Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,730 results · Clear filters · Feed

Medium max 9.8

ELSA-2017-0225 8 CVEs

Moderate: libtiff security update (Oracle Linux 7)

[3.9.4-21] - Fix patch for CVE-2016-5652 - Related: #1412078 [3.9.4-20] - Fix CWE-476 defect found by covscan - Related: #1412078 [3.9.4-19] - Add patches for CVEs: - CVE-2016-9533 CVE-2016-9534 CVE-2016-9535 - CVE-2016-9536 CVE-2016-9537 CVE-2016-9540 - CVE-…

Feb 1, 2017
Medium

ELSA-2017-0182 1 CVE

Moderate: squid security update (Oracle Linux 7)

[7:3.5.20-2.2] - Resolves: #1412735 - CVE-2016-10002 squid: Information disclosure in HTTP request processing

Jan 24, 2017
Medium

ELSA-2017-0020 5 CVEs

Moderate: gstreamer1-plugins-good security update (Oracle Linux 7)

[1.4.5-3] - Remove insecure FLX plugin Resolves: rhbz#1400892

Jan 5, 2017
Medium

ELSA-2017-0018 3 CVEs

Moderate: gstreamer-plugins-bad-free security update (Oracle Linux 7)

[0.10.23-22] - h264parse: Ensure codec_data has the required size when reading number of SPS Resolves: rhbz#1400838 [0.10.23-21] - Remove insecure NSF plugin - vmncdec: Sanity-check width/height before using it Resolves: rhbz#1400838

Jan 5, 2017
Medium

ELSA-2017-0019 5 CVEs

Moderate: gstreamer-plugins-good security update (Oracle Linux 7)

[0.10.31-12] - Disable insecure FLX plugin Resolves: rhbz#1400842

Jan 5, 2017
Medium

ELSA-2017-0021 4 CVEs

Moderate: gstreamer1-plugins-bad-free security update (Oracle Linux 7)

[1.4.5-6] - Fix h264 and h265 buffer size checks - Fix mpegts pat parsing and add more size checks Resolves: rhbz#1400897 [1.4.5-5] - vmncdec: Sanity-check width/height before using it Resolves: rhbz#1400897

Jan 5, 2017
Medium

ELSA-2017-0013 5 CVEs

Moderate: ghostscript security update (Oracle Linux 7)

[9.07-20_1] - Added security fixes for: - CVE-2013-5653 (bug #1380327) - CVE-2016-7977 (bug #1380415) - CVE-2016-7978 (bug #1382300) - CVE-2016-7979 (bug #1382305) - CVE-2016-8602 (bug #1383940)

Jan 4, 2017
Medium

ELSA-2017-0001 2 CVEs

Moderate: ipa security update (Oracle Linux 7)

[4.4.0-14.0.1.el7_3.1.1] - Blank out header-logo.png product-name.png Replace login-screen-logo.png [20362818] [4.4.0-14.1.1] - Resolves: #1370493 CVE-2016-7030 ipa: DoS attack against kerberized services by abusing password policy - ipa-kdb: search for passw…

Jan 3, 2017
Medium

ELSA-2016-2972 1 CVE

Moderate: vim security update (Oracle Linux 7)

[7.4.629-5.1] - add fix for CVE-2016-1248

Dec 20, 2016
Medium max 6.4

ELSA-2016-2872 2 CVEs

Moderate: sudo security update (Oracle Linux 7)

[1.8.6p3-25] - Update noexec syscall blacklist - Fixes CVE-2016-7032 and CVE-2016-7076 Resolves: rhbz#1391937

Dec 6, 2016
Medium

ELSA-2016-2824 1 CVE

Moderate: expat security update (Oracle Linux 7)

[2.0.1-13] - updated security fix for CVE-2016-0718 [2.0.1-12] - add security fix for CVE-2016-0718

Nov 28, 2016
Medium max 5.3

ELSA-2016-2779 3 CVEs

Moderate: nss and nss-util security update (Oracle Linux 7)

nss [3.21.3-2.0.1] - Added nss-vendor.patch to change vendor [3.21.3-2] - Mozilla #1314604 / Red Hat CVE-2016-8635 [3.21.3-1.1] - rebuild [3.21.3-1] - Rebase to NSS 3.21.3 - Resolves: #1383887 nss-util [3.21.3-1.1] - rebuild [3.21.3-1] - Rebase to nss-3.21.3 …

