Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

High max 7.5

ELSA-2024-0267 6 CVEs

Important: java-17-openjdk security and bug fix update (Oracle Linux 8)

[1:17.0.10.0.7-2.0.1] - Rebase to 17.0.10.0.7

Jan 22, 2024
High max 7.4

ELSA-2024-0248 5 CVEs

Important: java-21-openjdk security update (Oracle Linux 8)

[1:21.0.2.0.13-1.0.1] - Add Oracle vendor bug URL [1:21.0.2.0.13-1] - Rebase to 21.0.2.0.13

Jan 19, 2024
High max 7.4

ELSA-2024-0249 5 CVEs

Important: java-21-openjdk security update (Oracle Linux 9)

[1:21.0.2.0.13-1.0.1] - Add Oracle vendor bug URL [1:21.0.2.0.13-1] - Rebase to 21.0.2.0.13

Jan 19, 2024
High max 8.8

ELSA-2024-0279 1 CVE

Important: gstreamer-plugins-bad-free security update (Oracle Linux 7)

[0.10.23-24] - Patch CVE-2023-44446: MXF demuxer use-after-free - Disable gtk-doc to fix the build - Resolves: RHEL-16792

Jan 18, 2024
High max 5.9

ELSA-2024-12078 1 CVE

Important: python3.11-cryptography security update (Oracle Linux 8)

[37.0.2-5.0.1] - Fix CVE-2023-49083: NULL-dereference when loading PKCS7 certificates [Orabug: 36143834]

Jan 18, 2024
High max 5.9

ELSA-2024-12079 1 CVE

Important: python-cryptography security update (Oracle Linux 8)

[36.0.1-4.0.1] - Fix CVE-2023-49083: NULL-dereference when loading PKCS7 certificates [Orabug: 36119159] [36.0.1-4] - Fix FTBFS caused by rsa_pkcs1_implicit_rejection OpenSSL feature, resolves rhbz#2203840 [36.0.1-3] - Fix CVE-2023-23931: Don't allow update_i…

Jan 18, 2024
High max 7.4

ELSA-2024-0232 6 CVEs

Important: java-11-openjdk security update (Oracle Linux 7)

[1:11.0.22.0.7-1.0.1] - link atomic for ix86 build [1:11.0.22.0.7-1] - Update to jdk-11.0.22+7 (GA) - Update release notes to 11.0.22+7 - Switch to GA mode for release - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. ** - Resolves: RHEL-20966 [1:11.0…

Jan 17, 2024
High max 7.4

ELSA-2024-0223 6 CVEs

Important: java-1.8.0-openjdk security and bug fix update (Oracle Linux 7)

[1:1.8.0.402.b06-0.1.ea] - Update to shenandoah-jdk8u402-b06 (GA) - Update release notes for shenandoah-8u402-b06. - Drop local copy of JDK-8312489 which is now included upstream - Switch to GA mode. - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. *…

Jan 17, 2024
High max 9.1

ELSA-2024-0157 3 CVEs

Important: .NET 7.0 security update (Oracle Linux 8)

[7.0.115-1.0.1] - Add support for Oracle Linux - Update to .NET SDK 7.0.115 and Runtime 7.0.15

Jan 17, 2024
High max 9.1

ELSA-2024-0152 3 CVEs

Important: .NET 8.0 security update (Oracle Linux 9)

[8.0.101-1.0.1] - Update to .NET SDK 8.0.101 and Runtime 8.0.1

Jan 17, 2024
High max 9.1

ELSA-2024-0158 3 CVEs

Important: .NET 6.0 security update (Oracle Linux 8)

[6.0.126-1.0.1] - Add support for Oracle Linux [6.0.126-1] - Update to .NET SDK 6.0.126 and Runtime 6.0.26

Jan 16, 2024
Medium max 5.3

ELSA-2024-0256 1 CVE

Moderate: python3 security update (Oracle Linux 8)

[3.6.8-56.0.1.3] - Security fix for CVE-2023-27043 Resolves: rhbz#2196183

Jan 16, 2024
Medium max 5.5

ELSA-2024-0253 1 CVE

Moderate: sqlite security update (Oracle Linux 8)

[3.26.0-19.0.1] - Fixed CVE-2023-7104

Jan 16, 2024
High max 9.1

ELSA-2024-0151 3 CVEs

Important: .NET 7.0 security update (Oracle Linux 9)

