Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

  • High max 7.8
    ELSA-2024-12154 5 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

    [5.4.17-2136.328.3.el8] - IB/cm: Cancel mad on the DREQ event when the state is MRA_REP_RCVD (Mark Zhang) [Orabug: 36143228] - KSPLICE: make sure the stack is zeroed. (Gregory Herrero) [Orabug: 36154654] - sched/fair: Fix tg->load when offlining a CPU (Vincen…

  • Medium
    ELSA-2024-0768 1 CVE

    Moderate: libmaxminddb security update (Oracle Linux 8)

    [1.2.0-10.1] - Resolves: RHEL-20594 - improper initialization in dump_entry_data_list() in maxminddb.c

  • Medium max 6.0
    ELSA-2024-12152 3 CVEs

    Moderate: virt:kvm_utils1 security update (Oracle Linux 8)

    hivex libguestfs libguestfs-winsupport libiscsi libnbd libvirt [5.7.0-41] - qemu_monitor: Add defensive protection on mon->msg (Wim ten Have) [Orabug: 35699260] - vircpi: Add PCIe 5.0 and 6.0 link speeds (Michal Privoznik) [Orabug: 35496776] - qemuProcessSetu…

  • High max 7.8
    ELSA-2024-12151 5 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.328.3] - IB/cm: Cancel mad on the DREQ event when the state is MRA_REP_RCVD (Mark Zhang) [Orabug: 36143228] - KSPLICE: make sure the stack is zeroed. (Gregory Herrero) [Orabug: 36154654] - sched/fair: Fix tg->load when offlining a CPU (Vincent Gu…

  • High max 8.6
    ELSA-2024-17931 1 CVE

    Important: runc security update (Oracle Linux 7)

    [1.1.12-1] - Update runc to 1.1.12 [JIRA: OLDIS-30530] [1.1.10-1] - Update runc to 1.1.10 [JIRA: OLDIS-30530]

  • High max 8.6
    ELSA-2024-12148 1 CVE

    Important: runc security update (Oracle Linux 7)

    [1.1.12-1] - Update runc to 1.1.12 [JIRA: OLDIS-30530] [1.1.10-1] - Update runc to 1.1.10 [JIRA: OLDIS-30530]

  • High max 7.8
    ELSA-2024-12149 2 CVEs

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-362.18.0.2] - net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623} - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve {CVE-2023-4623} - dpll: core: Add DPLL framework base functions {CVE-2023-6679} - dpll: sp…

  • High max 7.8
    ELSA-2024-0675 4 CVEs

    Important: gimp security update (Oracle Linux 9)

    [2:2.99.8-4] - fix CVE-2023-44441 - fix CVE-2023-44442 - fix CVE-2023-44443 - fix CVE-2023-44444

  • Medium max 7.5
    ELSA-2024-12135 1 CVE

    Moderate: gnutls security update (Oracle Linux 8)

    [3.6.16-8.1_fips] - Allow RSA keygen with modulus sizes bigger than 3072 bits and validate the seed length as defined in FIPS 186-4 section B.3.2 [Orabug: 33200526] - Allow bigger known RSA modulus sizes when calling rsa_generate_fips186_4_keypair directly [O…

  • High max 8.6
    ELSA-2024-0670 1 CVE

    Important: runc security update (Oracle Linux 9)

    [4:1.1.12-1] - update to https://github.com/opencontainers/runc/releases/tag/v1.1.12 - Related: RHEL-2112 [4:1.1.11-1] - update to https://github.com/opencontainers/runc/releases/tag/v1.1.11 - Related: RHEL-2112 [4:1.1.10-3] - Rebuild for CVEs: CVE-2023-39321…

  • Medium max 7.5
    ELSA-2024-0627 1 CVE

    Moderate: gnutls security update (Oracle Linux 8)

    [3.6.16-8.1] - auth/rsa-psk: minimize branching after decryption (RHEL-21550)

  • Medium
    ELSA-2024-0647 3 CVEs

    Moderate: rpm security update (Oracle Linux 8)

    [4.14.3-28.0.2] - Import additional patches to fix regressions with CVE-2021-35937, CVE-2021-35938 and CVE-2021-35939 patchset [Orabug: 36256318] [4.14.3-28.0.1] - Fixed infinte loop for db_create with error check [Orabug: 36202920] [4.14.3-28] - Backport fil…