Nov 16, 2016
Medium

ELSA-2016-2577 3 CVEs

Moderate: libvirt security, bug fix, and enhancement update (Oracle Linux 7)

[2.0.0-10] - virtlogd: Don't stop or restart along with libvirtd (rhbz#1372576) [2.0.0-9] - Add helper for removing transient definition (rhbz#1368774) - qemu: Remove stale transient def when migration fails (rhbz#1368774) - qemu: Don't use query-migrate on d…

Nov 9, 2016
Medium

ELSA-2016-2597 1 CVE

Moderate: firewalld security, bug fix, and enhancement update (Oracle Linux 7)

[0.4.3.2-8] - Exclude firewallctl (RHBZ#1374799) [0.4.3.2-7] - Tolerate ipv6_rpfilter fail (RHBZ#1285769) - Fix set_rules to copy the rule before extracting the table (RHBZ#1373260) - Translation update (RHBZ#1273296) - Conflict with NetworkManager < 1:1.4.0-…

Nov 9, 2016
Medium

ELSA-2016-2674 1 CVE

Moderate: libgcrypt security update (Oracle Linux 7)

[1.5.3-13.1] - fix CVE-2016-6313 - predictable PRNG output (#1366105) [1.5.3-13] - touch only urandom in the selftest and when /dev/random is unavailable for example by SELinux confinement - fix the RSA selftest key (p q swap)

Nov 9, 2016
Medium

ELSA-2016-2585 2 CVEs

Moderate: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 7)

[1.5.3-126.el7] - kvm-virtio-recalculate-vq-inuse-after-migration.patch [bz#1376542] - Resolves: bz#1376542 (RHSA-2016-1756 breaks migration of instances) [1.5.3-125.el7] - kvm-nbd-server-Set-O_NONBLOCK-on-client-fd.patch [bz#1285453] - Resolves: bz#1285453 (…

Nov 9, 2016
Medium

ELSA-2016-2576 1 CVE

Moderate: libguestfs and virt-p2v security, bug fix, and enhancement update (Oracle Linux 7)

libguestfs [1:1.32.7-3] - Rebase to libguestfs 1.32 in RHEL 7.3 resolves: rhbz#1218766 - The full tests are now run after the package has been built. - New tool and subpackage: virt-dib (safe diskimage-builder replacement). - New subpackage libguestfs-inspect…

Nov 9, 2016
Medium

ELSA-2016-2603 1 CVE

Moderate: libreswan security and bug fix update (Oracle Linux 7)

[3.15-8.0.1] - add libreswan-oracle.patch to detect Oracle Linux distro [3.15-8] - Resolves: rhbz#1361721 libreswan pluto segfault [UPDATED] - Resolves: rhbz#1276524 [USGv6] IKEv2.EN.R.1.1.3.2 case failed due to response to bad INFORMATIONAL request [UPDATED]…

Nov 9, 2016
Medium

ELSA-2016-2575 3 CVEs

Moderate: curl security, bug fix, and enhancement update (Oracle Linux 7)

[7.29.0-35] - fix incorrect use of a previously loaded certificate from file (related to CVE-2016-5420) [7.29.0-34] - acknowledge the --no-sessionid/CURLOPT_SSL_SESSIONID_CACHE option (required by the fix for CVE-2016-5419) [7.29.0-33] - fix re-using connecti…

Nov 9, 2016
Medium

ELSA-2016-2583 15 CVEs

Moderate: ntp security and bug fix update (Oracle Linux 7)

[4.2.6p5-25.0.1] - add disable monitor to default ntp.conf [CVE-2013-5211] [4.2.6p5-25] - don't allow spoofed packet to enable symmetric interleaved mode (CVE-2016-1548) - check mode of new source in config command (CVE-2016-2518) - make MAC check resilient a…

Nov 9, 2016
Medium

ELSA-2016-2606 2 CVEs

Moderate: postgresql security and bug fix update (Oracle Linux 7)

