Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,730 results · Clear filters · Feed

Medium

ELSA-2016-1296 1 CVE

Moderate: ocaml security update (Oracle Linux 7)

[4.01.0-22.7] - Fix buffer overflow and information leak CVE-2015-8869 resolves: rhbz#1343100

Jun 23, 2016
Medium

ELSA-2016-1139 8 CVEs

Moderate: squid security update (Oracle Linux 7)

[7:3.3.8-26.3] - Related: #1330576 - CVE-2016-4553 squid: Cache poisoning issue in HTTP Request handling - Related: #1334491 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556 squid: various flaws [7:3.3.8-26.2] - Related: #1330576 - CVE-2016-4051 CVE-2016-4052 CVE-…

May 31, 2016
Medium

ELSA-2016-1141 5 CVEs

Moderate: ntp security update (Oracle Linux 7)

[4.2.6p5-10.el6_8.1] - don't allow spoofed packets to demobilize associations (CVE-2015-7979, CVE-2016-1547) - don't allow spoofed packet to enable symmetric interleaved mode (CVE-2016-1548) - check mode of new source in config command (CVE-2016-2518) - make …

May 31, 2016
Medium

ELSA-2016-1086 1 CVE

Moderate: libndp security update (Oracle Linux 7)

[1.2-6] - libndp: fix hop limit validation [CVE-2016-3698] [1.2-5] - libndp: validate the IPv6 hop limit [CVE-2016-3698] - libndb: reject redirect and router advertisements from non-link-local [CVE-2016-3698]

May 17, 2016
Medium

ELSA-2016-3554 1 CVE

Moderate: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-37.2.2] - sctp: Prevent soft lockup when sctp_accept() is called during a timeout event (Karl Heiss) [Orabug: 23222731] {CVE-2015-8767}

May 5, 2016
Medium

ELSA-2016-3551 1 CVE

Moderate: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.6.1] - skbuff: skb_segment: orphan frags before copying (Dongli Zhang) [Orabug: 23018911] - RDS/IB: VRPC DELAY / OSS RECONNECT CAUSES 5 MINUTE STALL ON PORT FAILURE (Venkat Venkatsubra) [Orabug: 22888920] - mlx4_core: Introduce restrict…

May 4, 2016
Medium

ELSA-2016-0685 2 CVEs

Moderate: nss, nspr, nss-softokn, and nss-util security, bug fix, and enhancement update (Oracle Linux 7)

nspr [4.11.0-1] - Rebase to NSPR 4.11 nss [3.21.0-9.0.1] - Added nss-vendor.patch to change vendor [3.21.0-9] - Rebuild to require the latest nss-util build and nss-softokn build. [3.21.0-8] - Update the minimum nss-softokn build required at runtime. [3.21.0-…

Apr 25, 2016
Medium

ELSA-2016-0534 24 CVEs

Moderate: mariadb security and bug fix update (Oracle Linux 7)

[1:5.5.47-1] - Rebase to 5.5.47 Also fixes: CVE-2015-4792 CVE-2015-4802 CVE-2015-4815 CVE-2015-4816 CVE-2015-4819 CVE-2015-4826 CVE-2015-4830 CVE-2015-4836 CVE-2015-4858 CVE-2015-4861 CVE-2015-4870 CVE-2015-4879 CVE-2015-4913 CVE-2015-7744 CVE-2016-0505 CVE-2…

Mar 31, 2016
Medium

ELSA-2016-0532 3 CVEs

Moderate: krb5 security update (Oracle Linux 7)

[1.13.2-12] - Fix CVE-2015-8631, CVE-2015-8630, and CVE-2015-8629 - Remove obsolete trigger to enable building of package - Resolves: #1306969

Mar 31, 2016
Medium max 9.8

ELSA-2016-0465 2 CVEs

Moderate: openssh security update (Oracle Linux 7)

