds:1.4/389-ds-base: information disclosure during the binding of a DN - Resolves: Bug 1936461 - A failed re-indexing leaves the database in broken state. - Resolves: Bug 1912…

Apr 9, 2021
Medium max 6.9

ELSA-2021-0860 1 CVE 1 exploited

Moderate: ipa security and bug fix update (Oracle Linux 7)

[4.6.8-5.0.1] - Blank out header-logo.png product-name.png - Replace login-screen-logo.png [Orabug: 20362818] [4.6.8-5.el7_9.4] - Resolves: #1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing - wgi/plugins.py: ignore e…

Mar 19, 2021
Medium

ELSA-2021-0699 7 CVEs

Moderate: grub2 security update (Oracle Linux 7)

[2.02-0.87.0.8.e7.2] - Enable common subpackage for aarch64 - Disable RHEL patch 0183-efinet-retransmit-if-our-device-is-busy.patch to comply with UEFI spec - add SBAT metadata for Oracle Linux grub2 - Use similar format for menu entry in grub environment blo…

Mar 5, 2021
Medium

ELSA-2021-0696 7 CVEs

Moderate: grub2 security update (Oracle Linux 8)

[2.02-90.0.2.el8_3.1] - Fix various coverity issues [Orabug: 32530657] - Add SBAT metadata to grubx64.efi [Orabug: 32530657] - Set proper blsdir if /boot is on btrfs rootfs [Orabug: 32063327] - Add CVE-2020-15706, CVE-2020-15707 to the list [Orabug: 31225072]…

Mar 5, 2021
Medium max 7.5

ELSA-2021-0551 7 CVEs

Moderate: nodejs:14 security and bug fix update (Oracle Linux 8)

nodejs [1:14.15.4-2] - Add patch for yarn crash - Resolves: RHBZ#1916465 [1:14.15.4-1] - Security rebase to 14.15.4 - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ - Resolves: RHBZ#1916463, RHBZ#1914788 - Resolves: RHBZ#1914785, RHB…

Feb 20, 2021
Medium max 9.8

ELSA-2021-0549 6 CVEs

Moderate: nodejs:12 security update (Oracle Linux 8)

nodejs [1:12.20.1-1] - Security rebase for January security release - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ - Resolves: RHBZ#1916460, RHBZ#1914786 - Resolves: RHBZ#1914784, RHBZ#1916396 nodejs-nodemon [2.0.3-1] - Resolves: R…

Feb 20, 2021
Medium max 5.3

ELSA-2021-0531 1 CVE

Moderate: container-tools:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

buildah [1.16.7-4.0.1] - Handling redirect from the docker registry [Orabug: 29874238] (Nikita Gerasimov) [1.16.7-4] - update to the latest content of https://github.com/containers/buildah/tree/release-1.16 (https://github.com/containers/buildah/commit/aaed66…

Feb 20, 2021
Medium max 7.5

ELSA-2021-0548 10 CVEs

Moderate: nodejs:10 security update (Oracle Linux 8)

nodejs [1:10.23.1-1] - January Security release - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ - Rebase to 10.23.1 - Resolves: RHBZ#1916461, RHBZ#1914789 - Resolves: RHBZ#1914783, RHBZ#1916462, RHBZ#1916395, RHBZ#1916459 - Resolves…

Feb 20, 2021
Medium

ELSA-2021-0557 1 CVE

Moderate: perl:5.26 security update (Oracle Linux 8)

[4:5.26.3-417] - Fix CVE-2020-12723 (bug #1909860) - Fix Time-Local tests to pass after year 2019 (bug #1807120)

Feb 18, 2021
Medium

ELSA-2021-0538 3 CVEs

Moderate: nss security and bug fix update (Oracle Linux 8)

[3.53.1-17] - Fix various corner cases with ike v1 app b support. [3.53.1-16] - Fix the following CVE - CVE-2020-12403 chacha-poly issues - CVE-2020-12400 constant time ECC. - CVE-2020-6829 constant time ECC. [3.53.1-15] - Revert some policy changes the gener…