[9.2.18-1] - update to 9.2.18 per release notes http://www.postgresql.org/docs/9.2/static/release-9-2-18.html http://www.postgresql.org/docs/9.2/static/release-9-2-17.html http://www.postgresql.org/docs/9.2/static/release-9-2-16.html [9.2.15-2] - fix postgres…

Nov 9, 2016
Medium

ELSA-2016-2580 1 CVE

Moderate: poppler security and bug fix update (Oracle Linux 7)

[0.26.5-16] - Fix crash in Splash - Resolves: #1299492 [0.26.5-15] - Check array length - Resolves: #1299506 [0.26.5-14] - Show correct glyph or none instead of 'fi' - Resolves: #1298616 [0.26.5-13] - Check for groupColorSpace existance - Resolves: #1299479 […

Nov 9, 2016
Medium

ELSA-2016-2600 5 CVEs

Moderate: squid security, bug fix, and enhancement update (Oracle Linux 7)

[7:3.5.20-2] - Resolves: #1378025 - host_verify_strict only accepts lowercase arguments [7:3.5.20-1] - Resolves: #1273942 - Rebase squid to latest mature 3.5 version (3.5.20) [7:3.5.10-9] - Related: #1349775 - Provide migration tools needed due to rebase to s…

Nov 9, 2016
Medium

ELSA-2016-2590 1 CVE

Moderate: dhcp security, bug fix, and enhancement update (Oracle Linux 7)

[12:4.2.5-47.0.1] - Added oracle-errwarn-message.patch [12:4.2.5-47] - 1269596 - fix undefined variable in dhclient-script [12:4.2.5-46] - unclosed TCP connections to OMAPI or failover ports can cause DoS (CVE-2016-2774) [12:4.2.5-45] - 1267489 - dhclient-scr…

Nov 9, 2016
Medium

ELSA-2016-2598 4 CVEs

Moderate: php security and bug fix update (Oracle Linux 7)

[5.4.16-42] - bz2: fix improper error handling in bzread() CVE-2016-5399 [5.4.16-41] - gd: fix integer overflow in _gd2GetHeader() resulting in heap overflow CVE-2016-5766 - gd: fix integer overflow in gdImagePaletteToTrueColor() resulting in heap overflow CV…

Nov 9, 2016
Medium

ELSA-2016-2589 1 CVE

Moderate: gimp security, bug fix, and enhancement update (Oracle Linux 7)

gimp [2:2.8.16-3] - fix multiple use-after-free bugs when parsing XCF channel and layer properties (#1348617) [2:2.8.16-2] - add back obsoletes necessary for RHEL [2:2.8.16-1] - version 2.8.16 [2:2.8.14-3] - export-dialog-destroyed-crash patch: avoid subseque…

Nov 9, 2016
Medium

ELSA-2016-2594 3 CVEs

Moderate: 389-ds-base security, bug fix, and enhancement update (Oracle Linux 7)

[1.3.5.10-11] - Release 1.3.5.10-11 - Resolves: bug 1321124 - Replication changelog can incorrectly skip over updates [1.3.5.10-10] - Release 1.3.5.10-10 - Resolves: bug 1370300 - set proper update status to replication agreement in case of failure (DS 48957)…

Nov 9, 2016
Medium

ELSA-2016-2601 1 CVE

Moderate: fontconfig security and bug fix update (Oracle Linux 7)

[2.10.95-10] - Fix a regression in the previous change. (#1355930) [2.10.95-9] - CVE-2016-5384: Validate offsets in cache files properly. (#1355930) [2.10.95-8] - Update 45-latin.conf to add some hints to fall back for Windows fonts (#1073460)

Nov 9, 2016
Medium max 8.8

ELSA-2016-2599 7 CVEs

Moderate: tomcat security, bug fix, and enhancement update (Oracle Linux 7)

[0:7.0.69-10] - Related: rhbz#1368122 [0:7.0.69-9] - Resolves: rhbz#1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header - Resolves: rhbz#1368122 [0:7.0.69-7] - Resolves: rhbz#1362545 [0:7.0.69-6] - Related: rhbz#1201409…

Nov 9, 2016
Medium

ELSA-2016-2587 1 CVE

Moderate: wget security and bug fix update (Oracle Linux 7)

