Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

Medium max 5.5

ELSA-2024-2217 2 CVEs

Moderate: motif security update (Oracle Linux 9)

[2.3.4-28] - Fix CVE-2023-43788: out of bounds read in XpmCreateXpmImageFromBuffer() - Fix CVE-2023-43789: out of bounds read on XPM with corrupted colormap

May 2, 2024
Medium max 6.5

ELSA-2024-2208 12 CVEs

Moderate: freerdp security update (Oracle Linux 9)

[2:2.11.2-1] - Update to 2.11.2 (RHEL-4290, RHEL-4292, RHEL-4296, RHEL-4298, RHEL-4300, RHEL-4302, RHEL-4304, RHEL-4306, RHEL-4308, RHEL-4310, RHEL-4312, RHEL-10060)

May 2, 2024
Medium max 7.8

ELSA-2024-2145 3 CVEs

Moderate: libX11 security update (Oracle Linux 9)

[1.7.0-9] - Fix CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms() - Fix CVE-2023-43786: stack exhaustion from infinite recursion in PutSubImage() - Fix CVE-2023-43787: integer overflow in XCreateImage() leading to a heap overflow

May 2, 2024
Low

ELSA-2024-2137 1 CVE

Low: LibRaw security update (Oracle Linux 9)

[0.21.1-1] - 0.21.1 - Include the fix for CVE-2023-1729 from Fedora Resolves: RHEL-768

May 2, 2024
Medium max 8.8

ELSA-2024-2302 1 CVE

Moderate: gstreamer1-plugins-base security update (Oracle Linux 9)

[1.22.1-2] - CVE-2023-37328: heap overwrite in subtitle parsing - Resolves: RHEL-19475

May 2, 2024
Medium

ELSA-2024-2396 2 CVEs

Moderate: squashfs-tools security update (Oracle Linux 9)

[4.4-10.git1] - CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix CVE-2021-40153 squashfs-tools: unvalidated filepaths allow writing outside of destination rhbz#2007304 RHEL-7763 [4.4-9.git1] - CVE-2021-40153 squashfs-t…

May 2, 2024
Medium max 5.5

ELSA-2024-2483 1 CVE

Moderate: traceroute security update (Oracle Linux 9)

[3:2.1.0-18] - add gating.yaml [3:2.1.0-17] - fix improper command line parsing (CVE-2023-46316)

May 2, 2024
Medium max 6.5

ELSA-2024-2289 5 CVEs

Moderate: libtiff security update (Oracle Linux 9)

[4.4.0-12] - Fix CVE-2023-6228 - Resolves: RHEL-10084 [4.4.0-11] - Fix CVE-2023-40090 CVE-2023-3618 CVE-2023-40745 CVE-2023-41175 - Resolves: RHEL-5458 RHEL-5455 RHEL-5405 RHEL-5450

May 2, 2024
Medium max 5.5

ELSA-2024-2146 2 CVEs

Moderate: libXpm security update (Oracle Linux 9)

[3.5.13-10] - Drop hardening patches from previous version to keep ABI compatibility [3.5.13-9] - CVE-2023-43786 libX11: stack exhaustion from infinite recursion in PutSubImage() - CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to a heap ov…

May 2, 2024
Medium max 5.8

ELSA-2024-2113 3 CVEs

Moderate: pcs security update (Oracle Linux 9)

[0.11.7-2] - Fixed CVE-2024-25126, CVE-2024-26141, CVE-2024-26146 in bundled dependency rack Resolves: RHEL-26446, RHEL-26448, RHEL-26450 [0.11.7-1] - Rebased to the latest sources (see CHANGELOG.md) Resolves: RHEL-7740 [0.11.6-6] - Rebased to the latest upst…

May 2, 2024
Medium max 5.3

ELSA-2024-2204 2 CVEs

Moderate: libnbd security update (Oracle Linux 9)

[1.18.1-3] - Backport unit test of recent libnbd API addition resolves: RHEL-16292 [1.18.1-2] - Fix assertion in ext-mode BLOCK_STATUS (CVE-2023-5871) resolves: RHEL-15143 [1.18.1-1] - Rebase to 1.18.1 resolves: RHEL-14476

May 2, 2024
Medium max 9.8

ELSA-2024-2169 10 CVEs

Moderate: xorg-x11-server security update (Oracle Linux 9)

[1.20.4-24] - Fix use after free related to CVE-2024-21886 [1.20.11-23] - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886, CVE-2024-0408 and CVE-2024-0409 Resolves: https://issues.redhat.com/browse/RHEL-21203 Resolves: https://issues…

May 2, 2024
Medium

ELSA-2024-2211 1 CVE

Moderate: tcpdump security update (Oracle Linux 9)

[14:4.99.0-9] - Resolves: RHEL-21558 - tcpslice: use-after-free in extract_slice() [14:4.99.0-8] - Resolves: RHEL-10714 - Fix PGM option printing

May 2, 2024
Medium max 7.8

ELSA-2024-2353 1 CVE

Moderate: mingw components security update (Oracle Linux 9)

mingw-binutils [2.41-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild [2.41-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild [2.41-1] - Update to 2.41 [2.40-4] - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_…