[6.6.1p1-25 + 0.9.3-9] - CVE-2016-1908: possible fallback from untrusted to trusted X11 forwarding (#1298741) [6.6.1p1-24 + 0.9.3-9] - CVE-2016-3115: missing sanitisation of input for X11 forwarding (#1317818)

Mar 21, 2016
Medium

ELSA-2016-0448 1 CVE

Moderate: samba security update (Oracle Linux 7)

[3.6.23-25.0.1] - Remove use-after-free talloc_tos() inlined function problem (John Haxby) [orabug 18253258] [3.6.23-25] - resolves: #1314668 - Fix CVE-2015-7560

Mar 15, 2016
Medium

ELSA-2016-0428 1 CVE

Moderate: libssh2 security update (Oracle Linux 7)

[1.4.2-2.el6_7.1] - use secrects of the appropriate length in Diffie-Hellman (CVE-2016-0787) [1.4.2-2] - fix basic functionality of libssh2 in FIPS mode (#968575)

Mar 10, 2016
Medium

ELSA-2016-0189 1 CVE

Moderate: polkit security update (Oracle Linux 7)

[0.112-6] - Fix CVE-2015-3256 Resolves: #1271790

Feb 16, 2016
Medium max 7.8

ELSA-2016-0188 1 CVE

Moderate: sos security and bug fix update (Oracle Linux 7)

[3.2-35.0.1.3] - Recreated patch for [orabug 18913115] - Make the selinux plugin fixfiles option useful (John Haxby) [orabug 18913115] - Added remove_gpgstring.patch [Bug 18313898] - Added sos-oracle-enterprise.patch - Added sos-oraclelinux-vendor-vendorurl.p…

Feb 16, 2016
Medium

ELSA-2015-1053 19 CVEs

Moderate: php55 security and bug fix update (Oracle Linux 7)

php55 [2.0-1] - fix incorrect selinux contexts #1194336 php55-php [5.5.21-2.0.1] - add dtrace-utils as build dependency [5.5.21-2] - core: fix use-after-free vulnerability in the process_nested_data function (unserialize) CVE-2015-2787 - core: fix NUL byte in…

Feb 4, 2016
Medium

ELSA-2015-2515 1 CVE

Moderate: git19-git security update (Oracle Linux 7)

[1.9.4-3.1] - fix arbitrary code execution via crafted URLs Resolves: #1273889 [1.9.4-3] - fix CVE-2014-9390 Resolves: rhbz#1220552

Feb 4, 2016
Medium

ELSA-2015-1219 8 CVEs

Moderate: php54-php security update (Oracle Linux 7)

[5.4.40-3] - fix more functions accept paths with NUL character #1213407 [5.4.40-2] - core: fix multipart/form-data request can use excessive amount of CPU usage CVE-2015-4024 - fix various functions accept paths with NUL character CVE-2015-4025, CVE-2015-402…

Feb 4, 2016
Medium

ELSA-2015-1666 4 CVEs

Moderate: httpd24-httpd security update (Oracle Linux 7)

[2.4.12-6.0.1.el7.1] - replace index.html with Oracles index page oracle_index.html - update vstring in specfile [2.4.12-6.1] - core: fix chunk header parsing defect (CVE-2015-3183) - core: replace of ap_some_auth_required with ap_some_authn_required and ap_f…

Feb 4, 2016
Medium max 5.9

ELSA-2015-1064 6 CVEs

Moderate: python27 security, bug fix, and enhancement update (Oracle Linux 7)

python27 [1.1-17] - Require python-pip and python-wheel (note: in rh-python34 this is not necessary, because 'python' depends on these). python27-python [2.7.8-3] - Add httplib fix for CVE-2013-1752 Resolves: rhbz#1187779 [2.7.8-2] - Fix %check unset DISPLAY …

Feb 4, 2016
Medium

ELSA-2016-0073 1 CVE

Moderate: bind security update (Oracle Linux 7)