[1.14-13] - Fix CVE-2016-4971 (#1345778) - Added support for non-ASCII URLs (Related: CVE-2016-4971) [1.14-12] - Fix wget to include Host header on CONNECT as required by HTTP 1.1 (#1203384) - Run internal test suite during build (#1295846) - Fix -nv being do…

Nov 9, 2016
Medium max 7.8

ELSA-2016-2588 1 CVE

Moderate: openssh security, bug fix, and enhancement update (Oracle Linux 7)

[6.6.1p1-31 + 0.9.3-9] - Do not depend on selinux-policy (#1373297) [6.6.1p1-30 + 0.9.3-9] - Drop dependency on libcap-ng for ssh-keycat (#1357859) [6.6.1p1-29 + 0.9.3-9] - Rework SELinux context handling with chroot using libcap-ng (#1357859) [6.6.1p1-28 + 0…

Nov 9, 2016
Medium

ELSA-2016-2582 4 CVEs

Moderate: nettle security and bug fix update (Oracle Linux 7)

[2.7.1-8] - Use a cache-silent version of mpz_powm to prevent cache-timing attacks against RSA and DSA in shared VMs. (#1364897,CVE-2016-6489) [2.7.1-5] - Fixed SHA-3 implementation to conform to final standard (#1252936) - Fixed CVE-2015-8803 CVE-2015-8804 C…

Nov 9, 2016
Medium

ELSA-2016-2610 1 CVE

Moderate: systemd security and bug fix update (Oracle Linux 7)

[219-30.0.1.3] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [22224874] - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469] - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475] - rules: load sg module (…

Nov 9, 2016
Medium

ELSA-2016-2579 2 CVEs

Moderate: libreoffice security, bug fix, and enhancement update (Oracle Linux 7)

libcmis [0.5.1-2] - Resolves: rhbz#1330591 fix Google Drive login - Related: rhbz#1330591 fix changelog entry [0.5.1-1] - Related: rhbz#1290152 new upstream release [0.5.0-2] - Related: rhbz#1290152 autoreconf is not needed - Related: rhbz#1290152 add a bunch…

Nov 9, 2016
Medium

ELSA-2016-1797 1 CVE

Moderate: ipa security update (Oracle Linux 7)

[3.0.0-50.el6.2] - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in certificate revocation - cert-revoke: fix permission check bypass (CVE-2016-5404)

Sep 1, 2016
Medium

ELSA-2016-1626 3 CVEs

Moderate: python security update (Oracle Linux 7)

[2.6.6-66.0.1] - Add Oracle Linux distribution in platform.py [orabug 21288328] (Keshav Sharma) [2.6.6-66] - Fix for CVE-2016-1000110 HTTPoxy attack Resolves: rhbz#1359161 [2.6.6-65] - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303…

Aug 18, 2016
Medium max 8.1

ELSA-2016-1613 1 CVE

Moderate: php security and bug fix update (Oracle Linux 7)

[5.4.16-36.3] - don't set environmental variable based on user supplied Proxy request header CVE-2016-5385 [5.4.16-36.2] - fix segmentation fault in header_register_callback #1346758

Aug 11, 2016
Medium

ELSA-2016-1606 2 CVEs

Moderate: qemu-kvm security update (Oracle Linux 7)

[1.5.3-105.el7_2.7] - kvm-block-iscsi-avoid-potential-overflow-of-acb-task-cdb.patch [bz#1358996] - Resolves: bz#1358996 (CVE-2016-5126 qemu-kvm: Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl [rhel-7.2.z]) [1.5.3-105.el7_2.6] - kvm-virtio-error-out-i…

Aug 11, 2016
Medium

ELSA-2016-1538 1 CVE

Moderate: golang security, bug fix, and enhancement update (Oracle Linux 7)

[1.6.3-1] - Resolves: rhbz#1358278 - CVE-2016-5386 [1.6.2-1] - rebase to 1.6.2 - Resolves: rhbz#1346331

Aug 2, 2016
Medium

ELSA-2016-1486 1 CVE

Moderate: samba security and bug fix update (Oracle Linux 7)

[4.2.10-7] - resolves: #1351960 - Fix CVE-2016-2119 [4.2.10-6.3] - resolves: #1350759 - Fix idmap_hash when used with other modules - resolves: #1351260 - Fix krb5 encryption type setup during join

Jul 26, 2016