Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

  • Medium max 7.5
    ELSA-2026-50345 1 CVE

    Moderate: openssl security fix update (Oracle Linux 9)

    [3.5.5-3.0.1] - Replace upstream references in fips man pages [Orabug: 35824276] - Update additional upstream references - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824276] …

  • Medium max 6.5
    ELSA-2026-26180 19 CVEs

    Moderate: mysql:8.4 security update (Oracle Linux 8)

    mecab [0.996-2.12] - Bump version for 'mysql' module rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'AppStream' repo - Resolves: #2180411 [0.996-2] - Rebuild to fix the issue described in #2000986 - Resolves: #2000986 [0.996-1.9]…

  • Medium max 6.5
    ELSA-2026-25919 22 CVEs

    Moderate: mysql:8.0 security update (Oracle Linux 8)

    mecab [0.996-2.12] - Bump version for 'mysql' module rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'AppStream' repo - Resolves: #2180411 [0.996-2] - Rebuild to fix the issue described in #2000986 - Resolves: #2000986 [0.996-1.9]…

  • Medium max 5.9
    ELSA-2026-19356 1 CVE

    Moderate: libsoup security update (Oracle Linux 9)

    [2.72.0-16.1] - Backport patch for CVE-2026-5119 [2.72.0-16] - Backport patch for CVE-2026-1761 [2.72.0-15] - Backport patch for CVE-2026-0719 - Fix NTLM authentication test failures in FIPS mode [2.72.0-14] - Backport patch for CVE-2025-14523 [2.72.0-13] - B…

  • Medium max 6.5
    ELSA-2026-19358 8 CVEs

    Moderate: freerdp security update (Oracle Linux 9)

    [2:2.11.7-7.3] - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159860 [2:2.11.7-7.2] - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix growth of preallocated buffers (CVE-2026-27951) - Fix heap-buffe…

  • Medium max 7.5
    ELSA-2026-22313 1 CVE

    Moderate: compat-openssl11 security update (Oracle Linux 9)

    [1:1.1.1k-5.3] - Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing Resolves: RHEL-165863

  • Medium max 4.0
    ELSA-2026-22553 2 CVEs

    Moderate: libexif security update (Oracle Linux 9)

    [0.6.22-6.1] - Fix integer underflow in MakerNote decoding (CVE-2026-40386) - Fix integer overflow in Nikon MakerNote handling (CVE-2026-40385) Resolves: RHEL-170253, RHEL-170234

  • Medium max 6.6
    ELSA-2026-28209 1 CVE

    Moderate: vim security update (Oracle Linux 9)

    [8.2.2637-26.0.1.el9_8.6] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-26.6] - CVE-2026-41411 vim: Command injection via backticks in tag files [2:8.2.2637-26.5] - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via…

  • Medium max 5.9
    ELSA-2026-18693 1 CVE

    Moderate: python3.9 security update (Oracle Linux 9)

    [3.9.25-7.0.1] - Remove upstream URL reference [3.9.25-7] - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161 [3.9.25-6] - Security fix for CVE-2026-4519 Resolves: RHEL-158117 [3.9.25-5] - Rebuilding previous fixes for diff…

  • Medium max 5.5
    ELSA-2026-28243 1 CVE

    Moderate: libxslt security update (Oracle Linux 9)

    [1.1.34-14.0.1.el9_8.1] - Fix memory leak in exclPrefixPush [Orabug: 37871881] - Added libxslt-oracle-enterprise.patch and replaced doc/redhat.gif in tarball [1.1.34-14.1] - Fix CVE-2025-10911 (RHEL-171991) [1.1.34-14.1] - Fix upgrade path for CVE-2023-40403 …

  • Medium max 7.5
    ELSA-2026-28244 1 CVE

    Moderate: libpng15 security update (Oracle Linux 9)

    [1.5.30-15.1] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161449) [1.5.30-15] - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148412)

  • Medium max 6.8
    ELSA-2026-28256 1 CVE

    Moderate: opencryptoki security update (Oracle Linux 9)

    [3.26.0-2.2] - Resolves: RHEL-171562, Fix CVE-2026-40253, possible out-of-bounds access in BER decode functions [3.26.0-2.1] - Resolves: RHEL-169586, Fix syslog message printing about different CPs

  • Medium max 6.5
    ELSA-2026-19361 2 CVEs

    Moderate: glib2 security update (Oracle Linux 9)