Feb 17, 2021
Medium max 5.9

ELSA-2021-0348 3 CVEs

Moderate: glibc security and bug fix update (Oracle Linux 7)

[2.17-322.0.2] - merge RH el7 u9 errata patches with Oracle patches Review-exception: Simple merge - merge RH el7 u9 patches with Oracle patches Review-exception: Simple merge - Four patches to match 3rd patch bundle from Marvell - modify MIPS values in elf/e…

Feb 5, 2021
Medium

ELSA-2021-0347 2 CVEs

Moderate: qemu-kvm security and bug fix update (Oracle Linux 7)

[1.5.3-175.el7_9.3] - kvm-Suppress-prototype-warning-for-nss-headers.patch [bz#1884997] - Resolves: bz#1884997 (qemu-kvm FTBFS on rhel7.9) [1.5.3-175.el7_9.2] - kvm-hw-net-vmxnet_tx_pkt-fix-assertion-failure-in-vmxnet.patch [bz#1860960] - kvm-hw-core-loader-F…

Feb 3, 2021
Medium

ELSA-2021-0343 3 CVEs

Moderate: perl security update (Oracle Linux 7)

[4:5.16.3-299] - Fix CVE-2020-10543 (bug #1839272) - Fix CVE-2020-10878 (bug #1839275) [4:5.16.3-298] - Fix CVE-2020-12723 (bug #1839278)

Feb 3, 2021
Medium

ELSA-2021-0336 2 CVEs

Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 7)

[3.10.0-1160.15.2.OL7] - Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and shim-x…

Feb 3, 2021
Medium

ELSA-2021-0153 3 CVEs

Moderate: dnsmasq security update (Oracle Linux 7)

[2.76-16.1] - Accept responses only on correct sockets (CVE-2020-25684) - Use strong verification on queries (CVE-2020-25685) - Handle multiple identical DNS queries better (CVE-2020-25686) - Link against nettle for sha256 hash implementation

Jan 19, 2021
Medium

ELSA-2020-5493 4 CVEs

Moderate: go-toolset:ol8 security update (Oracle Linux 8)

delve [1.4.1-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.4.1-1] - Rebase to 1.4.1 - Resolves: rhbz#1821281 - Related: rhbz#1820596 [1.4.0-2] - Change i686 to a better macro - Related: rhbz#1820596 [1.4.0-1] - Rebase to 1.4.0 - Remo…

Dec 22, 2020
Medium

ELSA-2020-5487 1 CVE

Moderate: pacemaker security update (Oracle Linux 8)

[2.0.4-6.1] - Prevent users from bypassing ACLs by using IPC directly (CVE-2020-25654) - Resolves: rhbz1891528

Dec 22, 2020
Medium

ELSA-2020-5483 1 CVE

Moderate: gnutls security and bug fix update (Oracle Linux 8)

[3.6.14-7] - Increase DH key bits to >= 2048 in self-tests (#1879506) - Implement self-tests for KDF and CMAC (#1890870) - Fix CVE-2020-24659: heap buffer-overflow when 'no_renegotiation' alert is received (#1873959)

Dec 21, 2020
Medium

ELSA-2020-5495 1 CVE

Moderate: nginx:1.16 security update (Oracle Linux 8)

[1:1.16.1-1.0.1.1] - Remove Red Hat references [Orabug: 29498217] [1:1.16.1-1.1] - Resolves: #1898952 - CVE 2019-20372 nginx:1.16/nginx: HTTP request smuggling via error pages in http/ngx_http_special_response.c

Dec 18, 2020
Medium max 7.3

ELSA-2020-5499 3 CVEs

Moderate: nodejs:12 security and bug fix update (Oracle Linux 8)

nodejs [1:12.19.1-1] - Resolves: RHBZ#1901044, #1901045, #1901046, #1901047 - c-ares, ajv and y18n CVEs and yarn installability issues

Dec 17, 2020
Medium

ELSA-2020-5473 1 CVE

Moderate: kernel security and bug fix update (Oracle Linux 8)