May 2, 2024
Medium max 9.8

ELSA-2024-2170 9 CVEs

Moderate: xorg-x11-server-Xwayland security update (Oracle Linux 9)

[21.1.9-5] Fix for CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886, CVE-2024-0408, CVE-2024-0409 [21.1.9-4] - Fix for CVE-2023-6377, CVE-2023-6478 [22.1.9-3] - Fix for CVE-2023-5367

May 2, 2024
Medium max 5.4

ELSA-2024-2348 1 CVE

Moderate: python-jinja2 security update (Oracle Linux 9)

[2.11.3-5] - Security fix for CVE-2024-22195 Resolves: RHEL-21349

May 2, 2024
Medium max 7.0

ELSA-2024-2228 1 CVE

Moderate: perl security update (Oracle Linux 9)

[4:5.32.1-481] - Fixes: CVE-2023-47038

May 2, 2024
Low

ELSA-2024-2512 1 CVE

Low: file security update (Oracle Linux 9)

[5.39-16] - Fix stack-based buffer over-read in file_copystr() (CVE-2022-48554) [5.39-15] - Fix segfault in python3-file-magic concurrent method calls

May 2, 2024
High max 9.8

ELSA-2024-2126 10 CVEs

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.42.5-1] - Update to 2.42.5 Resolves: RHEL-3960 [2.42.4-1] - Update to 2.42.4 Resolves: RHEL-3960 Resolves: RHEL-19366 [2.42.3-1] - Update to 2.42.3 Resolves: RHEL-3960 [2.42.2-1] - Update to 2.42.2 Resolves: RHEL-3960 [2.42.1-1] - Update to 2.42.1 Resolves…

May 2, 2024
Medium max 6.2

ELSA-2024-2276 2 CVEs

Moderate: qt5-qtbase security update (Oracle Linux 9)

[5.15.9-9] - Fix CVE-2024-25580: potential buffer overflow when reading KTX images Resolves: RHEL-25726 [5.15.9-8] - Fix incorrect integer overflow check in HTTP2 implementation Resolves: RHEL-20239

May 2, 2024
High max 9.8

ELSA-2024-2394 57 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-427.13.1_4.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.…

May 2, 2024
Medium max 5.9

ELSA-2024-2337 1 CVE

Moderate: python3.11-cryptography security update (Oracle Linux 9)

[37.0.2-6] - Security fix for CVE-2023-49083 - Resolves: RHEL-19832

May 2, 2024
Medium max 8.6

ELSA-2024-2002 1 CVE

Moderate: grub2 security update (Oracle Linux 7)

[2.02-0.87.0.26.el7.14] - Replace bugzilla.oracle.com reference [Orabug: 35477723] - Backport kernel EFI allocation pacthes [Orabug: 34301086] - Add to the list CVE-2021-3695, CVE-2021-3696, CVE-2021-3697, CVE-2022-28734, CVE-2022-28735, CVE-2022-28736 [JIRA:…

May 1, 2024
High max 8.3

ELSA-2024-1959 6 CVEs

Important: shim security update (Oracle Linux 7)

shim [- 15.8-2.0.3.el7] - Set shim.ol sbat generation to 3 [Orabug: 36271343] [- 15.8-2.0.1.el7] - Set SBAT_AUTOMATIC_DATE to 2021030218 [Orabug: 36271343] - Rebuild with Oracle certificates [Orabug: 36271343] - Full list of fixed CVEs: CVE-2023-40546, CVE-20…

May 1, 2024
High max 7.8

ELSA-2024-2080 3 CVEs

Important: tigervnc security update (Oracle Linux 7)

[1.8.0-33.0.1] - Dropped xorg-CVE-2023-5367.patch, xorg-CVE-2023-6816.patch, xorg-CVE-2023-6377.patch, xorg-CVE-2023-6478.patch, xorg-CVE-2024-0229-1.patch, xorg-CVE-2024-0229-2.patch, xorg-CVE-2024-0229-3.patch, xorg-CVE-2024-21885.patch, xorg-CVE-2024-21886…

Apr 29, 2024
High max 8.6

ELSA-2024-2084 1 CVE

Important: container-tools:4.0 security update (Oracle Linux 8)

buildah [1.24.7-1] - bump to v1.24.7 - Resolves: RHEL-26767 cockpit-podman conmon containernetworking-plugins containers-common container-selinux criu crun fuse-overlayfs libslirp oci-seccomp-bpf-hook podman python-podman runc [1.1.12-1.0.1] - rebuild with go…

Apr 29, 2024
High max 8.6

ELSA-2024-2098 1 CVE

Important: container-tools:ol8 security and bug fix update (Oracle Linux 8)

aardvark-dns buildah [1:1.31.5-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.31 (https://github.com/containers/buildah/commit/5fd539c) - Resolves: RHEL-26772 [1:1.31.3-3] - Make the module buildable again - Resolves…

