Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

High max 7.5

ELSA-2024-1963 1 CVE

Important: golang security update (Oracle Linux 9)

[1.20.12-4] - Rebuild for z-stream - Related: RHEL-28939 [1.20.12-3] - Fix CVE-2023-45288 - Resolves: RHEL-28939 - Temporarily disable FIPS tests (RHELBLD-14822)

Apr 23, 2024
Medium max 3.7

ELSA-2024-1822 5 CVEs

Moderate: java-11-openjdk security update (Oracle Linux 8)

[1:11.0.23.0.9-3.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:11.0.23.0.9-2] - Fix 11.0.22 release date in NEWS [1:11.0.23.0.9-1] - Update to jdk-11.0.23+9 (GA) - Update release notes to 11.0.23+9 - Switch to GA mode for release - Require tzdata 202…

Apr 23, 2024
Low max 3.7

ELSA-2024-1940 1 CVE

Low: owO: thunderbird security update (Oracle Linux 9)

[115.10.0-2.0.1] - Add Oracle prefs - Add OpenELA debranding [115.10.0-2] - Update to 115.10.0 build2 [115.10.0-1] - Update to 115.10.0 build1 - Revert expat CVE-2023-52425 fix

Apr 23, 2024
Low max 3.7

ELSA-2024-1935 1 CVE

Low: thunderbird security update (Oracle Linux 7)

[115.10.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [115.10.0-2] - Update to 115.10.0 build2 [115.10.0-1] - Update to 115.10.0 build1 - Revert expat CVE-2023-52425 fix

Apr 22, 2024
Medium max 3.7

ELSA-2024-1821 5 CVEs

Moderate: java-11-openjdk security update (Oracle Linux 7)

[1:11.0.23.0.9-2.0.1] - link atomic for ix86 build [1:11.0.23.0.9-2] - Fix 11.0.22 release date in NEWS - Restore ppc64le --with-jobs=1 workaround to avoid flaky ppc builds [1:11.0.23.0.9-1] - Update to jdk-11.0.23+9 (GA) - Update release notes to 11.0.23+9 -…

Apr 22, 2024
Low max 3.7

ELSA-2024-1939 1 CVE

Low: thunderbird security update (Oracle Linux 8)

[115.10.0-2.0.1] - Add Oracle prefs [115.10.0] - Add OpenELA debranding [115.10.0-2] - Update to 115.10.0 build2 [115.10.0-1] - Update to 115.10.0 build1 - Revert expat CVE-2023-52425 fix

Apr 22, 2024
High max 8.3

ELSA-2024-1903 6 CVEs

Important: shim bug fix update (Oracle Linux 9)

[15.8-1.0.3] - Update shimx64.efi and shimaa64.efi v15.8 signed by Microsoft [Orabug: 36072879] - Update shim fb and mm binaries to match unsigned releases [Orabug: 36072879] [15.8-1.0.2] - Use binaries with correct shim.ol generation [Orabug: 36072879] - Set…

Apr 22, 2024
Medium max 3.7

ELSA-2024-1825 4 CVEs

Moderate: java-17-openjdk security update (Oracle Linux 8)

[17.0.11.0.9-2.0.1] - Add Oracle vendor bug URL [1:17.0.11.0.9-2] - Update to jdk-17.0.11+9 (GA) - Add openjdk-17.0.11+9.tar.xz to .gitignore - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8 - Update buildver from 7 to 9 - Update portable…

Apr 22, 2024
High max 8.8

ELSA-2024-1912 7 CVEs

Important: firefox security update (Oracle Linux 8)

[115.10.0-1.0.1] - Change default prefs file to Oracle version [115.10.0-1] - Update to 115.10.0 build1

Apr 19, 2024
Medium

ELSA-2024-12337 1 CVE

Moderate: nss security update (Oracle Linux 9)

[3.90.0-6_fips] - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35862190] - Update FIPS module name for Oracle Linux [Orabug: 35862190] [3.90.0-6] - Fix ecc DER wrapping. [3.90.0-5] - Pick up validated constant time implemen…

Apr 19, 2024
High max 8.8

ELSA-2024-1908 7 CVEs

Important: firefox security update (Oracle Linux 9)

[115.10.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [115.10.0-1] - Update to 115.10.0 build1

Apr 19, 2024
Medium max 7.5

ELSA-2024-12336 5 CVEs

Moderate: gnutls security update (Oracle Linux 9)

[3.7.6-23.4_fips] - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35925409] - Update FIPS module name for Oracle Linux [Orabug: 35925409] - Verify salt length and iteration count for PBKDF [Orabug: 35925409] [3.7.6-23.4] - F…

Apr 19, 2024
High max 8.8

ELSA-2024-1910 7 CVEs

Important: firefox security update (Oracle Linux 7)

[115.10.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [115.10.0-1] - Update to 115.10.0 build1

Apr 18, 2024
Medium max 5.3

ELSA-2024-1879 2 CVEs

Moderate: gnutls security update (Oracle Linux 9)