    [2.68.4-19.1] - Add patch for CVE-2025-14087 and CVE-2025-14512

  • Medium max 4.1
    ELSA-2026-22717 1 CVE

    Moderate: vim security update (Oracle Linux 9)

    [8.2.2637-26.0.1.el9_8.5] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-26.5] - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass [2:8.2.2637-26.4] - Resolves: RHEL-164966 vim: arbitrary comma…

  • Medium max 7.6
    ELSA-2026-28255 2 CVEs

    Moderate: libpng security update (Oracle Linux 9)

    [2:1.6.37-15.2] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161448) [2:1.6.37-15.1] - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon (RHEL-161299)

  • Medium max 7.5
    ELSA-2026-20597 3 CVEs

    Moderate: glibc security update (Oracle Linux 9)

    [2.34-270.0.1] - Forward-port Oracle patches for ol9-u8 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Oracle history: May-20-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-266.0.1 - Forward-port Oracle patches for ol9-u8 Reviewed-by: …

  • Medium max 7.5
    ELSA-2026-26347 1 CVE

    Moderate: libpng15 security update (Oracle Linux 8)

    [1.5.30-9] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161346)

  • Medium max 7.5
    ELSA-2026-26348 1 CVE

    Moderate: libpng12 security update (Oracle Linux 8)

    [1.2.57-7] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161345)

  • Medium max 6.8
    ELSA-2026-26352 1 CVE

    Moderate: opencryptoki security update (Oracle Linux 8)

    [3.22.0-3.3] - Resolves: RHEL-171558, Fix possible out-of-bounds access in BER decode functions

  • Medium max 5.5
    ELSA-2026-26355 1 CVE

    Moderate: libxslt security update (Oracle Linux 8)

    [1.1.32-6.4.0.1] - Added libxslt-oracle-enterprise.patch and replaced doc/redhat.gif in tarball [1.1.32-6.4] - Fix CVE-2025-10911 (RHEL-171739)

  • Medium max 8.6
    ELSA-2026-19182 1 CVE

    Moderate: mariadb:11.8 security update (Oracle Linux 9)

    galera [26.4.25-1.0.1] - Drop nmap-ncat requirement. [Orabug: 34116228] - Requirement to delete lp1184034 test case without using patches. [26.4.25-1] - Rebased to 26.4.25 [26.4.24-1] - Rebase to 26.4.24 [26.4.23-1] - Rebase to 26.4.23 mariadb [3:11.8.6-2] - …

  • Medium max 5.3
    ELSA-2026-18599 1 CVE

    Moderate: p11-kit security update (Oracle Linux 9)

    [0.26.2-1] - Rebase to 0.26.2 Resolves: RHEL-147825 [0.26.1-1] - Rebase to 0.26.1 Resolves: RHEL-139075, RHEL-118361, RHEL-126132 [0.25.10-1] - Update to new upstream release 0.25.10 Resolves: RHEL-115453

  • Medium max 6.5
    ELSA-2026-18683 10 CVEs

    Moderate: libssh security update (Oracle Linux 9)

    [0.10.4-18] - Resolves: RHEL-150661 - Resolves: CVE-2025-4877 - Resolves: CVE-2025-4878 - Resolves: CVE-2025-5351 - Resolves: CVE-2025-8114 - Resolves: CVE-2025-8277 - Resolves: CVE-2026-0964 - Resolves: CVE-2026-0965 - Resolves: CVE-2026-0966 - Resolves: CVE…

  • Medium max 7.7
    ELSA-2026-18705 1 CVE

    Moderate: mingw-glib2 security update (Oracle Linux 9)

    [2.78.6-3] - Resolves: RHEL-131012 - CVE-2025-13601 mingw-glib2: Integer overflow in in g_escape_uri_string()

  • Medium max 7.5
    ELSA-2026-18772 1 CVE

    Moderate: qemu-kvm security update (Oracle Linux 9)

    [10.1.0-17] - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174] - kvm-block…

  • Medium max 4.4
    ELSA-2026-18824 1 CVE

    Moderate: luksmeta security update (Oracle Linux 9)

    [10-1] - New upstream release v10 Resolves: RHEL-122139

  • Medium max 7.5
    ELSA-2026-18931 2 CVEs

    Moderate: unbound security update (Oracle Linux 9)

