Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

Medium max 7.5

ELSA-2026-18028 1 CVE

Moderate: libpng security update (Oracle Linux 9)

[2:1.6.37-12.4] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161436)

May 18, 2026
Medium max 7.5

ELSA-2026-18064 1 CVE

Moderate: libpng security update (Oracle Linux 10)

[2:1.6.40-8.4] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161324)

May 18, 2026
Medium max 6.5

ELSA-2026-16482 8 CVEs

Moderate: freerdp security update (Oracle Linux 9)

[2:2.11.7-1.7] - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix growth of preallocated buffers (CVE-2026-27951) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array b…

May 12, 2026
Medium max 6.5

ELSA-2026-15953 2 CVEs

Moderate: glib2 security update (Oracle Linux 8)

[2.68.4-169] - Add patch for CVE-2025-14087 and CVE-2025-14512

May 11, 2026
Medium max 6.5

ELSA-2026-16019 8 CVEs

Moderate: freerdp security update (Oracle Linux 8)

[2:2.11.7-9] - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159850 [2:2.11.7-8] - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix growth of preallocated buffers (CVE-2026-27951) - Fix heap-buffer-ov…

May 11, 2026
Medium max 6.5

ELSA-2026-15971 2 CVEs

Moderate: glib2 security update (Oracle Linux 9)

[2.68.4-18.2] - Add patch for CVE-2025-14087 and CVE-2025-14512

May 11, 2026
Medium max 8.2

ELSA-2026-13673 2 CVEs

Moderate: corosync security update (Oracle Linux 9)

[3.1.9-2.1] - Resolves: RHEL-163815 - Resolves: RHEL-163836 - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091) - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)

May 11, 2026
Medium max 5.9

ELSA-2026-15968 2 CVEs

Moderate: libsoup3 security update (Oracle Linux 10)

[3.6.5-11] - Add patches for CVE-2026-4271 and CVE-2026-5119 [3.6.5-10] - Add patch for CVE-2026-1761 [3.6.5-9] - Fix CVE-2026-0719 [3.6.5-8] - Fix CVE-2025-14523 [3.6.5-7] - Add patch for CVE-2025-12105 [3.6.5-6] - Fix integer overflow in date/time parsing […

May 11, 2026
Medium max 7.1

ELSA-2026-16014 10 CVEs

Moderate: freerdp security update (Oracle Linux 10)

[2:3.10.3-5.8] - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) -…

May 11, 2026
Medium max 6.5

ELSA-2026-15969 2 CVEs

Moderate: glib2 security update (Oracle Linux 10)

[2.80.4-13] - Fix CVE-2025-14087 and CVE-2025-14512 [2.80.4-12] - Fix NVR [2.80.4-11] - Add patch for CVE-2025-13601

May 11, 2026
Medium max 8.2

ELSA-2026-13657 2 CVEs

Moderate: corosync security update (Oracle Linux 8)

[3.1.8-1.1] - Resolves: RHEL-163805 - Resolves: RHEL-163826 - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091) - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)

May 8, 2026
Medium max 7.6

ELSA-2026-14791 1 CVE

Moderate: libpng security update (Oracle Linux 9)

[2:1.6.37-12.3] - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon (RHEL-161291)

May 7, 2026
Medium max 7.5

ELSA-2026-14819 1 CVE

Moderate: freeipmi security update (Oracle Linux 9)

[1.6.17-1] - Update to 1.6.17, fixes CVE-2026-33554

May 7, 2026
Medium max 7.6

ELSA-2026-14790 1 CVE

Moderate: libpng security update (Oracle Linux 10)

[2:1.6.40-8.3] - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon (RHEL-161208)

May 7, 2026
Medium max 5.9

ELSA-2026-14087 1 CVE

Moderate: libsoup security update (Oracle Linux 8)

[2.62.3-14] - Backport patch for CVE-2026-5119 - Run testsuite during RPM check phase

May 6, 2026
Medium max 5.9

ELSA-2026-13978 1 CVE

Moderate: libsoup security update (Oracle Linux 9)

[2.72.0-12.6] - Backport patch for CVE-2026-5119

May 6, 2026
Medium max 8.7

ELSA-2026-13670 2 CVEs

Moderate: python-tornado security update (Oracle Linux 9)