  • High max 7.8
    ELSA-2024-12110 5 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.82.2] - Bluetooth: Reject connection with the device which has same BD_ADDR (Lee, Chun-Yi) [Orabug: 35959598] {CVE-2020-26555} - sched/rt: pick_next_rt_entity(): check list_entry (Pietro Borrello) [Orabug: 35181560] {CVE-2023-1077} - sched/debug: …

  • High max 9.8
    ELSA-2024-0629 4 CVEs

    Important: tigervnc security update (Oracle Linux 7)

    [1.8.0-31.0.1] - Dropped xorg-CVE-2023-5367.patch, xorg-CVE-2023-6816.patch, xorg-CVE-2023-6377.patch, xorg-CVE-2023-6478.patch, xorg-CVE-2024-0229-1.patch, xorg-CVE-2024-0229-2.patch, xorg-CVE-2024-0229-3.patch, xorg-CVE-2024-21885.patch, xorg-CVE-2024-21886…

  • Medium max 5.9
    ELSA-2024-0628 1 CVE

    Moderate: libssh security update (Oracle Linux 8)

    [0.9.6-13] - Client and Server side mitigations (CVE-2023-48795) - Strip extensions from both kex lists for matching (CVE-2023-48795) - tests: Adjust calculation to strict kex (CVE-2023-48795)

  • High max 8.8
    ELSA-2024-0609 9 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [115.7.0-1.0.1] - Update to 115.7.0 build1

  • High max 8.8
    ELSA-2024-0608 9 CVEs

    Important: firefox security update (Oracle Linux 8)

    [115.7.0.1.0.1] - Update to 115.7.0 build 1

  • High max 9.8
    ELSA-2024-0607 4 CVEs

    Important: tigervnc security update (Oracle Linux 8)

    [1.13.1-2.7] - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice Resolves: RHEL-20388 - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent Resolves: RHEL-20382 - Fix CVE-2024-0229…

  • High max 9.8
    ELSA-2024-0557 4 CVEs

    Important: tigervnc security update (Oracle Linux 9)

    [1.13.1-3.6] - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice Resolves: RHEL-20389 - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent Resolves: RHEL-20383 - Fix CVE-2024-0229…

  • High max 8.8
    ELSA-2024-0602 9 CVEs

    Important: thunderbird security update (Oracle Linux 9)

    [115.7.0-1.0.1] - Update to 115.7.0 build1

  • High max 8.8
    ELSA-2024-0600 9 CVEs

    Important: firefox security update (Oracle Linux 7)

    [115.7.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [115.7.0-1] - Update to 115.7.0 build1

  • High max 8.8
    ELSA-2024-0601 9 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [115.7.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [115.7.0-1] - Update to 115.7.0 build1 [115.6.0-1] - Update to 115.6.0 build2

  • High max 8.8
    ELSA-2024-0603 9 CVEs

    Important: firefox security update (Oracle Linux 9)

    [115.7.0.1.0.1] - Update to 115.7.0 build 1

  • Medium max 7.5
    ELSA-2024-0533 3 CVEs

    Moderate: gnutls security update (Oracle Linux 9)

    [3.7.6-23.3] - Fixes for CVE-2023-5981, CVE-2024-0553, CVE-2024-0567

  • High max 7.5
    ELSA-2024-0539 1 CVE

    Important: tomcat security update (Oracle Linux 8)

    [1:9.0.62-27.3] - tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)

  • High max 8.8
    ELSA-2024-12094 13 CVEs

    Important: kernel security update (Oracle Linux 9)

    - [5.14.0-362.18.0.1_3.OL9] - nfp: fix use-after-free in area_cache_get() (Jialiang Wang) {CVE-2022-3545} - drivers: net: slip: fix NPD bug in sl_tx_timeout() (Duoming Zhou) {CVE-2022-41858} - can: af_can: fix NULL pointer dereference in can_rcv_filter (Olive…

  • Medium max 7.5
    ELSA-2024-0477 4 CVEs

    Moderate: frr security update (Oracle Linux 9)

    [8.3.1-11.2] - Add patches for CVE-2023-47235, CVE-2023-47234, CVE-2023-38406, CVE-2023-38407

