Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

High max 9.2

ELSA-2026-77020 2 CVEs

Important: python3.12 security update (Oracle Linux 10)

[3.12.15-1.0.1] - Remove upstream URL reference [3.12.15-1] - Update to 3.12.15 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Securit…

Oct 8, 2026
Medium max 7.5

ELSA-2026-77534 1 CVE

Moderate: sssd security update (Oracle Linux 10)

[2.12.0-3.0.1.el10_2.2] - Restore default debug level for sss_cache [Orabug: 32810448] [2.12.0-3.2] - Resolves: RHEL-257112 - CVE-2026-87853 sssd: IDP prefix-match bypass in eval_access_token_buf() [2.12.0-3.1] - Resolves: RHEL-192056 - CVE-2026-14474 sssd: s…

Oct 8, 2026
High max 9.8

ELSA-2026-76738 35 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.63.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Oct 8, 2026
High max 10.0

ELSA-2026-77690 16 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.64.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Oct 8, 2026
High max 9.2

ELSA-2026-77028 2 CVEs

Important: python3.12 security update (Oracle Linux 8)

[3.12.15-1] - Update to 3.12.15 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-…

Oct 7, 2026
High max 7.1

ELSA-2026-77359 1 CVE

Important: vim security update (Oracle Linux 8)

[8.0.1763-32.0.1] - Remove upstream references [Orabug: 31197557] - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984] [2:8.0.1763-32] - RHEL-271024 vim: vim: Ex command injection via crafted filename in sign_jump() [2:8.0.176…

Oct 7, 2026
High max 8.8

ELSA-2026-76755 6 CVEs

Important: freerdp security update (Oracle Linux 9)

[2:2.11.7-7.8] - Backport several CVE fixes (CVE-2026-91953, CVE-2026-91954, CVE-2026-91956, CVE-2026-91959, CVE-2026-91963, CVE-2026-91964) Resolves: RHEL-260758, RHEL-260785, RHEL-260803, RHEL-260849, RHEL-260871 Resolves: RHEL-260902

Oct 7, 2026
High max 7.4

ELSA-2026-76733 1 CVE

Important: rust-rpm-sequoia security update (Oracle Linux 9)

[1.10.2.1-1] - Rebase to 1.10.2 and sequioa-openpgp with fixes for CVE-2026-42784

Oct 7, 2026
High max 10.0

ELSA-2026-500377 383 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-325.220.5] - octeontx2-pf: fix SQB pointer leak on init failure (Dawei Feng) [Orabug: 39951718] - batman-adv: Remove stale reason member from batadv_tp_vars (Vijayendra Suman) [Orabug: 39966037] - Revert 'octeontx2-pf: Fix leak of SQ timestamp buffer …

Oct 7, 2026
High max 6.2

ELSA-2026-76760 1 CVE

Important: perl-DBI security update (Oracle Linux 9)

[1.643-9.7] - CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting memory read during numeric type casting Resolves: RHEL-271974

Oct 7, 2026
High max 9.8

ELSA-2026-76761 43 CVEs

Important: firefox security update (Oracle Linux 9)

[140.17.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.17.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

Oct 7, 2026
High max 9.8

ELSA-2026-76764 43 CVEs

Important: firefox security update (Oracle Linux 10)

[140.17.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.17.0-1] - Update to 140.17.0 ESR

Oct 7, 2026
High max 10.0

ELSA-2026-500374 1468 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-207.111.5.1] - selftests/mm/khugepaged: include kselftest.h in khugepaged (Sherry Yang) [Orabug: 40099804] [6.12.0-207.111.5] - Rename ONOS kernel flavor to OSP for OL9 and OL10 (Vijay Kumar) [Orabug: 40055216] - tcp: Remove hashinfo test for inet6?_l…

Oct 7, 2026
High max 7.1

ELSA-2026-75582 1 CVE

Important: librabbitmq security update (Oracle Linux 8)

[0.9.0-6] - CVE-2026-44236 librabbitmq: rabbitmq-c: Heap buffer overflow leading to denial of service [rhel-8.10.z] leading to denial of service [rhel-8.10.z] - Resolves: RHEL-266743

Oct 6, 2026
High max 8.8

ELSA-2026-76747 6 CVEs

Important: freerdp security update (Oracle Linux 8)

[2:2.11.7-14] - Backport several CVE fixes (CVE-2026-91953, CVE-2026-91954, CVE-2026-91956, CVE-2026-91959, CVE-2026-91963, CVE-2026-91964) Resolves: RHEL-260751, RHEL-260776, RHEL-260800, RHEL-260846, RHEL-260860 Resolves: RHEL-260892

Oct 6, 2026
High max 9.1

ELSA-2026-76763 8 CVEs

Important: dovecot security, bug fix, and enhancement update (Oracle Linux 8)

[1:2.3.16-15] - fix CVE-2026-33605: ManageSieve login deadlock caused by lone CR protocol violation (RHEL-251995) [1:2.3.16-14] - fix CVE-2026-42007: heap use-after-free in pigeonhole edit_mail_snapshot after deleteheader operation (RHEL-251946) [1:2.3.16-13]…

Oct 6, 2026
Medium max 9.8

ELSA-2026-76877 1 CVE

Moderate: ghostscript security update (Oracle Linux 8)

[9.27-18] - RHEL-264919 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 output adapter via component subsampling mismatch

Oct 6, 2026
High max 9.1

ELSA-2026-500375 13 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.360.3] - IB/mlx4: delete allocated id_map_entry while sending REJ (Praveen Kumar Kannoju) [Orabug: 39999072] - net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40020673] {CVE-2026-81000} - xfrm: ah6: validate routing header s…

Oct 6, 2026
High max 7.8

ELSA-2026-75579 1 CVE

Important: sudo security update (Oracle Linux 10)

[1.9.17-7] - CVE-2026-96512 sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization [rhel-10.2.z] [1.9.17-6] - Fix CVE-2026-82474: execveat(2) intercept/log_subcmds bypass [1.9.17-5.p2] - Resolves: RHEL-212546 - Use ca…

Oct 6, 2026
High max 8.8

ELSA-2026-75570 11 CVEs

Important: freerdp security update (Oracle Linux 10)

[2:3.10.3-12.14] - Backport several CVE fixes (CVE-2026-85089, CVE-2026-91946, CVE-2026-91947, CVE-2026-91950, CVE-2026-91953, CVE-2026-91954, CVE-2026-91956, CVE-2026-91959, CVE-2026-91960, CVE-2026-91963, CVE-2026-91964) Resolves: RHEL-253892, RHEL-260716, …

Oct 6, 2026
High max 7.5

ELSA-2026-75864 2 CVEs

Important: nodejs22 security update (Oracle Linux 10)

[1:22.23.1-4.0.1] - Add c-ares as dependency [orabug 39781219]

Oct 6, 2026
High max 7.4

ELSA-2026-76735 1 CVE

Important: rust-sequoia-sqv security update (Oracle Linux 10)

[1.3.0.2-1] - Update openpgp crate to fix CVE-2026-42784

Oct 6, 2026
High max 7.4

ELSA-2026-76734 1 CVE

Important: rust-rpm-sequoia security, bug fix, and enhancement update (Oracle Linux 10)

[1.10.2.1-1] - Rebase to 1.10.2 and sequioa-openpgp with fixes for CVE-2026-42784

Oct 6, 2026
High max 6.2

ELSA-2026-76762 1 CVE

Important: perl-DBI security update (Oracle Linux 10)

[1.643-26.7] - CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting memory read during numeric type casting Resolves: RHEL-271970

Oct 6, 2026
High max 7.8

ELSA-2026-75580 1 CVE

Important: sudo security update (Oracle Linux 8)

[1.9.5p2-2.0.1] - Fixes sudo -s unclosed sessions when use_pty option used [Orabug: 36952911] [1.9.5p2-2] RHEL 8.10.0.Z ERRATUM - CVE-2026-96512 - TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization [rhel-8.10.z] Resolves: RHE…

Oct 5, 2026
High max 6.9

ELSA-2026-75674 1 CVE

Important: mariadb-connector-c security update (Oracle Linux 8)

