Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

  • High max 7.5
    ELSA-2023-12935 5 CVEs

    Important: GraalVM Security update (Oracle Linux 7)

  • High max 7.5
    ELSA-2023-12933 5 CVEs

    Important: GraalVM Security update (Oracle Linux 7)

  • High max 7.5
    ELSA-2023-12938 5 CVEs

    Important: GraalVM Security update (Oracle Linux 8)

  • High max 7.5
    ELSA-2023-5989 1 CVE 1 exploited

    Important: varnish security update (Oracle Linux 8)

    varnish [6.0.8-3.1] - Add parameters h2_rst_allowance and h2_rst_allowance_period to mitigate CVE-2023-44487 varnish-modules

  • High max 7.5
    ELSA-2023-12937 5 CVEs

    Important: GraalVM Security update (Oracle Linux 8)

  • High max 7.5
    ELSA-2023-5928 1 CVE 1 exploited

    Important: tomcat security update (Oracle Linux 8)

    [1:9.0.62-5.2] - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

  • High max 7.5
    ELSA-2023-12940 5 CVEs

    Important: GraalVM Security update (Oracle Linux 8)

  • High max 7.5
    ELSA-2023-12939 5 CVEs

    Important: GraalVM Security update (Oracle Linux 8)

  • High
    ELSA-2023-5997 1 CVE

    Important: python3 security update (Oracle Linux 8)

    [3.6.8-51.0.1.2] - Security fix for CVE-2023-40217 Resolves: rhbz#2235789

  • High
    ELSA-2023-5994 1 CVE

    Important: python27:2.7 security update (Oracle Linux 8)

    babel Cython numpy pytest python2 [2.7.18-13.0.1.2] - Security fix for CVE-2023-40217 python2-pip python2-rpm-macros python2-setuptools python2-six python-attrs python-backports python-backports-ssl_match_hostname python-chardet python-coverage python-dns pyt…

  • High max 7.5
    ELSA-2023-12941 5 CVEs

    Important: GraalVM Security update (Oracle Linux 9)

  • Medium
    ELSA-2023-5068 1 CVE

    Moderate: linux-firmware security update (Oracle Linux 9)

    [20230516-999.27.git6c9e0ed5.el9] - Update firmware for qat_4xxx devices (Orabug: 35811008) [20230516-999.26.git6c9e0ed5.el9] - Run dracut -f in %posttrans instead of %post (Orabug: 35661938) - Drop latest AMD microcode commits to family 19 file to include Mi…

  • High max 7.5
    ELSA-2023-12944 5 CVEs

    Important: GraalVM Security update (Oracle Linux 9)

  • High max 7.5
    ELSA-2023-12942 5 CVEs

    Important: GraalVM Security update (Oracle Linux 9)

  • High max 7.5
    ELSA-2023-12943 5 CVEs

    Important: GraalVM Security update (Oracle Linux 9)

  • High max 7.5
    ELSA-2023-5924 1 CVE 1 exploited

    Important: varnish security update (Oracle Linux 9)

    [6.6.2-3.el9_2.1] - Add parameters h2_rst_allowance and h2_rst_allowance_period to mitigate CVE-2023-44487 - Resolves: RHEL-12818

  • High max 7.5
    ELSA-2023-5869 4 CVEs 1 exploited

    Important: nodejs:18 security update (Oracle Linux 8)

    nodejs [1:18.18.2-1] - Rebase to version 18.18.2 Resolves: CVE-2023-44487 CVE-2023-45143 CVE-2023-38552 CVE-2023-39333 nodejs-nodemon nodejs-packaging

  • High max 9.4
    ELSA-2023-5927 6 CVEs

    Important: php:8.0 security update (Oracle Linux 8)

    libzip php [8.0.30-1] - rebase to 8.0.30 - Resolves: RHEL-11946 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip

  • High max 7.5
    ELSA-2023-5929 1 CVE 1 exploited

    Important: tomcat security update (Oracle Linux 9)

    [1:9.0.62-11.3] - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

  • High max 9.4
    ELSA-2023-5926 6 CVEs

    Important: php security update (Oracle Linux 9)

    [8.0.30-1] - rebase to 8.0.30 - Resolves: RHEL-11946

  • Medium max 7.5
    ELSA-2023-5863 2 CVEs 1 exploited

    Moderate: grafana security update (Oracle Linux 8)

    [7.5.15-5] - Resolve CVE-2023-44487 Rapid Reset Attack - Resolve CVE-2023-39325 rapid stream resets can cause excessive work

  • High max 7.5
    ELSA-2023-5850 1 CVE 1 exploited

    Important: nodejs:16 security update (Oracle Linux 8)

    nodejs [1:16.20.2-3.0.1] - Update nghttp2 to 1.57.0 Resolves: CVE-2023-44487 nodejs-nodemon nodejs-packaging [26-1] - nodejs.prov: find namespaced bundled dependencies - Apply https://src.fedoraproject.org/rpms/nodejs-packaging/c/e24e7df

  • Medium max 7.5
    ELSA-2023-5867 2 CVEs 1 exploited

    Moderate: grafana security update (Oracle Linux 9)

    [9.0.9-4] - Resolve CVE-2023-44487 Rapid Reset Attack - Resolve CVE-2023-39325 rapid stream resets can cause excessive work

  • High max 7.5
    ELSA-2023-5765 1 CVE 1 exploited

    Important: nodejs security update (Oracle Linux 9)

    [1:16.20.2-3.0.1] - Update nghttp2 to 1.57.0 Resolves: CVE-2023-44487

  • High max 7.5
    ELSA-2023-5849 4 CVEs 1 exploited

    Important: 18 security update (Oracle Linux 9)

    nodejs [1:18.18.2-2] - Rebase to version 18.18.2 Resolves: CVE-2023-44487 CVE-2023-45143 CVE-2023-38552 CVE-2023-39333 nodejs-nodemon [3.0.1-1] - Rebase to 3.0.1 - Resolves: CVE-2022-25883 nodejs-packaging [2021.06-4] - NPM bundler: also find namespaced bundl…

  • Medium max 5.3
    ELSA-2023-5736 1 CVE

    Moderate: java-11-openjdk security and bug fix update (Oracle Linux 7)

    [1:11.0.21.0.9-1.0.1] - link atomic for ix86 build [1:11.0.21.0.9-1] - Update to jdk-11.0.21+9 (GA) - Update release notes to 11.0.21+9 - Remove system crypto policy patch which doesn't belong on RHEL 7 with no system policies - Update generate_tarball.sh to …

  • Medium max 5.3
    ELSA-2023-5761 2 CVEs

    Moderate: java-1.8.0-openjdk security update (Oracle Linux 7)

    [1:1.8.0.392.b08-2] - Revert jcmd move as jcmd will not operate without tools.jar - Related: RHEL-13577 [1:1.8.0.392.b08-1] - Update to shenandoah-jdk8u392-b08 (GA) - Update release notes for shenandoah-8u392-b08. - Update generate_tarball.sh to be closer to …

  • High max 9.8
    ELSA-2023-5790 1 CVE

    Important: python-reportlab security update (Oracle Linux 8)

    [3.4.0-8.1] - python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

  • High max 5.5
    ELSA-2023-12924 1 CVE

    Important: kvm_utils2 security update (Oracle Linux 8)

    hivex libguestfs libguestfs-winsupport libiscsi libnbd libtpms libvirt [7.10.0-3.el8] - virpci: Resolve leak in virPCIVirtualFunctionList cleanup (Tim Shearer) [Orabug: 35395469] {CVE-2023-2700} libvirt-dbus libvirt-python [7.10.0-3.el8] - Update version numb…

  • High max 7.5
    ELSA-2023-5709 1 CVE 1 exploited

    Important: dotnet7.0 security update (Oracle Linux 8)

    [7.0.112-1.0.1] - Update to .NET SDK 7.0.112 and Runtime 7.0.12 - Resolves: RHEL-11698

  • High max 7.5
    ELSA-2023-5837 1 CVE 1 exploited

    Important: nghttp2 security update (Oracle Linux 8)

    [1.33.0-5] - fix HTTP/2 Rapid Reset (CVE-2023-44487) [1.33.0-4] - prevent DoS caused by overly large SETTINGS frames (CVE-2020-11080)

  • High max 7.5
    ELSA-2023-5838 1 CVE 1 exploited

    Important: nghttp2 security update (Oracle Linux 9)

    [1.43.0-5.1] - fix HTTP/2 Rapid Reset (CVE-2023-44487)

  • High max 7.5
    ELSA-2023-5721 2 CVEs 1 exploited

    Important: go-toolset:ol8 security update (Oracle Linux 8)

    delve golang [1.19.13-1] - Rebase to Go 1.19.13 [CVE-2023-39325] [CVE-2023-44487] go-toolset [1.19.13-1] - Rebase to Go 1.19.13 [CVE-2023-39325] [CVE-2023-44487]

  • High max 7.5
    ELSA-2023-5710 1 CVE 1 exploited

    Important: dotnet6.0 security update (Oracle Linux 8)

    [6.0.123-1.0.1] - Update to .NET SDK 6.0.123 and Runtime 6.0.23 - Resolves: RHEL-11696

  • High max 7.5
    ELSA-2023-5684 8 CVEs

    Important: galera and mariadb security update (Oracle Linux 9)

    galera [26.4.14-1.0.1] - Rebase to 26.4.14 [26.4.13-1.0.1] - Rebase to 26.4.13 [26.4.12-1.0.1] - Rebase to 26.4.12 mariadb [3:10.5.22-1] - Rebase to 10.5.22 [3:10.5.21-1] - Rebase to version 10.5.21 [3:10.5.20-2] - Use _fortify_level to disable fortification …

  • High max 8.8
    ELSA-2023-5763 2 CVEs

    Important: curl security update (Oracle Linux 9)

    [7.76.1-23.el9_2.4] - curl: a heap-based buffer overflow in the SOCKS5 proxy handshake (CVE-2023-38545) - curl: cookie injection with none file (CVE-2023-38546)

  • High max 7.5
    ELSA-2023-5749 1 CVE 1 exploited

    Important: .NET 7.0 security update (Oracle Linux 9)

    [7.0.112-1.0.1] - Update to .NET SDK 7.0.112 and Runtime 7.0.12 - Resolves: RHEL-11698

  • High max 7.5
    ELSA-2023-5738 3 CVEs 1 exploited

    Important: go-toolset and golang security and bug fix update (Oracle Linux 9)

    golang [1.19.13-1] - Update to go 1.19.13 [CVE-2023-44487] [CVE-2023-39325] [CVE-2023-29409] go-toolset [1.19.13-1] - Update to Go version 1.19.13

  • High max 7.5
    ELSA-2023-5708 1 CVE 1 exploited

    Important: dotnet6.0 security update (Oracle Linux 9)

    [6.0.123-1.0.1] - Update to .NET SDK 6.0.123 and Runtime 6.0.23 - Resolves: RHEL-11696

  • High max 7.0
    ELSA-2023-12914 1 CVE

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [5.4.17-2136.323.8.2.el7] - netfilter: nfnetlink_osf: avoid OOB read (Wander Lairson Costa) [Orabug: 35824307] - netfilter: xt_sctp: validate the flag_info count (Wander Lairson Costa) [Orabug: 35824307] - netfilter: xt_u32: validate user space input (Wander …