Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

Medium max 5.9

ELSA-2024-3105 1 CVE

Moderate: python3.11-cryptography security update (Oracle Linux 8)

[37.0.2-6] - Security fix for CVE-2023-49083 - Resolves: RHEL-19831

May 23, 2024
Medium max 8.1

ELSA-2024-3094 1 CVE

Moderate: perl-CPAN security update (Oracle Linux 8)

[2.18-399] - Fix tests to run in correct order [2.18-398] - Fix CVE-2023-31484 - Package tests [2.18-397] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [2.18-396] - Rebase patches to prevent from installing back-up files [2.18-395] - Reb…

May 23, 2024
Medium max 7.8

ELSA-2024-3306 4 CVEs

Moderate: kernel security and bug fix update (Oracle Linux 9)

[5.14.0-427.18.1_4.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.…

May 23, 2024
High max 7.5

ELSA-2024-3307 2 CVEs

Important: tomcat security and bug fix update (Oracle Linux 9)

[1:9.0.87-1.el9_4.1] - Resolves: RHEL-34815 - Rebase tomcat to version 9.0.87 - Resolves: RHEL-31048 tomcat: Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672) - Resolves: RHEL-31032 tomcat: : Apache Tomcat: HTTP/2 header handling…

May 23, 2024
High max 8.2

ELSA-2024-2910 5 CVEs

Important: nodejs security update (Oracle Linux 9)

[1:16.20.2-8.0.1] - Fix CVE-2024-28182, CVE-2024-22025, CVE-2024-25629, CVE-2024-27982, CVE-2024-27983

May 22, 2024
High max 8.8

ELSA-2024-2913 6 CVEs

Important: thunderbird security update (Oracle Linux 7)

[115.11.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [115.11.0-1] - Update to 115.11.0 build2

May 20, 2024
High max 8.8

ELSA-2024-2881 6 CVEs

Important: firefox security update (Oracle Linux 7)

[115.11.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [115.11.0-1] - Update to 115.11.0 build1

May 16, 2024
High max 8.2

ELSA-2024-2853 5 CVEs

Important: nodejs:20 security update (Oracle Linux 9)

nodejs [1:20.12.2-2] - Backport nghttp2 patch for CVE-2024-28182 [1:20.12.2-1] - Rebase to version 20.12.0 Fixes: CVE-2024-27983 CVE-2024-27982 CVE-2024-22025 (node) Fixes: CVE-2024-25629 (c-ares) nodejs-nodemon nodejs-packaging

May 16, 2024
High max 8.8

ELSA-2024-2888 6 CVEs

Important: thunderbird security update (Oracle Linux 9)

[115.11.0-1.0.1] - Add Oracle prefs [115.11.0-1] - Update to 115.11.0 build2

May 16, 2024
High max 8.8

ELSA-2024-2883 6 CVEs

Important: firefox security update (Oracle Linux 9)

[115.11.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [115.11.0-1] - Update to 115.11.0 build1

May 16, 2024
High max 4.7

ELSA-2024-12385 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-206.153.7] - mmc: core: Initialize mmc_blk_ioc_data (Mikko Rapeli) - ahci: asm1064: asm1166: don't limit reported ports (Conrad Kostecki) - mmc: core: Fix switch on gp3 partition (Dominique Martinet) - Drivers: hv: vmbus: Calculate ring buffer size fo…

May 15, 2024
High max 6.3

ELSA-2024-2842 2 CVEs

Important: .NET 8.0 security update (Oracle Linux 9)

[8.0.105-1.0.1] - Add support for Oracle Linux [8.0.105-1] - Update to .NET SDK 8.0.105 and Runtime 8.0.5 - Resolves: RHEL-35317

May 14, 2024
High max 8.2

ELSA-2024-2779 5 CVEs

Important: nodejs:18 security update (Oracle Linux 9)

nodejs [1:18.20.2-2] - Removes .ps1 files - Rebase to 18.20.2 - Fixes: CVE-2024-27983, CVE-2024-28182, CVE-2024-27982, CVE-2024-25629 nodejs-nodemon nodejs-packaging

May 14, 2024
High max 6.3

ELSA-2024-2843 2 CVEs

Important: .NET 7.0 security update (Oracle Linux 9)