[6.5.5-1.1] - Update to 6.5.5 Resolves: RHEL-160941

May 5, 2026
Medium max 5.5

ELSA-2026-13677 1 CVE

Moderate: systemd security update (Oracle Linux 9)

[252-55.0.3.el9_7.9] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve loggin…

May 5, 2026
Medium max 7.5

ELSA-2026-13515 1 CVE

Moderate: freeipmi security update (Oracle Linux 10)

[1.6.17-1] - Update to 1.6.17 [1.6.14-6] - .fmf/version: Add fmf metadtata root [1.6.14-5] - gating: RHEL-10: Add OSCI testing

May 5, 2026
Medium max 8.7

ELSA-2026-13641 2 CVEs

Moderate: python-tornado security update (Oracle Linux 10)

[6.5.5-1.1] - Update to 6.5.5 Resolves: RHEL-160934

May 5, 2026
Medium max 5.5

ELSA-2026-13651 1 CVE

Moderate: systemd security update (Oracle Linux 10)

[257-13.0.1.el10_1.3] - Fix detection of Oracle Virtualization or BM envs [Orabug: 37531877] - Avoid udevadm warnings when using udev valid configs [Orabug: 37503197] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - set 'RemoveIPC=no' in l…

May 5, 2026
Medium max 8.2

ELSA-2026-13644 2 CVEs

Moderate: corosync security update (Oracle Linux 10)

[3.1.9-2.1] - Resolves: RHEL-163801 - Resolves: RHEL-163822 - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091) - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)

May 5, 2026
Medium max 4.4

ELSA-2026-50251 2 CVEs

Moderate: dtrace security update (Oracle Linux 8)

[2.0.7-4] - Prevent out-of-buonds memory access during object symbol table construction (CVE-2026-35233). [Orabug: 39121881] - Prevent divide-by-zero (FPE trap) if section header data is corrupted. (CVE-2026-21996). [Orabug: 39121874] - Ensure safety checks a…

Apr 30, 2026
Medium max 4.4

ELSA-2026-50250 2 CVEs

Moderate: dtrace security update (Oracle Linux 8)

[2.0.7-4] - Prevent out-of-buonds memory access during object symbol table construction (CVE-2026-35233). [Orabug: 39121881] - Prevent divide-by-zero (FPE trap) if section header data is corrupted. (CVE-2026-21996). [Orabug: 39121874] - Ensure safety checks a…

Apr 30, 2026
Medium max 4.4

ELSA-2026-50249 2 CVEs

Moderate: dtrace security update (Oracle Linux 9)

[2.0.7-4] - Prevent out-of-buonds memory access during object symbol table construction (CVE-2026-35233). [Orabug: 39121881] - Prevent divide-by-zero (FPE trap) if section header data is corrupted. (CVE-2026-21996). [Orabug: 39121874] - Ensure safety checks a…

Apr 30, 2026
Medium max 6.2

ELSA-2026-11349 1 CVE

Moderate: libxml2 security update (Oracle Linux 8)

[2.9.7-21.4] - Fix CVE-2025-9714 (RHEL-119279) [2.9.7.21.3] - Fix CVE-2025-32415 (RHEL-100177) [2.9.7.21.2] - Fix CVE-2025-7425 (RHEL-102797) [2.9.7-21.1] - Fix CVE-2025-6021 (RHEL-96498) - Fix CVE-2025-49794 (RHEL-96398) - Fix CVE-2025-49796 (RHEL-96424)

Apr 28, 2026
Medium

ELSA-2026-65202 0 CVEs

Moderate: oci-utils security update (Oracle Linux 8)

[-- 0.14.0-21] - Update the debugging log file path. [Orabug: 39250938]

Apr 28, 2026
Medium max 6.5

ELSA-2026-50239 6 CVEs

Moderate: virt:kvm_utils3 bug fix update (Oracle Linux 8)

hivex [1.3.18-23] - Limit recursion in ri-records (CVE-2021-3622) resolves: rhbz#1976194 [1.3.18-22.el8] - Resolves: bz#2000225 (Rebase virt:rhel module:stream based on AV-8.6) [1.3.18-21] - Bounds check for block exceeding page length (CVE-2021-3504) resolve…

Apr 24, 2026
Medium max 7.5

ELSA-2026-50241 10 CVEs

Moderate: qemu-kvm security update (Oracle Linux 9)