[30:9.3.6-25.P1.6] - Fix CVE-2015-8704

Jan 27, 2016
Medium max 8.1

ELSA-2016-0043 2 CVEs

Moderate: openssh security update (Oracle Linux 7)

[6.6.1p1-23 + 0.9.3-9] - Disable undocumented feauture Roaming for good (#1298218) - prevents CVE-2016-0777 and CVE-2016-0778

Jan 14, 2016
Medium

ELSA-2016-0012 1 CVE

Moderate: gnutls security update (Oracle Linux 7)

[3.3.8-14] - Prevent downgrade attack to RSA-MD5 in server key exchange. [3.3.8-13] - Corrected reseed and respect of max_number_of_bits_per_request in FIPS140-2 mode. Also enhanced the initial tests. (#1228199)

Jan 7, 2016
Medium

ELSA-2016-0005 1 CVE

Moderate: rpcbind security update (Oracle Linux 7)

[0.2.0-11.el6_7] - Fix memory corruption in PMAP_CALLIT code (bz 1283638)

Jan 7, 2016
Medium

ELSA-2016-0008 1 CVE

Moderate: openssl security update (Oracle Linux 7)

[1.0.1e-42.2] - fix CVE-2015-7575 - disallow use of MD5 in TLS1.2

Jan 7, 2016
Medium

ELSA-2016-0006 5 CVEs

Moderate: samba security update (Oracle Linux 7)

[4.2.3-11] - resolves: #1290710 - CVE-2015-3223 Remote DoS in Samba (AD) LDAP server - CVE-2015-5299 Missing access control check in shadow copy code - CVE-2015-5252 Insufficient symlink verification in smbd - CVE-2015-5296 Samba client requesting encryption …

Jan 7, 2016
Medium

ELSA-2016-0009 2 CVEs

Moderate: libldb security update (Oracle Linux 7)

[1.1.13-3.1] - Resolves: rhbz#1290712 - CVE-2015-5330 libldb: samba: Remote memory read in Samba LDAP server [rhel-7.2.z] - Remove the patch from the previous commit, it doesn't fix a remotely eploitable issue. Add patches from upstream #11636 instead.

Jan 7, 2016
Medium

ELSA-2016-0007 1 CVE

Moderate: nss security update (Oracle Linux 7)

[3.19.1-8.0.1] - Added nss-vendor.patch to change vendor [3.19.1-8] - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol - Resolves: Bug 1289881

Jan 7, 2016
Medium max 7.4

ELSA-2015-2623 1 CVE

Moderate: grub2 security and bug fix update (Oracle Linux 7)

[2.02-0.33.0.1] - Fix comparison in patch for 18504756 - Remove symlink to grub environment file during uninstall on EFI platforms [bug 19231481] - update Oracle Linux certificates (Alexey Petrenko) - Put 'with' in menuentry instead of 'using' [bug 18504756] …

Dec 15, 2015
Medium

ELSA-2015-2619 4 CVEs

Moderate: libreoffice security update (Oracle Linux 7)

[4.2.8.2-11.0.1.1] - Replaced RedHat colors with Oracle colors, and the filename redhat.soc with oracle.soc in specfile (jingdong.lu@oracle.com) - Build with --with-vendor='Oracle America, Inc.' (jingdong.lu@oracle.com) [1:4.2.8.2-11.1] - Resolves: rhbz#12858…

Dec 14, 2015
Medium

ELSA-2015-2617 3 CVEs

Moderate: openssl security update (Oracle Linux 7)

[1.0.1e-51.1] - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak - fix CVE-2015-3196 - race condition when handling PSK identity hint [1.0.1e-51] - fix the CVE-2015-1791 fix (broken serve…

Dec 14, 2015
Medium

ELSA-2015-2595 3 CVEs

Moderate: libpng12 security update (Oracle Linux 7)

[1.2.50-7] - Security fix for CVE-2015-7981 and CVE-2015-8126 - Resolves: #1283576

Dec 9, 2015
Medium

ELSA-2015-2596 2 CVEs

Moderate: libpng security update (Oracle Linux 7)