[7.0.115-1.0.1] - Update to .NET SDK 7.0.115 and Runtime 7.0.15 [7.0.114-1.0.1] - Update to .NET SDK 7.0.114 and Runtime 7.0.14

Jan 16, 2024
Medium max 6.6

ELSA-2024-0143 2 CVEs

Moderate: idm:DL1 security update (Oracle Linux 8)

bind-dyndb-ldap custodia ipa [4.9.12-11.0.1] - Resolves: 2242828 Invalid CSRF protection (CVE-2023-5455) ipa-healthcheck opendnssec python-jwcrypto python-kdcproxy [0.4-5] - Always buffer TCP data in __handle_recv() - Resolves: #1747144 [0.4-4] - Correct addr…

Jan 12, 2024
Medium max 7.5

ELSA-2024-0130 4 CVEs

Moderate: frr security update (Oracle Linux 8)

[7.5.1-13.3] - Resolves: RHEL-15916 - Flowspec overflow in bgpd/bgp_flowspec.c - Resolves: RHEL-15919 - Out of bounds read in bgpd/bgp_label.c - Resolves: RHEL-15869 - crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message - Resolves: RHEL…

Jan 12, 2024
Medium max 6.0

ELSA-2024-0135 1 CVE

Moderate: virt:ol and virt-devel:ol security update (Oracle Linux 8)

hivex libguestfs libguestfs-winsupport libiscsi libnbd libtpms libvirt libvirt-dbus libvirt-python nbdkit netcf perl-Sys-Virt qemu-kvm [6.2.0-40.el8_9.2] - Resolves: RHEL-7309 (CVE-2023-3019 virt:rhel/qemu-kvm: QEMU: e1000e: heap use-after-free in e1000e_writ…

Jan 12, 2024
High max 9.1

ELSA-2024-0156 3 CVEs

Important: .NET 6.0 security update (Oracle Linux 9)

[6.0.126-1.0.1] - Add support for Oracle Linux [6.0.126-1] - Update to .NET SDK 6.0.126 and Runtime 6.0.26 [6.0.125-1] - Update to .NET SDK 6.0.125 and Runtime 6.0.25

Jan 12, 2024
Medium max 7.5

ELSA-2024-0133 2 CVEs

Moderate: fence-agents security update (Oracle Linux 8)

[4.2.1-121.2] - bundled urllib3: fix CVE-2023-43804 Resolves: RHEL-11988 - bundled certifi: fix CVE-2023-37920 Resolves: RHEL-6972

Jan 11, 2024
Medium max 8.8

ELSA-2024-0131 1 CVE

Moderate: pixman security update (Oracle Linux 8)

[0.38.4-3] - Security fix for CVE-2022-44638

Jan 11, 2024
High max 7.8

ELSA-2024-12069 3 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-513.11.1.0.1_9.OL8] - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-2162} - af_unix: Fix null-ptr-deref in unix_stream_sendpage() {CVE-2023-4622} - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for …

Jan 11, 2024
Medium max 5.9

ELSA-2024-0155 1 CVE

Moderate: gnutls security update (Oracle Linux 8)

[3.6.16-8] - timing side-channel in the RSA-PSK authentication (CVE-2023-5981)

Jan 11, 2024
Medium max 6.1

ELSA-2024-0125 4 CVEs

Moderate: tomcat security update (Oracle Linux 8)

[1:9.0.62-27.2] - Open Redirect vulnerability in FORM authentication (CVE-2023-41080) - FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794) - improper cleaning of recycled objects could lead to information leak (CVE-2023-42795) …

Jan 11, 2024
Medium max 7.5

ELSA-2024-0121 9 CVEs

Moderate: container-tools:4.0 security update (Oracle Linux 8)

buildah [1:1.24.6-7] - rebuild for CVE-2023-29406 - Related: #2176055 cockpit-podman [46-1] - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/46 - Related: #2061390 conmon [2:2.1.4-2] - update to https://github.com/containers/conmon/r…

Jan 11, 2024
Medium max 6.5

ELSA-2024-0141 1 CVE

Moderate: ipa security update (Oracle Linux 9)

[4.10.2-5.0.1] - Resolves: 2242828 Invalid CSRF protection (CVE-2023-5455)

Jan 11, 2024
Medium max 6.5

ELSA-2024-0145 1 CVE

Moderate: ipa security update (Oracle Linux 7)