Apr 29, 2024
High max 7.5

ELSA-2024-12348 2 CVEs

Important: cri-o security update (Oracle Linux 8)

cri-o [1.26.4-2] - Address CVE-2024-24786 cri-tools [1.26.1-5] - Address CVE-2024-24786 etcd [3.5.10-3] - Address protobuf [CVE-2024-24786] [3.5.10-1] - Added Oracle specific build files istio [1.17.8-3] - Address protobuf [CVE-2024-24786] - Backport from 1.1…

Apr 26, 2024
High max 7.5

ELSA-2024-12347 2 CVEs

Important: cri-o security update (Oracle Linux 9)

cri-o [1.26.4-2] - Address CVE-2024-24786 cri-tools [1.26.1-5] - Address CVE-2024-24786 etcd [3.5.10-3] - Address protobuf [CVE-2024-24786] [3.5.10-1] - Added Oracle specific build files istio [1.17.8-3] - Address protobuf [CVE-2024-24786] - Backport from 1.1…

Apr 26, 2024
High max 8.3

ELSA-2024-1902 6 CVEs

Important: shim security update (Oracle Linux 8)

[15.8-4.0.1] - Add support for Oracle signed shim [Orabug: 36540084] - Add shim binaries signed with Oracle Secure Boot Signing (key 1) [Orabug: 36540084] [15.8-1.0.3] - Update shimx64.efi, shimia32.efi and shimaa64.efi v15.8 signed by Microsoft [Orabug: 3607…

Apr 25, 2024
High max 8.6

ELSA-2024-2055 1 CVE

Important: buildah security update (Oracle Linux 9)

[1.31.5-1.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [1:1.31.5-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.31 (https://github.com/containers/buildah/commit/5fd539c) - Res…

Apr 25, 2024
High max 7.8

ELSA-2024-2037 3 CVEs

Important: tigervnc security update (Oracle Linux 8)

[1.13.1-2.10] - Fix crash caused by fix for CVE-2024-31083 Resolves: RHEL-30981 [1.13.1-2.9] - Rebuild (z-stream target) Resolves: RHEL-31011 Resolves: RHEL-30981 Resolves: RHEL-30998 [1.13.1-2.8] - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer ov…

Apr 24, 2024
Medium max 8.3

ELSA-2024-20865 10 CVEs

Moderate: edk2 security update (Oracle Linux 8)

* Tue Feb 27 2024 Aaron Young - Create new 20240227 release for OL8 which includes the following fixed CVEs: {CVE-2023-45229} {CVE-2023-45230} {CVE-2023-45231} {CVE-2023-45232} {CVE-2023-45233} {CVE-2023-45234} {CVE-2023-45235} {CVE-2022-36763} {CVE-2022-3676…

Apr 24, 2024
Medium max 8.3

ELSA-2024-12343 10 CVEs

Moderate: edk2 security update (Oracle Linux 8)

* Tue Feb 27 2024 Aaron Young - Create new 20240227 release for OL8 which includes the following fixed CVEs: {CVE-2023-45229} {CVE-2023-45230} {CVE-2023-45231} {CVE-2023-45232} {CVE-2023-45233} {CVE-2023-45234} {CVE-2023-45235} {CVE-2022-36763} {CVE-2022-3676…

Apr 24, 2024
Medium max 6.5

ELSA-2024-2033 1 CVE

Moderate: libreswan security and bug fix update (Oracle Linux 9)

[4.12-1.0.1.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.12-1.1] - Fix CVE-2024-2357 (RHEL-29734) - x509: unpack IPv6 general names based on length (RHEL-32719) [4.12-1] - Update to 4.12 to fix CVE-2023-38710, CVE-2023-38711, CVE-2023-3871…

Apr 24, 2024
High max 7.8

ELSA-2024-2004 5 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1160.118.1.0.1] - debug: lock down kgdb [Orabug: 34270798] {CVE-2022-21499} [3.10.0-1160.118.1] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@…

Apr 23, 2024
Medium max 6.5

ELSA-2024-1998 1 CVE

Moderate: libreswan security update (Oracle Linux 8)

[4.12-2.0.1.2] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.12-2.2] - Fix patch application in the previous change [4.12-2.1] - Fix CVE-2024-2357 (RHEL-28742)

Apr 23, 2024
High max 7.5

ELSA-2024-1962 1 CVE

Important: go-toolset:ol8 security update (Oracle Linux 8)

delve golang [1.20.12-8] - Update sources file - Related: RHEL-27928 [1.20.12-7] - Fix CVE-2024-1394 - Resolves: RHEL-27928 [1.20.12-6] - Fix CVE-2023-45288 - Resolves: RHEL-31914 go-toolset

Apr 23, 2024
Medium max 3.7

ELSA-2024-1828 3 CVEs

Moderate: java-21-openjdk security update (Oracle Linux 8)

[1:21.0.3.0.9-1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:21.0.3.0.9-1] - Update to jdk-21.0.3+9 (GA) - Update release notes to 21.0.3+9 - Switch to GA mode. - Sync the copy of the portable specfile with the latest update - ** This tarball is emb…

Apr 23, 2024
Medium max 3.7

ELSA-2024-1818 4 CVEs

Moderate: java-1.8.0-openjdk security update (Oracle Linux 8)

[1:1.8.0.412.b08-2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155]

Apr 23, 2024