Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

  • Medium max 7.5
    ELSA-2024-1615 1 CVE

    Moderate: expat security update (Oracle Linux 8)

    [2.2.5-11.0.1.1] - lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910314] [2.2.5-11.1] - CVE-2023-52425 expat: parsing large tokens can trigger a denial of service - Resolves: RHEL-29321

  • Medium max 6.5
    ELSA-2024-1601 3 CVEs

    Moderate: curl security and bug fix update (Oracle Linux 8)

    [7.61.1-33.5] - cap SFTP packet size sent (RHEL-5485) - when keyboard-interactive auth fails, try password (#2229800) - unify the upload/method handling (CVE-2023-28322) - fix cookie injection with none file (CVE-2023-38546) - lowercase the domain names befor…

  • Medium max 5.9
    ELSA-2024-1608 1 CVE

    Moderate: opencryptoki security update (Oracle Linux 8)

    [3.21.0-10] - timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin) Resolves: RHEL-22791

  • Medium max 7.8
    ELSA-2024-1610 1 CVE

    Moderate: less security update (Oracle Linux 8)

    [530-2] - Fix CVE-2022-48624 - Resolves: RHEL-26265

  • High max 7.8
    ELSA-2024-12266 1 CVE 1 exploited

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-513.18.1.0.1_9.OL8] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters [Orabug: 36461932] {CVE-2024-1086} [4.18.0-513.18.1_9.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHC…

  • High max 7.5
    ELSA-2024-1644 1 CVE

    Important: grafana-pcp security and bug fix update (Oracle Linux 8)

    [5.1.1-2] - Rebuild with latest version of golang - resolves CVE-2024-1394

  • High max 7.5
    ELSA-2024-1646 1 CVE

    Important: grafana security and bug fix update (Oracle Linux 8)

    [9.2.10-8] - Rebuild with latest version of golang - resolves CVE-2024-1394

  • High max 7.8
    ELSA-2024-12265 1 CVE 1 exploited

    Important: kernel security update (Oracle Linux 9)

    - [5.14.0-362.24.1.0.1_3.OL9] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters [Orabug: 36461940 ] {CVE-2024-1086} - [5.14.0-362.24.1_3.OL9] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linu…

  • High max 7.8
    ELSA-2024-12257 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.14.35-2047.534.3.1] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36251145] {CVE-2024-1086}

  • High max 7.8
    ELSA-2024-12259 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [5.4.17-2136.329.3.2.el7] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36465920] {CVE-2024-1086}

  • High
    ELSA-2024-12263 1 CVE

    Important: olcne security update (Oracle Linux 8)

    [1.8.1-2] - Cleanup spec file [1.8.1-1] - Fix OLM upgrade failure - upgrade from 0.17.0 to 0.23.1 failed due to a couple of crds missing - Add hostpathRequiresPrivilged value to rook template cr to be passed to module operator - Fixed Istio-1.18 and Istio-1.1…

  • High
    ELSA-2024-12264 1 CVE

    Important: olcne security update (Oracle Linux 8)

    [1.8.1-2] - Cleanup spec file [1.8.1-1] - Fix OLM upgrade failure - upgrade from 0.17.0 to 0.23.1 failed due to a couple of crds missing - Add hostpathRequiresPrivilged value to rook template cr to be passed to module operator - Fixed Istio-1.18 and Istio-1.1…

  • High max 7.8
    ELSA-2024-12260 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

    [5.4.17-2136.329.3.2.el8] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36465920] {CVE-2024-1086}

  • High
    ELSA-2024-12261 1 CVE

    Important: olcne security update (Oracle Linux 9)

    [1.8.1-2] - Cleanup spec file [1.8.1-1] - Fix OLM upgrade failure - upgrade from 0.17.0 to 0.23.1 failed due to a couple of crds missing - Add hostpathRequiresPrivilged value to rook template cr to be passed to module operator - Fixed Istio-1.18 and Istio-1.1…