[3.1.11-3] - CVE-2026-44172 fix

Oct 5, 2026
High max 8.7

ELSA-2026-76045 1 CVE

Important: libpcap security update (Oracle Linux 8)

[14:1.9.1-6] - Fix CVE-2026-0799: add bounds checks for BPF scratch memory register indices in the BPF interpreter - Resolves: RHEL-256926

Oct 5, 2026
High max 9.8

ELSA-2026-75747 29 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.171.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 5, 2026
High max 9.8

ELSA-2026-72468 13 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.170.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 5, 2026
High

ELSA-2026-75680 0 CVEs

Important: gd security update (Oracle Linux 8)

[2.2.5-8] - Fix CVE-2026-9672: incorrect array index and uninitialized memory in GIF LZW decoder Resolves: RHEL-259584

Oct 5, 2026
High max 7.2

ELSA-2026-75573 1 CVE

Important: pki-core:10.6 security update (Oracle Linux 8)

jss [4.11.0-1] - Rebase to JSS 4.11.0 [4.10.0-0.1] - Rebase to JSS 4.10.0-alpha1 [4.9.8-1] - Rebase to JSS 4.9.8 [4.9.4-1] - Rebase to JSS 4.9.4 - Bug 2013674 - JSS cannot be properly initialized after using another NSS-backed security provider [4.9.3-1] - Re…

Oct 5, 2026
High max 7.8

ELSA-2026-75575 4 CVEs

Important: gimp security update (Oracle Linux 9)

[2:3.0.4-4.14] - fix CVE-2026-97185 [2:3.0.4-4.13] - fix CVE-2026-92248 [2:3.0.4-4.12] - fix CVE-2026-90947 [2:3.0.4-4.11] - fix CVE-2026-90948

Oct 5, 2026
High max 6.9

ELSA-2026-75673 1 CVE

Important: mariadb-connector-c security update (Oracle Linux 9)

[3.2.6-2] - CVE-2026-44172 fix

Oct 5, 2026
High max 7.8

ELSA-2026-75571 1 CVE

Important: sudo security update (Oracle Linux 9)

[1.9.17p2-3.3] - CVE-2026-96512 sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization [rhel-9.8.z] Resolves: RHEL-267328

Oct 5, 2026
High max 7.1

ELSA-2026-75768 1 CVE

Important: vim security update (Oracle Linux 9)

[8.2.2637-26.0.1.el9_8.23] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-26.23] - RHEL-271037 vim: ex command injection via crafted filename in sign_jump() [2:8.2.2637-26.22] - RHEL-257027 CVE-2026-73073 vim: arbitrary Ex command execution durin…

Oct 5, 2026
High max 7.5

ELSA-2026-75578 5 CVEs

Important: bind9.18 security update (Oracle Linux 9)

[32:9.18.29-14.10] - Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666) - Prevent memory leak on following HTTPS/SVCB RR (CVE-2026-81563) - Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs (CVE-2026-80274) …

Oct 5, 2026
High max 7.5

ELSA-2026-75767 3 CVEs

Important: bind security update (Oracle Linux 9)

[9.16.23-40.0.1.el9_8.10] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-40.10] - Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666) - Prevent crash on wildcard responses containing both NSEC and…

Oct 5, 2026
High max 7.8

ELSA-2026-75583 2 CVEs

Important: libvirt security, bug fix, and enhancement update (Oracle Linux 10)

[11.10.0-12.9.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] [11.10.0-12.9.el10_2] - remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245266, CVE-2026-18917) - qemu: Always assume support for 'QEMU_CAP…

Oct 5, 2026
Medium max 6.5

ELSA-2026-73954 1 CVE

Moderate: openssh security update (Oracle Linux 10)

[9.9p1-28.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-28] - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258463

Oct 5, 2026
High max 7.5

ELSA-2026-75577 5 CVEs

Important: bind security update (Oracle Linux 10)

[9.18.33-15.0.1.el10_2.12] - Hard require needed openssl-libs [Orabug: 38742109] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.18.33-15.12] - Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666) - Preve…

Oct 5, 2026