[2:1.5.13-7] - Security fix for CVE-2015-8126 - Changing png_ptr to info_ptf based on upstream - Related: #1283576 [2:1.5.13-6] - Security fix for CVE-2015-8126 - Resolves: #1283576

Dec 9, 2015
Medium

ELSA-2015-2561 1 CVE

Moderate: git security update (Oracle Linux 7)

[1.8.3.1-6] - fix arbitrary code execution via crafted URLs Resolves: #1274737

Dec 8, 2015
Medium

ELSA-2015-2550 11 CVEs

Moderate: libxml2 security update (Oracle Linux 7)

[2.9.1-6.0.1.el7_1.2] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [2.9.1-6.2] - Fix a series of CVEs (rhbz#1286496) - CVE-2015-7941 Stop parsing on entities boundaries errors - CVE-2015-7941 Cleanup con…

Dec 7, 2015
Medium max 7.8

ELSA-2015-2505 3 CVEs 1 exploited

Moderate: abrt and libreport security update (Oracle Linux 7)

abrt [2.1.11-35.0.1] - Drop libreport-rhel and libreport-plugin-rhtsupport requires [2.1.11-35] - make /var/spool/abrt owned by root - remove 'r' from /var/spool/abrt for other users - abrt-action-install-debug-info: use secure temporary directory - stop savi…

Nov 25, 2015
Medium

ELSA-2015-2199 4 CVEs

Moderate: glibc security, bug fix, and enhancement update (Oracle Linux 7)

[2.17-105.0.1] - Remove strstr and strcasestr implementations using sse4.2 instructions. - Upstream commits 584b18eb4df61ccd447db2dfe8c8a7901f8c8598 and 1818483b15d22016b0eae41d37ee91cc87b37510 backported. [2.17-105] - Fix up test case for initial-exec fix (#…

Nov 24, 2015
Medium

ELSA-2015-2184 1 CVE

Moderate: realmd security, bug fix, and enhancement update (Oracle Linux 7)

[0.16.1-5] - Revert 0.16.1-4 - Use samba by default - Resolves: rhbz#1271618 [0.16.1-4] - Fix regressions in 0.16.x releases - Resolves: rhbz#1258745 - Resolves: rhbz#1258488 [0.16.1-3] - Fix regression accepting DNS domain names - Resolves: rhbz#1243771 [0.1…

Nov 24, 2015
Medium

ELSA-2015-2233 2 CVEs

Moderate: tigervnc security, bug fix, and enhancement update (Oracle Linux 7)

[1.3.1-3] - Do not mention that display number is required in the file name Resolves: bz#1195266 [1.3.1-2] - Resolves: bz#1248422 CVE-2014-8240 CVE-2014-8241 tigervnc: various flaws [1.3.1-1] - Drop unecessary patches - Re-base to 1.3.1 (bug #1199453) - Re-bu…

Nov 24, 2015
Medium

ELSA-2015-2315 2 CVEs

Moderate: NetworkManager security, bug fix, and enhancement update (Oracle Linux 7)

ModemManager [1.1.0-8.git20130913] - rfcomm: don't open the ttys until NetworkManager connects them (rh #1251954) [1.1.0-7.git20130913] - iface-modem: fix MODEM_STATE_IS_INTERMEDIATE macro (rh #1200958) NetworkManager [1.0.6-27.0.1] - fix build error on i386 …

Nov 24, 2015
Medium max 5.9

ELSA-2015-2101 5 CVEs

Moderate: python security, bug fix, and enhancement update (Oracle Linux 7)

[2.7.5-34.0.1] - Add Oracle Linux distribution in platform.py [orabug 20812544] [2.7.5-34] - Revert fix for rhbz#1117751 as it leads to regressions Resolves: rhbz#1117751 [2.7.5-33] - Only restore SIG_PIPE when Popen called with restore_sigpipe Resolves: rhbz…

Nov 23, 2015