[7.2.0-37.el9] - hashing: use mmap/munmap for isal functions (Elena Ufimtseva) [Orabug: 39165991] - multifd: replace allocations/free with mmap/munmap (Elena Ufimtseva) [Orabug: 39165991] - page_cache: use mmap() based data pool for cache items (Elena Ufimtse…

Apr 24, 2026
Medium max 5.5

ELSA-2026-9666 2 CVEs

Moderate: wireshark security update (Oracle Linux 10)

[4.4.2-4.0.1.el10_1.4] - Fix post script to not fail during initial installation [Orabug: 37565359] [1:4.4.2-4.4] - Resolves: RHEL-152921 - CVE-2026-3203 Buffer Over-read [1:4.4.2-4.3] - Resolves: RHEL-152912 - CVE-2026-3201 Improperly Controlled Sequential M…

Apr 22, 2026
Medium max 5.9

ELSA-2026-5393 2 CVEs

Moderate: python security update (Oracle Linux 7)

[2.7.5-94.0.5] - Fix for CVE-2025-15366 and CVE-2025-15367 [Orabug: 39114639] [2.7.5-94.0.3] - Fix for CVE-2025-12084 [Orabug: 38902314]

Apr 16, 2026
Medium max 7.2

ELSA-2026-6220 1 CVE

Moderate: 389-ds-base security update (Oracle Linux 7)

[1.3.11.1-5.0.7] - Security fix for CVE-2025-14905 [Orabug: 39146844] [1.3.11.1-5.0.5] - Allow Uniqueness plugin to search uniqueness attributes using custom matching rules [Orabug: 38388205]

Apr 16, 2026
Medium max 6.0

ELSA-2026-6464 3 CVEs

Moderate: python3 security update (Oracle Linux 7)

[3.6.8-21.0.9] - Security update CVE-2025-15366, CVE-2025-15367, CVE-2026-1299 [Orabug: 39159999] [3.6.8-21.0.7] - Security update CVE-2025-12084 [Orabug: 38971895] [3.6.8-21.0.5] - tarfile now validates archives to ensure member offsets are non-negative [Ora…

Apr 16, 2026
Medium max 5.9

ELSA-2026-8096 1 CVE

Moderate: perl:5.32 security update (Oracle Linux 8)

perl [4:5.32.1-474] - Resolves: RHEL-153834 - Fix CVE-2025-40909 - Clone dirhandles without fchdir [4:5.32.1-473] - Fix CVE-2023-47038 - Added perl-autouse and perl-ExtUtils-MM-Utils to perl run-requires [4:5.32.1-472] - Add definition of OPTIMIZE to .ph file…

Apr 16, 2026
Medium max 8.7

ELSA-2026-8093 1 CVE

Moderate: pcs security update (Oracle Linux 8)

[0.10.18-2.0.1.el8_10.9] - Replaced HAM-logo [0.10.18] - Debrand PCS [0.10.18-2.el8_10.9] - Fixed CVE-2026-31958 by patching bundled Tornado Resolves: RHEL-155293

Apr 15, 2026
Medium max 7.8

ELSA-2026-5233 1 CVE

Moderate: grub2 security update (Oracle Linux 7)

[2.02-0.87.0.29.el7.14] - Unregister gettext command on module unload [CVE-2025-61662][Orabug: 39112125] [2.02-0.87.0.27.el7.14] - Fix OOB write in grub_net_search_config_file() CVE-2025-0624 [Orabug: 37770226] - Also adds implementation of grub_strlcpy() for…

Apr 8, 2026
Medium max 7.5

ELSA-2026-7081 1 CVE

Moderate: libtiff security update (Oracle Linux 10)

[4.6.0-6.2] - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-148254)

Apr 8, 2026
Medium max 8.8

ELSA-2026-6571 4 CVEs

Moderate: kernel security update (Oracle Linux 8)

[4.18.0-553.117.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Apr 7, 2026
Medium max 0.0

ELSA-2026-6621 1 CVE

Moderate: crun security update (Oracle Linux 9)

[1.27-1] - update to https://github.com/containers/crun/releases/tag/1.27 - fixes CVE-2026-30892 crun: crun: Privilege escalation due to incorrect parsing of the --user option [rhel-9.7.z] - Resolves: RHEL-161439

Apr 7, 2026
Medium max 7.8

ELSA-2026-6570 4 CVEs

Moderate: kernel security update (Oracle Linux 9)

[5.14.0-611.47.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Apr 7, 2026