    [1.24.2-2] - Switch TLS configuration to follow TLS sockets by crypto-policy again (RHEL-147860) - Change the default of tls-use-system-policy-versions at build-time [1.16.2-24] - Add new root key 38696 (RHEL-77716) [1.16.2-23] - Do not verify root.key in lib…

  • Medium max 0.0
    ELSA-2026-19178 1 CVE

    Moderate: crun security update (Oracle Linux 9)

    [1.27-1] - update to https://github.com/containers/crun/releases/tag/1.27 - fixes CVE-2026-30892 crun: crun: Privilege escalation due to incorrect parsing of the --user option [rhel-9.8] - Resolves: RHEL-161441

  • Medium max 7.4
    ELSA-2026-19187 1 CVE

    Moderate: compat-openssl11 security update (Oracle Linux 9)

    [1:1.1.1k-5.2] - Fixes CVE-2025-69419 OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing Resolves: RHEL-142723

  • Medium max 8.7
    ELSA-2026-19189 2 CVEs

    Moderate: python-tornado security update (Oracle Linux 9)

    [6.5.5-1] - Update to 6.5.5 Resolves: RHEL-160942

  • Medium max 8.2
    ELSA-2026-19200 2 CVEs

    Moderate: corosync security update (Oracle Linux 9)

    [3.1.10-1.1] - Resolves: RHEL-163816 - Resolves: RHEL-163837 - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091) - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092) [3.1.10-1] - Resolves: RHEL-122942 - New upstream re…

  • Medium max 7.5
    ELSA-2026-19208 1 CVE

    Moderate: freeipmi security update (Oracle Linux 9)

    [1.6.17-1] - Update to 1.6.17, fixes CVE-2026-33554

  • Medium max 5.5
    ELSA-2026-19213 1 CVE

    Moderate: systemd security update (Oracle Linux 9)

    [252-67.0.1.el9_8.2] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve loggin…

  • Medium max 7.5
    ELSA-2026-19218 1 CVE

    Moderate: openssl security update (Oracle Linux 9)

    [3.5.5-2.0.1] - Replace upstream references [Orabug: 34340177] [1:3.5.5-2] - Fix CVE-2026-31790 Resolves: RHEL-161586 [1:3.5.5-1] - Rebase to OpenSSL 3.5.5 Resolves: RHEL-136895 Resolves: RHEL-142004 Resolves: RHEL-142012 Resolves: RHEL-142020 Resolves: RHEL-…

  • Medium max 5.3
    ELSA-2026-17618 1 CVE

    Moderate: ImageMagick security update (Oracle Linux 7)

    [6.9.10.68-7.0.11] - Fix CVE-2026-32636 [Orabug: 39375225] [6.9.10.68-7.0.9] - Fix CVE-2026-28691 and CVE-2026-28693 [Orabug: 39174244] [6.9.10.68-7.0.7] - Fixes Local File Disclosure via Path Traversal (CVE-2026-25965) [Orabug: 39118995] - Fixes Memory alloc…

  • Medium max 4.1
    ELSA-2026-22730 1 CVE

    Moderate: vim security update (Oracle Linux 8)

    [8.0.1763-23.0.1] - Remove upstream references [Orabug: 31197557] - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984] [2:8.0.1763-23] - RHEL-170126 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path tra…

  • Medium max 7.5
    ELSA-2026-22315 1 CVE

    Moderate: compat-openssl10 security update (Oracle Linux 8)

    [1.1.0.2o-4.2] - Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing Resolves: RHEL-165754

  • Medium max 4.0
    ELSA-2026-20929 2 CVEs

    Moderate: libexif security update (Oracle Linux 8)

    [0.6.22-6] - Fix integer underflow in MakerNote decoding (CVE-2026-40386) - Fix integer overflow in Nikon MakerNote handling (CVE-2026-40385) Resolves: RHEL-170243, RHEL-170220

  • Medium max 7.5
    ELSA-2026-20579 1 CVE

    Moderate: freeipmi security update (Oracle Linux 8)

    [1.6.17-1] - Update to 1.6.17, fixes CVE-2026-33554

  • Medium max 7.5
    ELSA-2026-20587 1 CVE

    Moderate: glibc security update (Oracle Linux 8)

    [2.28-251.0.4.37] - Forward port of Oracle patches Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: May-7-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.4.34 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi <…