Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

High max 8.8

ELSA-2024-0013 1 CVE

Important: gstreamer1-plugins-bad-free security update (Oracle Linux 7)

[1.10.4-4] - Patch CVE-2023-44446: MXF demuxer use-after-free - Disable gtk-doc to fix build - Resolves: RHEL-16793

Jan 2, 2024
High max 8.8

ELSA-2024-0026 11 CVEs

Important: firefox security update (Oracle Linux 7)

[115.6.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [115.6.0-1] - Update to 115.6.0 build1

Jan 2, 2024
High max 7.8

ELSA-2024-0009 2 CVEs

Important: xorg-x11-server security update (Oracle Linux 7)

[1.20.4-25] - CVE fix for: CVE-2023-6377, CVE-2023-6478 Resolves: https://issues.redhat.com/browse/RHEL-18416 Resolves: https://issues.redhat.com/browse/RHEL-18428

Jan 2, 2024
High max 8.8

ELSA-2024-0027 11 CVEs

Important: thunderbird security update (Oracle Linux 7)

[115.6.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [115.6.0-1] - Update to 115.6.0 build2

Jan 2, 2024
High max 7.8

ELSA-2023-7749 4 CVEs

Important: kernel security update (Oracle Linux 9)

[5.14.0-362.13.1.el9_3.OL9] - x86/retpoline: Document some thunk handling aspects (Borislav Petkov) {CVE-2023-20569} - objtool: Fix return thunk patching in retpolines (Josh Poimboeuf) {CVE-2023-20569} - x86/srso: Remove unnecessary semicolon (Yang Li) {CVE-2…

Dec 22, 2023
High max 8.8

ELSA-2023-7884 5 CVEs

Important: postgresql:15 security update (Oracle Linux 8)

pgaudit [1.7.0-1] - Update to 1.7.0 - Support postgresql 15 - Related: #2128241 [1.5.0-1] - Update to version 1.5.0 Related: #1855776 pg_repack [1.4.8-1] - Update to version 1.4.8 - Postgresql 15 is supported - Related: #2128241 [1.4.6-4] - Rebuilt for IMA si…

Dec 20, 2023
High max 8.8

ELSA-2023-7790 1 CVE

Important: postgresql:10 security update (Oracle Linux 8)

[10.23-3.0.1] - Resolves: CVE-2023-5869

Dec 19, 2023
High max 7.8

ELSA-2023-5455 4 CVEs 1 exploited

Important: glibc security update (Oracle Linux 8)

[2.28-225.0.4.6] - CVE-2023-4527: Stack read overflow in getaddrinfo in no-aaa mode. - CVE-2023-4806: potential use-after-free in getaddrinfo. - CVE-2023-4813: potential use-after-free in gaih_inet (RHEL-2435). - CVE-2023-4813: work around RHEL-8 limitation i…

Dec 19, 2023
High max 8.8

ELSA-2023-7841 1 CVE

Important: gstreamer1-plugins-bad-free security update (Oracle Linux 8)

[1.16.1-2] - Resolves MXF demuxer use-after-free vulnerability (CVE-2023-44446)

Dec 19, 2023
High max 7.5

ELSA-2023-13054 2 CVEs 1 exploited

Important: conmon security update (Oracle Linux 8)

conmon [2.1.3-7] - Resolve CVE-2023-39325 [2.1.3-6] - Add ol8_baseos_latest, and ol9_baseos_latest, to Jenkinsfile [2.1.3-5] - Add systemd-devel as build requirement [2.1.3-4] - Add support ARM build cri-o [1.26.3-3] - Resolve CVE-2023-39325 [1.26.3-2] - Add …

Dec 19, 2023
Medium max 6.6

ELSA-2023-7879 3 CVEs

Moderate: opensc security update (Oracle Linux 9)

[0.23.0-3] - Fix file caching with different offsets (RHEL-4079) - Fix CVE-2023-40660: Potential PIN bypass - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init - Fix CVE-2023-4535: Out-of-bounds read in MyEID driver handling encryption using symmetr…

Dec 19, 2023
High max 7.5

ELSA-2023-13053 2 CVEs 1 exploited

Important: conmon security update (Oracle Linux 9)

conmon [2.1.3-7] - Resolve CVE-2023-39325 [2.1.3-6] - Add ol8_baseos_latest, and ol9_baseos_latest, to Jenkinsfile [2.1.3-5] - Add systemd-devel as build requirement [2.1.3-4] - Add support ARM build cri-o [1.26.3-3] - Resolve CVE-2023-39325 [1.26.3-2] - Add …

Dec 19, 2023
Medium max 6.6

ELSA-2023-7876 2 CVEs

Moderate: opensc security update (Oracle Linux 8)