  • Medium max 8.8
    ELSA-2024-1576 4 CVEs

    Moderate: ruby:3.1 security, bug fix, and enhancement update (Oracle Linux 9)

    ruby [3.1.4-143] - Upgrade to Ruby 3.1.4. Resolves: RHEL-5586 - Fix HTTP response splitting in CGI. Resolves: RHEL-5591 - Fix ReDos vulnerability in URI. Resolves: RHEL-28919 Resolves: RHEL-5612 - Fix ReDos vulnerability in Time. Resolves: RHEL-28920 - Make R…

  • High
    ELSA-2024-12262 1 CVE

    Important: olcne security update (Oracle Linux 9)

    [1.8.1-2] - Cleanup spec file [1.8.1-1] - Fix OLM upgrade failure - upgrade from 0.17.0 to 0.23.1 failed due to a couple of crds missing - Add hostpathRequiresPrivilged value to rook template cr to be passed to module operator - Fixed Istio-1.18 and Istio-1.1…

  • High max 7.8
    ELSA-2024-12258 3 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.84.2] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36251327] {CVE-2024-1086} [4.1.12-124.84.1] - mm: avoid conflict between MADV_DOEXEC and upstream advice values (Anthony Yznaga) [Orabug: 36334311] - ko…

  • High max 7.8
    ELSA-2024-12256 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.329.3.2] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36465920] {CVE-2024-1086}

  • High max 7.8
    ELSA-2024-12255 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-204.147.6.3] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36464807] {CVE-2024-1086}

  • High max 8.3
    ELSA-2024-1514 2 CVEs

    Important: libreoffice security fix update (Oracle Linux 8)

    [6.4.7.2-16.0.1] - Replace colors with Oracle colors [Orabug: 32120093] - Build with --with-vendor='Oracle America, Inc.' - Added the --with-hamcrest option to configure. [1:6.4.7.2-16] - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 ch…

  • Critical max 8.8
    ELSA-2024-1486 10 CVEs

    Critical: firefox security update (Oracle Linux 7)

    [115.9.1-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [115.9.1-1] - Update to 115.9.1 [115.9.0-2] - Update to 1…

  • Critical max 8.8
    ELSA-2024-1484 10 CVEs

    Critical: firefox security update (Oracle Linux 8)

    [115.9.1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding OpenELA file [115.9.1] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [115.9.1-1] - Update to 115.9.1 [115.9.0-2] - Update to 115.9.0 bui…

  • High max 7.5
    ELSA-2024-1510 3 CVEs

    Important: nodejs:18 security update (Oracle Linux 8)

    nodejs [1:18.19.1-1] - Rebase to version 18.19.1 - Fixes: CVE-2024-21892 CVE-2024-22019 (high) - Fixes: CVE-2023-46809 (medium) nodejs-nodemon nodejs-packaging

  • Medium max 8.8
    ELSA-2024-1494 9 CVEs

    Moderate: thunderbird security update (Oracle Linux 8)

    [115.9.0-1.0.1] - Add Oracle prefs [115.9.0-1] - Update to 115.9.0 build1 - Fix expat CVE-2023-52425

  • Medium max 7.5
    ELSA-2024-1530 2 CVEs

    Moderate: expat security update (Oracle Linux 9)

    [2.5.0-1.1] - CVE-2023-52425: Fix parsing of large tokens - CVE-2024-28757: Reject direct parameter entity recursion - Resolves: RHEL-29698 - Resolves: RHEL-29695

  • Critical max 8.8
    ELSA-2024-1485 10 CVEs

    Critical: firefox security update (Oracle Linux 9)

    [115.9.1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding OpenELA file [115.9.1] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [115.9.1-1] - Update to 115.9.1 [115.9.0-2] - Update to 115.9.0 bui…

  • High max 7.5
    ELSA-2024-1503 3 CVEs

    Important: nodejs:18 security update (Oracle Linux 9)

    nodejs [1:18.19.1-1] - Rebase to version 18.19.1 - Fixes: CVE-2024-21892 CVE-2024-22019 (high) - Fixes: CVE-2023-46809 (medium) nodejs-nodemon nodejs-packaging

  • Medium max 8.8
    ELSA-2024-1493 9 CVEs

    Moderate: thunderbird security update (Oracle Linux 9)