[3.7.6-23.4] - Fix timing side-channel in deterministic ECDSA (RHEL-28958) - Fix potential crash during chain building/verification (RHEL-28953)

Apr 18, 2024
High max 7.5

ELSA-2024-1872 1 CVE

Important: mod_http2 security update (Oracle Linux 9)

[1.15.19-5.1] - Resolves: RHEL-29826 - mod_http2: httpd: CONTINUATION frames DoS (CVE-2024-27316)

Apr 18, 2024
Medium max 3.7

ELSA-2024-1817 4 CVEs

Moderate: java-1.8.0-openjdk security update (Oracle Linux 7)

[1:1.8.0.412.b08-1] - Update to shenandoah-jdk8u412-b08 (GA) - Update release notes for shenandoah-8u412-b08. - Complete release note for Certainly roots - Switch to GA mode. - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. ** - Related: RHEL-30926 […

Apr 17, 2024
High max 7.5

ELSA-2024-12329 2 CVEs

Important: cri-o security update (Oracle Linux 7)

cri-o [1.25.5-2] - Address CVE-2024-24786 cri-tools [1.25.0-4] - Address CVE-2024-24786 etcd [3.5.9-4] - Address protobuf [CVE-2024-24786] [3.5.9-3] - Address CVE-2023-39326 by upgrading golang to version 1.20.12 istio [1.16.7-4] - Address protobuf [CVE-2024-…

Apr 16, 2024
High max 7.5

ELSA-2024-12328 2 CVEs

Important: cri-o security update (Oracle Linux 8)

cri-o [1.25.5-2] - Address CVE-2024-24786 cri-tools [1.25.0-4] - Address CVE-2024-24786 etcd [3.5.9-4] - Address protobuf [CVE-2024-24786] [3.5.9-3] - Address CVE-2023-39326 by upgrading golang to version 1.20.12 istio [1.16.7-4] - Address protobuf [CVE-2024-…

Apr 16, 2024
Medium max 5.3

ELSA-2024-1784 1 CVE

Moderate: gnutls security update (Oracle Linux 8)

[3.6.16-8.3_fips] - Allow RSA keygen with modulus sizes bigger than 3072 bits and validate the seed length as defined in FIPS 186-4 section B.3.2 [Orabug: 33200526] - Allow bigger known RSA modulus sizes when calling rsa_generate_fips186_4_keypair directly [O…

Apr 15, 2024
High max 7.8

ELSA-2024-1785 3 CVEs

Important: X.Org server security update (Oracle Linux 7)

[1.20.4-29] - Fix regression caused by the fix for CVE-2024-31083 [1.20.4-28] - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and CVE-2024-31083 Resolves: https://issues.redhat.com/browse/RHEL-31003 Resolves: https://issues.redhat.com/browse/RHE…

Apr 11, 2024
High max 8.6

ELSA-2024-1787 6 CVEs

Important: squid security update (Oracle Linux 7)

[7:3.5.20-17.0.1] - Mutiple CVE fixes for squid [Orabug: 33146289] - Resolves: CVE-2021-28651 squid: Bug 5104: Memory leak in RFC 2169 response parsing (#778) - Resolves: CVE-2021-28652 squid: Bug 5106: Broken cache manager URL parsing (#788) - Resolves: CVE-…

Apr 11, 2024
High max 8.0

ELSA-2024-1751 1 CVE

Important: unbound security update (Oracle Linux 8)

[1.16.2-5.6] - Rebuilt again with z-stream target [1.16.2-5.5] - Correct typo in new config file [1.16.2-5.4] - Ensure group access correction reaches also updated configs (CVE-2024-1488) [1.16.2-5.3] - Ensure only unbound group can change configuration (CVE-…

Apr 11, 2024
High max 7.5

ELSA-2024-1781 6 CVEs

Important: bind9.16 security update (Oracle Linux 8)

[32:9.16.23-0.16.2] - Prevent crashing at masterformat system test (CVE-2023-6516) [32:9.16.23-0.16.1] - Prevent increased CPU load on large DNS messages (CVE-2023-4408) - Prevent assertion failure when nxdomain-redirect is used with RFC 1918 reverse zones (C…

Apr 11, 2024
High max 7.5

ELSA-2024-1782 3 CVEs

Important: bind and dhcp security update (Oracle Linux 8)

bind [32:9.11.36-11.1] - Speed up parsing of DNS messages with many different names (CVE-2023-4408) - Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387 CVE-2023-50868) - Do not use header_prev in expire_lru_headers dhcp [4.3.6] - Change bu…

Apr 11, 2024
High max 7.5

ELSA-2024-1786 1 CVE

Important: httpd:2.4/mod_http2 security update (Oracle Linux 8)

httpd mod_http2 [1.15.7-8.5] - Resolves: RHEL-29816 - httpd:2.4/mod_http2: httpd: CONTINUATION frames DoS (CVE-2024-27316) mod_md