[7.0.119-1.0.1] - Add OracleLinux support

May 14, 2024
High max 7.8

ELSA-2024-12378 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.536.5] - mmc: core: Fix switch on gp3 partition (Dominique Martinet) - Revert 'Revert 'md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d'' (Song Liu) - mm/memory-failure: fix an incorrect use of tail pages (Liu Shixin) - Revert 'x86/mm/ident_map…

May 13, 2024
Medium max 4.7

ELSA-2024-12380 1 CVE

Moderate: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.331.7.el7] - Revert 'tracing/trigger: Fix to return error if failed to alloc snapshot' (Siddh Raman Pant) - Revert 'selftests: mm: fix map_hugetlb failure on 64K page size systems' (Harshit Mogalapalli) [Orabug: 36584568] - Revert 'net/mlx5: Enab…

May 13, 2024
High max 4.7

ELSA-2024-12377 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.331.7] - Revert 'tracing/trigger: Fix to return error if failed to alloc snapshot' (Siddh Raman Pant) - Revert 'selftests: mm: fix map_hugetlb failure on 64K page size systems' (Harshit Mogalapalli) [Orabug: 36584568] - Revert 'net/mlx5: Enable S…

May 13, 2024
High max 8.2

ELSA-2024-2780 5 CVEs

Important: nodejs:18 security update (Oracle Linux 8)

nodejs [1:18.20.2-1] - Removes .ps1 files - Rebase to 18.20.2 - Fixes: CVE-2024-27983, CVE-2024-28182, CVE-2024-27982, CVE-2024-25629 nodejs-nodemon nodejs-packaging

May 10, 2024
High max 8.2

ELSA-2024-2778 5 CVEs

Important: nodejs:20 security update (Oracle Linux 8)

nodejs [1:20.12.2-2] - Backport nghttp2 patch for CVE-2024-28182 [1:20.12.2-1] - Rebase to version 20.12.0 Fixes: CVE-2024-27983 CVE-2024-27982 CVE-2024-22025 (node) Fixes: CVE-2024-25629 (c-ares) nodejs-nodemon nodejs-packaging

May 9, 2024
High max 7.5

ELSA-2024-2699 1 CVE

Important: git-lfs security update (Oracle Linux 8)

[3.2.0-3] - Rebuild with new Golang - Resolves: RHEL-32542

May 8, 2024
High max 7.3

ELSA-2024-2722 1 CVE

Important: glibc security update (Oracle Linux 8)

[2.28-236.0.1.13] - Forward port of Oracle patches. Reviewed-by: Jose E. Marchesi

May 8, 2024
Medium max 5.3

ELSA-2024-12364 2 CVEs

Moderate: gnutls security update (Oracle Linux 9)

[3.8.3-4_fips] - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35925409] - Update FIPS module name for Oracle Linux [Orabug: 35925409] [3.8.3-4] - Bump release to ensure el9 package is greater than el9_* packages [3.8.3-3] -…

May 8, 2024
Medium max 7.1

ELSA-2024-2758 3 CVEs

Moderate: kernel security and bug fix update (Oracle Linux 9)

[5.14.0-427.16.1_4.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.…

May 8, 2024
High max 8.8

ELSA-2024-2566 1 CVE

Important: pcp security, bug fix, and enhancement update (Oracle Linux 9)

[6.2.0-2.0.1] - Fixed libpcp derived metric issue for ol9 [Orabug: 36538820] [6.2.0-2] - Disable RESP proxying by default in pmproxy (RHEL-30719)

May 8, 2024
High max 7.0

ELSA-2024-12354 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.85.1] - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition (Zheng Wang) [Orabug: 35282809] {CVE-2023-1989}

May 7, 2024
Medium max 7.5

ELSA-2024-2564 1 CVE

Moderate: mod_http2 security update (Oracle Linux 9)

[2.0.26-2] - Resolves: RHEL-31855 - mod_http2: httpd: CONTINUATION frames DoS (CVE-2024-27316) [2.0.26-1] - Resolves: RHEL-14691 - mod_http2 rebase to 2.0.26

May 7, 2024
Medium max 7.5

ELSA-2024-2550 1 CVE

Moderate: buildah bug fix update (Oracle Linux 9)

[1.33.7-1.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.33.7-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.33 (https://github.com/containers/buildah/commit/b95e962) - Res…

May 7, 2024
High max 7.5

ELSA-2024-2724 4 CVEs

Important: git-lfs security update (Oracle Linux 9)