[4.18.0-240.8.1_3.OL8] - Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Ora…

Dec 17, 2020
Medium max 7.8

ELSA-2020-5435 1 CVE

Moderate: python-rtslib security update (Oracle Linux 7)

[2.1.74-1.0.1] - Add patch 0005-allow-mixed-case-in-oracle-iqns to fix [Orabug: 27613482] - Add patch 0004-allow-underscore-in-oracle-iqns to fix [Orabug: 27582660] - Add patch 0014-reenable-vhost to fix [Orabug: 27707403] <alan.adamson@oracle.com> [2.1.74-1]…

Dec 16, 2020
Medium max 5.5

ELSA-2020-5439 3 CVEs 1 exploited

Moderate: samba security and bug fix update (Oracle Linux 7)

[4.10.17-9] - related: #1853272 - Add back missing patch hunks [4.10.16-8] - resolves: #1878205 - Fix restarting winbind on package upgrade - resolves: #1892632 - Fix CVE-2020-14318 - resolves: #1891687 - Fix CVE-2020-14323 - resolves: #1879834 - Fix CVE-2020…

Dec 16, 2020
Medium

ELSA-2020-5434 1 CVE

Moderate: targetcli security update (Oracle Linux 7)

[2.1.53-1.0.1] - added Requires: python-gobject-base [Orabug: 30252308] [2.1.53-1] - Rebase the targetcli package to fix some security issues

Dec 16, 2020
Medium

ELSA-2020-5443 1 CVE

Moderate: gd security update (Oracle Linux 7)

[2.0.35-27] - Fix CVE-2016-5766 - Resolves: #1356813 - Upstream patch: https://github.com/libgd/libgd/commit/aba3db8

Dec 16, 2020
Medium

ELSA-2020-4481 1 CVE

Moderate: bluez security update (Oracle Linux 8)

[5.50-4] + bluez-5.50-4 - Fixing CVE-2020-0556

Nov 18, 2020
Medium

ELSA-2020-5083 3 CVEs

Moderate: microcode_ctl security, bug fix, and enhancement update (Oracle Linux 7)

[2:2.1-73.2.0.1] - for Intel, do not trigger load if on-disk microcode is not an update [Orabug: 30634727] - set early_microcode='no' in virtualized guests to avoid early load bugs [Orabug: 30618736] - ensure late loading fixes are present on 4.1.12-* and 4.1…

Nov 17, 2020
Medium max 7.5

ELSA-2020-5011 3 CVEs

Moderate: bind security and bug fix update (Oracle Linux 7)

[32:9.11.4-26.P2.2] - Fix unsupported algorithms validation (#rh1769876) [32:9.11.4-26.P2.1] - Fix tsig-request verify (CVE-2020-8622) - Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623) - Correct update-policy type subdomain to match documentatio…

Nov 17, 2020
Medium

ELSA-2020-5085 3 CVEs

Moderate: microcode_ctl security, bug fix and enhancement update (Oracle Linux 8)

[4:20200609-2.20201027.1.0.1] - add support for UEK6 kernels - remove no longer appropriate caveats for 06-2d-07 and 06-55-04 [4:20200609-2.20201027.1] - Update Intel CPU microcode to microcode-20201027 release, addresses CVE-2020-8694, CVE-2020-8695, CVE-202…

Nov 17, 2020
Medium max 5.5

ELSA-2020-5010 2 CVEs

Moderate: python3 security update (Oracle Linux 7)

[3.6.8-18.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8-18] - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907) Resolves: rhbz#1856481 - Resolve hash collisions for Pv4Interface and IPv6Interface (CV…

Nov 13, 2020
Medium max 5.5

ELSA-2020-5009 1 CVE

Moderate: python security update (Oracle Linux 7)

[2.7.5-90.0.1] - Add Oracle Linux distribution in platform.py [orabug 20812544] [2.7.5-90] - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907) Resolves: rhbz#1856481

Nov 13, 2020