  • Medium max 6.1
    ELSA-2024-0474 4 CVEs

    Moderate: tomcat security update (Oracle Linux 9)

    [1:9.0.62-37.el9_3.1] - Resolves: #2235370 CVE-2023-41080 tomcat: Open Redirect vulnerability in FORM authentication - Resolves: #2243749 CVE-2023-45648 tomcat: incorrectly parsed http trailer headers can cause request smuggling - Resolves: #2243751 CVE-2023-…

  • Medium max 9.4
    ELSA-2024-0387 6 CVEs

    Moderate: php:8.1 security update (Oracle Linux 9)

    php [8.1.27-1] - rebase to 8.1.27 RHEL-19093 [8.1.14-1] - rebase to 8.1.14 [8.1.8-1] - update to 8.1.8 #2070040 [8.1.7-2] - clean unneeded dependency on useradd command [8.1.7-1] - update to 8.1.7 #2070040 [8.1.6-2] - add upstream patch to initialize pcre bef…

  • Medium max 6.8
    ELSA-2024-0468 1 CVE

    Moderate: grub2 security update (Oracle Linux 9)

    [2.06-70.0.2.2] - search command: add flag to only search root dev - Resolves: #CVE-2023-4001

  • Medium max 5.9
    ELSA-2024-0464 2 CVEs

    Moderate: python-urllib3 security update (Oracle Linux 9)

    [1.26.5-3.0.1.1] - Security fix for CVE-2023-45803 Resolves: RHEL-16874 - Security fix for CVE-2023-43804 Resolves: RHEL-12001

  • Medium max 5.3
    ELSA-2024-0466 1 CVE

    Moderate: python3.9 security update (Oracle Linux 9)

    [3.9.18-1.1] - Security fix for CVE-2023-27043 Resolves: RHEL-20613

  • Medium
    ELSA-2024-0463 3 CVEs

    Moderate: rpm security update (Oracle Linux 9)

    [4.16.1.3-27] - TOCTOU race in checks for unsafe symlinks (CVE-2021-35937) - races with chown/chmod/capabilities calls during installation (CVE-2021-35938) - checks for unsafe symlinks are not performed for intermediary directories (CVE-2021-35939)

  • Medium max 5.5
    ELSA-2024-0465 1 CVE

    Moderate: sqlite security update (Oracle Linux 9)

    [3.34.1-7] - Fixes CVE-2023-7104

  • Medium max 7.5
    ELSA-2024-0345 1 CVE

    Moderate: python-pillow security update (Oracle Linux 7)

    [2.0.0-24gitd1c6db8] - Security fix for CVE-2023-44271 Resolves: RHEL-15459

  • Medium max 7.8
    ELSA-2024-0343 1 CVE

    Moderate: LibRaw security update (Oracle Linux 7)

    [0.19.4-2] - Fix CVE-2021-32142 - Resolves: RHEL-9524

  • High max 7.4
    ELSA-2024-0266 6 CVEs

    Important: java-11-openjdk security update (Oracle Linux 8)

    [1:11.0.22.0.7-2.0.1] - Update to openjdk-11.0.22+7

  • High max 7.4
    ELSA-2024-0265 6 CVEs

    Important: java-1.8.0-openjdk security and bug fix update (Oracle Linux 8)

    [1:1.8.0.402.b06-0.2.0.1] - Update to shenandoah-jdk8u402-b06 (GA) - Update release notes for shenandoah-8u402-b06. - Add Oracle vendor bug URL [Orabug: 34340155]

  • High max 9.8
    ELSA-2024-0320 6 CVEs

    Important: xorg-x11-server security update (Oracle Linux 7)

    [1.20.4-27] - Fix use after free related to CVE-2024-21886 [1.20.4-26] - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886, CVE-2024-0408 and CVE-2024-0409 Resolves: https://issues.redhat.com/browse/RHEL-21205 Resolves: https://issues.…

  • Medium max 7.5
    ELSA-2024-0310 1 CVE

    Moderate: openssl security update (Oracle Linux 9)

    [1:3.0.7-25.0.1] - Replace upstream references [Orabug: 34340177] [1:3.0.7-25] - Provide relevant diagnostics when FIPS checksum is corrupted Resolves: RHEL-5317 - Don't limit using SHA1 in KDFs in non-FIPS mode. Resolves: RHEL-5295 - Provide empty evp_proper…