[0.20.0-7] - Fix file caching with different offsets (RHEL-4077) - Fix CVE-2023-40660: Potential PIN bypass - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init - Fix CVE-2023-5992: Marvin: Side-channel leaks while stripping encryption PKCS#1.5 paddi…

Dec 18, 2023
High max 8.8

ELSA-2023-7714 4 CVEs

Important: postgresql:12 security update (Oracle Linux 8)

pgaudit pg_repack postgres-decoderbufs postgresql

Dec 18, 2023
Low max 5.3

ELSA-2023-7877 3 CVEs

Low: openssl security update (Oracle Linux 8)

[1:1.1.1k-12] - Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series (a proper fix for CVE-2020-25659) Resolves: RHEL-17696 [1:1.1.1k-11] - Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking excessively long X9.42 D…

Dec 18, 2023
Medium max 7.5

ELSA-2023-7753 2 CVEs

Moderate: fence-agents security update (Oracle Linux 9)

[4.10.0-55.2] - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920) - python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

Dec 18, 2023
Medium max 6.2

ELSA-2023-7836 6 CVEs

Moderate: avahi security update (Oracle Linux 8)

[0.7-21.1] - Fix CVE-2021-3468 (#1939614) - Fix CVE-2023-38469 (#2191687) - Fix CVE-2023-38470 (#2191694) - Fix CVE-2023-38471 (#2191690) - Fix CVE-2023-38472 (#2191692) - Fix CVE-2023-38473 (#2191691)

Dec 15, 2023
High max 8.8

ELSA-2023-7784 4 CVEs

Important: postgresql security update (Oracle Linux 9)

[13.13-1.0.1] - Update to 13.13 - Fixes CVE-2023-5868, CVE-2023-5869, CVE-2023-5870, and CVE-2023-39417

Dec 15, 2023
High max 8.8

ELSA-2023-7791 2 CVEs

Important: gstreamer1-plugins-bad-free security update (Oracle Linux 9)

[1.22.1-2] - Patch CVE-2023-44429: AV1 codec parser heap-based buffer overflow - Patch CVE-2023-44446: MXF demuxer use-after-free - Resolves: RHEL-17030, RHEL-17039

Dec 15, 2023
High max 8.8

ELSA-2023-13048 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.326.6.el7] - Revert 'md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d' (Junxiao Bi) [Orabug: 35914789] - md: bypass block throttle for superblock update (Junxiao Bi) [Orabug: 35914789] [5.4.17-2136.326.5.el7] - Revert 'tracing: Increase trace ar…

Dec 14, 2023
High max 8.8

ELSA-2023-13049 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

[5.4.17-2136.326.6.el8] - Revert 'md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d' (Junxiao Bi) [Orabug: 35914789] - md: bypass block throttle for superblock update (Junxiao Bi) [Orabug: 35914789] [5.4.17-2136.326.5.el8] - Revert 'tracing: Increase trace ar…

Dec 14, 2023
High max 7.8

ELSA-2023-13047 3 CVEs

Important: kernel security update (Oracle Linux 9)

- [5.14.0-362.13.0.1_3.OL9] - cifs: Fix UAF in cifs_demultiplex_thread() (Zhang Xiaoxu) (Steve French) {CVE-2023-1192} - fs/smb/client: Reset password pointer to NULL (Quang Le) (Steve French) {CVE-2023-5345} - igb: set max size RX buffer when store bad packe…

Dec 14, 2023
Medium

ELSA-2023-7765 5 CVEs

Moderate: podman security update (Oracle Linux 9)

[2:4.6.1-7.0.1] - Rebuild for following CVEs: CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-29409 - Resolves: #2228743 - Resolves: #2237773 - Resolves: #2237776 - Resolves: #2237777 - Resolves: #2237778 [2:4.6.1-6.0.1] - Drop nmap-ncat …

Dec 14, 2023
Medium

ELSA-2023-7763 3 CVEs

Moderate: runc security update (Oracle Linux 9)

[4:1.1.9-2] - Rebuild for CVEs: CVE-2023-39321 CVE-2023-39322 CVE-2023-29409 - Resolves: #2228743 - Resolves: #2237777 - Resolves: #2237778

Dec 14, 2023
Medium

ELSA-2023-7764 5 CVEs

Moderate: buildah security update (Oracle Linux 9)

[1.31.3-2.0.1] - Rebuild for CVEs: CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-29409

Dec 14, 2023
High max 8.8

ELSA-2023-7783 1 CVE

Important: postgresql security update (Oracle Linux 7)