Apr 11, 2024
High max 7.5

ELSA-2024-1789 6 CVEs

Important: bind security update (Oracle Linux 9)

bind [32:9.16.23-14.4] - Rebuild with correct z-stream tag again [32:9.16.23-14.3] - Rebuild together with bind-dyndb-ldap to adjust ABI changes [32:9.16.23-14.2] - Import tests for large DNS messages fix - Add downstream change complementing CVE-2023-50387 […

Apr 11, 2024
Medium max 8.8

ELSA-2024-12276 8 CVEs

Moderate: virt:kvm_utils3 security update (Oracle Linux 8)

hivex libguestfs libguestfs-winsupport [8.9-1] - Rebase to ntfs-3g 2022.10.3 - Fixes: CVE-2022-40284 - resolves: rhbz#2236372 libiscsi libnbd libtpms libvirt [9.0.0-5] - Fix off-by-one error in udevListInterfacesByStatus (Martin Kletzander) [Orabug: 36364464]…

Apr 10, 2024
High max 7.8

ELSA-2024-1607 7 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-513.24.1_9.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

Apr 10, 2024
High max 8.0

ELSA-2024-1750 1 CVE

Important: unbound security update (Oracle Linux 9)

[1.16.2-3.5] - Rebuilt again with z-stream target [1.16.2-3.4] - Correct typo in new config file [1.16.2-3.3] - Ensure group access correction reaches also updated configs (CVE-2024-1488) [1.16.2-3.2] - Ensure only unbound group can change configuration (CVE-…

Apr 10, 2024
High max 7.5

ELSA-2024-1690 1 CVE

Important: varnish security update (Oracle Linux 8)

varnish [6.0.13-1] - new version 6.0.13 - Resolves: RHEL-30378 - varnish:6/varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156) varnish-modules

Apr 9, 2024
Medium max 5.5

ELSA-2024-1719 1 CVE

Moderate: rear security update (Oracle Linux 8)

[2.6-11.0.1] - Change OS_VENDOR to OracleServer [2.6-11] - make initrd accessible only by root (CVE-2024-23301), PR 3123

Apr 9, 2024
High max 7.5

ELSA-2024-1691 1 CVE

Important: varnish security update (Oracle Linux 9)

[6.6.2-4.1] - Resolves: RHEL-30387 - varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156) [6.6.2-4] - Add parameters h2_rst_allowance and h2_rst_allowance_period to mitigate CVE-2023-44487 - Resolves: RHEL-12817

Apr 9, 2024
High max 7.8

ELSA-2024-12270 2 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.535.2.1] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36467681] {CVE-2024-1086} [4.14.35-2047.535.2] - Fix null ptr in rds_tcp_recv_path (Allison Henderson) [Orabug: 33499812] - LTS version: v4.14.338 …

Apr 8, 2024
High max 7.8

ELSA-2024-12274 5 CVEs 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.330.7.1.el7] - KVM: x86: Add BHI_NO (Daniel Sneddon) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Pawan Gupta) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Pawan Gupta) [Orabug: 36384803] {CVE-2…

Apr 8, 2024
High max 7.8

ELSA-2024-12271 5 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.330.7.1] - KVM: x86: Add BHI_NO (Daniel Sneddon) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Pawan Gupta) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Pawan Gupta) [Orabug: 36384803] {CVE-2024-…

Apr 8, 2024
High max 7.8

ELSA-2024-12275 5 CVEs 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

[5.4.17-2136.330.7.1.el8] - KVM: x86: Add BHI_NO (Daniel Sneddon) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Pawan Gupta) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Pawan Gupta) [Orabug: 36384803] {CVE-2…

Apr 8, 2024
High max 7.9

ELSA-2024-1687 7 CVEs

Important: nodejs:20 security update (Oracle Linux 8)

nodejs [1:20.11.1-1] - Rebase to version 20.11.1 - Fixes: CVE-2024-21892 CVE-2024-21896 CVE-2024-22017 CVE-2024-22019 (high) - Fixes: CVE-2023-46809 CVE-2024-21890 CVE-2024-21891 (medium) nodejs-nodemon nodejs-packaging

Apr 8, 2024
High max 7.9

ELSA-2024-1688 7 CVEs

Important: nodejs:20 security update (Oracle Linux 9)

nodejs [1:20.11.1-1] - Rebase to version 20.11.1 - Fixes: CVE-2024-21892 CVE-2024-21896 CVE-2024-22017 CVE-2024-22019 (high) - Fixes: CVE-2023-46809 CVE-2024-21890 CVE-2024-21891 (medium) nodejs-nodemon nodejs-packaging

Apr 8, 2024
High max 4.7

ELSA-2024-12272 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-205.149.5.1] - KVM: x86: Add BHI_NO (Daniel Sneddon) [Orabug: 36384802] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Pawan Gupta) [Orabug: 36384802] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Pawan Gupta) [Orabug: 36384802] {CVE-2024-2…

Apr 8, 2024
Medium max 7.8

ELSA-2024-1692 1 CVE

Moderate: less security update (Oracle Linux 9)

[590-3] - Fix CVE-2022-48624 - Resolves: RHEL-26265

Apr 8, 2024