[4.6.8-5.0.1] - Blank out header-logo.png product-name.png - Replace login-screen-logo.png [Orabug: 20362818] [4.6.8-5.el7_9.16] - Resolves: RHEL-12570 ipa: Invalid CSRF protection

Jan 10, 2024
Medium max 5.9

ELSA-2024-0116 2 CVEs

Moderate: python-urllib3 security update (Oracle Linux 8)

[1.24.2-5.0.1.2] - set RECENT_DATE to 01/30/2019 to make checks happy [Orabug: 30228991] [1.24.2-5.2] - Security fix for CVE-2023-45803 Resolves: rhbz#2246840 - Security fix for CVE-2023-43804 Resolves: rhbz#2242493

Jan 10, 2024
Medium

ELSA-2024-0119 1 CVE

Moderate: libxml2 security update (Oracle Linux 8)

[2.9.7-18] - Fix CVE-2023-39615 (RHEL-5179) [2.9.7-17] - Fix CVE-2023-28484 (#2186692) - Fix CVE-2023-29469 (#2186692)

Jan 10, 2024
Medium max 6.5

ELSA-2024-0105 1 CVE

Moderate: nss security update (Oracle Linux 8)

[3.90.0-4] - Fix expired certs in tests - Fix CVE-2023-5388

Jan 10, 2024
Medium

ELSA-2024-0114 2 CVEs

Moderate: python3 security update (Oracle Linux 8)

[3.6.8-56.0.1.2] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8-56.2] - Security fix for CVE-2022-48560 Resolves: rhbz#2249755 - Security fix for CVE-2022-48564 Resolves: rhbz#2249750

Jan 10, 2024
Medium max 6.5

ELSA-2024-0108 1 CVE

Moderate: nss security update (Oracle Linux 9)

[3.90.0-4] - CVE-2023-5388 nss: timing attack against RSA decryption. Make the final blinding multmod constant time.

Jan 10, 2024
High max 8.6

ELSA-2024-0071 4 CVEs

Important: squid security update (Oracle Linux 9)

[7:5.5-6.0.1.el9_3.5] - squid: Denial of Service in SSL Certificate validation (CVE-2023-46724) - squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728) - squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285) - …

Jan 10, 2024
High max 8.6

ELSA-2024-0046 4 CVEs

Important: squid:4 security update (Oracle Linux 8)

libecap squid [7:4.15-7.5] - Fix squid: Denial of Service in SSL Certificate validation (CVE-2023-46724) - Fix squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728) - Fix squid: Buffer over-read in the HTTP Message processing feature (C…

Jan 4, 2024
High max 7.8

ELSA-2024-0018 2 CVEs

Important: tigervnc security update (Oracle Linux 8)

[1.13.1-2.4] - xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty (CVE-2023-5367) - xorg-x11-server: Use-after-free bug in DestroyWindow (CVE-2023-5380) - xorg-x11-server: out-of-bounds memory reads/writes in XKB button acti…

Jan 4, 2024
High max 8.8

ELSA-2024-0003 11 CVEs

Important: thunderbird security update (Oracle Linux 8)

[115.6.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [115.6.0-1] - Update to 115.6.0 build2

Jan 3, 2024
High max 8.8

ELSA-2024-0012 11 CVEs

Important: firefox security update (Oracle Linux 8)

[115.6.0-1.0.1] - Update to 115.6.0 build1 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

Jan 3, 2024
High max 7.8

ELSA-2024-0010 3 CVEs

Important: tigervnc security update (Oracle Linux 9)

[1.13.1-3.3] - xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty (CVE-2023-5367) - xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions (CVE-2023-6377) - xorg-x11-server: out-of-bounds memory read in RRC…

Jan 3, 2024
High max 8.8

ELSA-2024-0025 11 CVEs

Important: firefox security update (Oracle Linux 9)

[115.6.0-1.0.1] - Udate to 115.6.0 build1 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

Jan 3, 2024
High max 8.8

ELSA-2024-0001 11 CVEs

Important: thunderbird security update (Oracle Linux 9)

[115.6.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Update to 115.6.0 build2

Jan 3, 2024
High max 7.8

ELSA-2024-0006 2 CVEs

Important: tigervnc security update (Oracle Linux 7)

[1.8.0-28.0.1] - Dropped xorg-CVE-2023-5367.patch, xorg-CVE-2023-6377.patch, and xorg-CVE-2023-6478.patch [1.8.0-28] - Updated fix for CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions Resolves: RHEL-18415 [1.8.0…

Jan 2, 2024