[3.4.1-2] - Rebuild with new Golang - Resolves: RHEL-32570, RHEL-28385, RHEL-28402, RHEL-28432

May 7, 2024
Medium max 6.8

ELSA-2024-2559 1 CVE

Moderate: python-jwcrypto security update (Oracle Linux 9)

[0.8-5] - Address potential DoS with high compression ratio Resolves: RHEL-28698

May 7, 2024
High max 7.8

ELSA-2024-2616 3 CVEs

Important: tigervnc security update (Oracle Linux 9)

[1.13.1-8.3] - Rebuild (z-stream target) Resolves: RHEL-30985 Resolves: RHEL-31015 [1.13.1-8.2] - Fix crash caused by fix for CVE-2024-31083 Resolves: RHEL-30985 [1.13.1-8.1] - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in…

May 7, 2024
Medium max 5.3

ELSA-2024-2570 2 CVEs

Moderate: gnutls security update (Oracle Linux 9)

[3.8.3-4] - Bump release to ensure el9 package is greater than el9_* packages [3.8.3-3] - Bump release to ensure el9 package is greater than el9_* packages [3.8.3-2] - Fix timing side-channel in deterministic ECDSA (RHEL-28959) - Fix potential crash during ch…

May 7, 2024
Medium max 8.6

ELSA-2024-2548 2 CVEs

Moderate: podman security and bug fix update (Oracle Linux 9)

[4.9.4-3.0.1] - Add devices on container startup, not on creation - Backport fast gzip for compression [Orabug: 36420418] - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug…

May 7, 2024
Medium max 6.5

ELSA-2024-2565 1 CVE

Moderate: libreswan security update (Oracle Linux 9)

[4.12-2.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.12-2] - Fix CVE-2024-2357 (RHEL-32761) - x509: unpack IPv6 general names based on length (RHEL-32718)

May 7, 2024
Medium max 6.2

ELSA-2024-2560 2 CVEs

Moderate: libvirt security and bug fix update (Oracle Linux 9)

[10.0.0-6.2.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] [10.0.0-6.2.el9_4] - qemu: Fix migration with custom XML (RHEL-32654) [10.0.0-6.1.el9_4] - Fix off-by-one error in udevListInterfacesByStatus (CVE-2024-1441, RHEL-25081) - remote: chec…

May 7, 2024
Medium max 7.1

ELSA-2024-2571 1 CVE

Moderate: sssd security and bug fix update (Oracle Linux 9)

[2.9.4-6.0.1] - Restore default debug level for sss_cache [Orabug: 32810448] [2.9.4-6] - Resolves: RHEL-27209 - Race condition during authorization leads to GPO policies functioning inconsistently [rhel-9.4.0] [2.9.4-5] - Resolves: RHEL-28161 - Passkey cannot…

May 7, 2024
Medium max 7.5

ELSA-2024-2549 2 CVEs

Moderate: skopeo security and bug fix update (Oracle Linux 9)

[2:1.14.3-2] - update to the latest content of https://github.com/containers/skopeo/tree/release-1.14 (https://github.com/containers/skopeo/commit/5f2b9af) - Resolves: RHEL-28736 [2:1.14.3-1] - update to the latest content of https://github.com/containers/sko…

May 7, 2024
Medium max 7.5

ELSA-2024-2679 1 CVE

Moderate: libxml2 security update (Oracle Linux 9)

[2.9.13-6] - Fix CVE-2024-25062 (RHEL-29196)

May 7, 2024
High max 7.5

ELSA-2024-2551 6 CVEs

Important: bind security update (Oracle Linux 9)

bind [9.16.23-18.0.1] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-18.1] - Rebuild with correct z-stream tag again [32:9.16.23-18] - Prevent crashing at masterformat system test (CVE-2023-6516) [32:9.16.23-17] - Import te…

May 7, 2024
High max 7.5

ELSA-2024-2569 1 CVE

Important: grafana-pcp security update (Oracle Linux 9)

[5.1.1-2] - fix CVE-2024-1394

May 7, 2024
Medium max 7.5

ELSA-2024-2568 2 CVEs

Moderate: grafana security update (Oracle Linux 9)

[9.2.10-16] - Check OrdID is correct before deleting snapshot - fix CVE-2024-1313 - fix CVE-2024-1394

May 7, 2024