[9.2.24-9] - Backport fix for CVE-2023-5869

Dec 13, 2023
High max 8.8

ELSA-2023-7716 1 CVE 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.40.5-1.1] - Add patch for CVE-2023-42917 Resolves: rhbz#2253058

Dec 13, 2023
High max 8.8

ELSA-2023-13044 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.326.6] - Revert 'md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d' (Junxiao Bi) [Orabug: 35914789] - md: bypass block throttle for superblock update (Junxiao Bi) [Orabug: 35914789] [5.4.17-2136.326.5] - Revert 'tracing: Increase trace array ref …

Dec 13, 2023
High max 7.5

ELSA-2023-7732 1 CVE

Important: tracker-miners security update (Oracle Linux 8)

[2.1.5-2.1] - Bump dist [2.1.5-2] - Backport stricter seccomp jail Resolves: RHEL-12466

Dec 13, 2023
High max 8.8

ELSA-2023-7785 5 CVEs

Important: postgresql:15 security update (Oracle Linux 9)

pgaudit pg_repack postgres-decoderbufs postgresql [15.5-1] - update to 15.5 - Fixes CVE-2023-5868, CVE-2023-5869, CVE-2023-5870, CVE-2023-39417, and CVE-2023-39418 Resolves: RHEL-16100, RHEL-16124, RHEL-16139

Dec 13, 2023
Medium

ELSA-2023-7747 1 CVE

Moderate: libxml2 security update (Oracle Linux 9)

[2.9.13-5] - Fix CVE-2023-39615 (RHEL-5180)

Dec 13, 2023
High max 8.8

ELSA-2023-7715 1 CVE 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.40.5-1.1] - Add patch for CVE-2023-42917 Resolves: rhbz#2253058

Dec 13, 2023
Medium max 8.8

ELSA-2023-7754 1 CVE

Moderate: pixman security update (Oracle Linux 9)

[0.40.0-6] - Backport fix for CVE-2022-44638

Dec 13, 2023
Medium

ELSA-2023-7766 5 CVEs

Moderate: containernetworking-plugins security update (Oracle Linux 9)

[1:1.3.0-6] - rebuild for following CVEs: CVE-2023-29409 CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 - Resolves: #2228743 - Resolves: #2237773 - Resolves: #2237776 - Resolves: #2237777 - Resolves: #2237778 [1:1.3.0-5] - fix path to dhcp servic…

Dec 13, 2023
Medium

ELSA-2023-7762 5 CVEs

Moderate: skopeo security update (Oracle Linux 9)

[2:1.13.3-3] - Rebuild with golang 1.20.10 - Related: Jira:RHEL-2786 [2:1.13.3-2] - Rebuild with golang 1.21.3 - Related: Jira:RHEL-2786

Dec 13, 2023
High max 8.8

ELSA-2023-13043 10 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-201.135.6] - Revert ncsi: Propagate carrier gain/loss events to the NCSI controller (Johnathan Mantey) - netfilter: nf_tables: split async and sync catchall in two functions (Pablo Neira Ayuso) - netfilter: nf_tables: remove catchall element in GC syn…

Dec 13, 2023
Low max 5.9

ELSA-2023-7743 1 CVE

Low: curl security update (Oracle Linux 7)

[7.29.0-59.0.3.el7_9.2] - load CA certificates even with --insecure [Orabug: 32836997] - Fix TFTP small blocksize heap buffer overflow (https://curl.haxx.se/docs/CVE-2019-5482.html)[CVE-2019-5482][Orabug: 30568724] - Security Fixes [OraBug: 28939992] - CVE-20…

Dec 12, 2023
High max 7.5

ELSA-2023-7712 1 CVE

Important: tracker-miners security update (Oracle Linux 9)

[3.1.2-4] - Backport stricter seccomp jail Resolves: RHEL-12469

Dec 12, 2023
High max 7.8

ELSA-2023-13039 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.532.3] - Revert 'mmc: core: Capture correct oemid-bits for eMMC cards' (Dominique Martinet) - media: dvb-usb-v2: af9035: fix missing unlock (Hans Verkuil) - perf/core: Fix potential NULL deref (Peter Zijlstra) [4.14.35-2047.532.2] - x86: change …

Dec 11, 2023
High max 7.5

ELSA-2023-7668 1 CVE

Important: squid:4 security update (Oracle Linux 8)

libecap squid [7:4.15-7.3] - Fix squid: DoS against HTTP and HTTPS (CVE-2023-5824) [7:4.15-7.1] - Resolves: RHEL-14801 - squid: squid: Denial of Service in HTTP Digest Authentication - Resolves: RHEL-14776 - squid: squid: Request/Response smuggling in HTTP/1.…

Dec 11, 2023