    [115.9.0-1.0.1] - Add Oracle prefs [115.9.0-1] - Update to 115.9.0 build1 - Fix expat CVE-2023-52425

  • High max 7.5
    ELSA-2024-1501 1 CVE

    Important: grafana security update (Oracle Linux 9)

    [9.2.10-8] - Rebuild with latest version of golang - resolve RHEL-24313

  • High max 7.5
    ELSA-2024-1502 1 CVE

    Important: grafana-pcp security update (Oracle Linux 9)

    [5.1.1-2] - Rebuild with latest version of golang - resolves CVE-CVE-2024-1394

  • Medium max 8.8
    ELSA-2024-1498 9 CVEs

    Moderate: thunderbird security update (Oracle Linux 7)

    [115.9.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [115.9.0-1] - Update to 115.9.0 build1 - Fix expat CVE-2023-52425

  • High max 7.5
    ELSA-2024-1472 1 CVE

    Important: go-toolset:ol8 security update (Oracle Linux 8)

    delve [1.20.2-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.20.2-1] - Rebase to 1.20.2 - Resolves: rhbz#2186495 golang [1.20.12-3] - Fix CVE-2024-1394 - Resolves: RHEL-27928 [1.20.12-2] - Fix sources file - Related: RHEL-19231 go-too…

  • High max 7.5
    ELSA-2024-1444 2 CVEs 1 exploited

    Important: nodejs:16 security update (Oracle Linux 8)

    nodejs [1:16.20.2-4.0.1] - reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks Resolves: CVE-2024-22019 nodejs-nodemon nodejs-packaging [26-1] - nodejs.prov: find namespaced bundled dependencies - Apply https://src.fedoraproject…

  • High max 8.6
    ELSA-2024-1375 3 CVEs

    Important: squid:4 security update (Oracle Linux 8)

    libecap squid [7:4.15-7.10] - Resolves: RHEL-19551 - squid:4/squid: denial of service in HTTP request parsing (CVE-2023-50269) [7:4.15-7.9] - Resolves: RHEL-28611 - squid:4/squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111) [7:4.15-7.6] - Reso…

  • High max 7.5
    ELSA-2024-1438 1 CVE

    Important: nodejs security update (Oracle Linux 9)

    [1:16.20.2-4.0.1] - reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks Resolves: CVE-2024-22019

  • High max 7.5
    ELSA-2024-1462 1 CVE

    Important: golang security update (Oracle Linux 9)

    [1.20.12-2] - Fix CVE-2024-1394 - Resolves: RHEL-27189

  • High max 8.0
    ELSA-2024-1249 6 CVEs 1 exploited

    Important: kernel security and bug fix update (Oracle Linux 7)

    [3.10.0-1160.114.2.0.1.OL7] - debug: lock down kgdb [Orabug: 34270798] {CVE-2022-21499} [3.10.0-1160.114.2.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.p…

  • Medium max 5.9
    ELSA-2024-12234 1 CVE

    Moderate: python-cryptography security update (Oracle Linux 7)

    [3.2.1-1.0.1] - Fix CVE-2023-49083: NULL-dereference when loading PKCS7 certificates [Orabug: 36143838]

  • Medium max 5.9
    ELSA-2024-19480 1 CVE

    Moderate: python-cryptography security update (Oracle Linux 7)

    [3.2.1-1.0.1] - Fix CVE-2023-49083: NULL-dereference when loading PKCS7 certificates [Orabug: 36143838]

  • Medium max 8.8
    ELSA-2024-1431 4 CVEs

    Moderate: ruby:3.1 security, bug fix, and enhancement update (Oracle Linux 8)

    ruby [3.1.4-142] - Upgrade to Ruby 3.1.4. Resolves: RHEL-28565 - Fix HTTP response splitting in CGI. Resolves: RHEL-28564 - Fix ReDos vulnerability in URI. Resolves: RHEL-28567 Resolves: RHEL-28576 - Fix ReDos vulnerability in Time. Resolves: RHEL-28566 - Mak…