Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

  • High max 7.5
    ELSA-2026-75581 1 CVE

    Important: mod_auth_openidc security update (Oracle Linux 10)

    [2.4.16.11-1.1] - Fix CVE-2026-54789: out-of-bounds read/write in state cookie parsing - Resolves: RHEL-248045

  • High max 9.8
    ELSA-2026-70498 12 CVEs 1 exploited

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.60.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 7.1
    ELSA-2026-75769 1 CVE

    Important: vim security update (Oracle Linux 10)

    [9.1.083-9.0.1.el10_2.22] - Remove upstream references [Orabug: 31197557] [2:9.1.083-9.22] - RHEL-271045 ex command injection via crafted filename in sign_jump() [2:9.1.083-9.21] - RHEL-257016 CVE-2026-73073 arbitrary Ex command execution during C omni-comple…

  • High max 9.3
    ELSA-2026-75576 2 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.62.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 9.8
    ELSA-2026-70402 20 CVEs 1 exploited

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-553.168.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 9.8
    ELSA-2026-71213 7 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-553.168.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • Medium max 9.8
    ELSA-2026-74133 4 CVEs

    Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-553.170.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 8.3
    ELSA-2026-73519 2 CVEs

    Important: ruby:2.5 security update (Oracle Linux 8)

    ruby [2.5.9-114] - Fix integer overflow in search_in_range function in regexec.c (CVE-2019-19012). Resolves: RHEL-87505 [2.5.9-113] - Fix REXML ReDoS vulnerability. (CVE-2024-49761) Resolves: RHEL-68515 [2.5.9-112] - Fix ReDoS vulnerability - upstream's incom…

  • High max 7.5
    ELSA-2026-74085 3 CVEs

    Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 8)

    nodejs [1:24.21.0-1] - Update to version 24.21.0 Fix: CVE-2026-85152 CVE-2026-84961 CVE-2026-19534 Resolves: RHEL-255252 RHEL-255291 RHEL-255313 RHEL-249188 [1:24.18.0-3] - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 5.9.0 Fix:…

  • Medium max 9.8
    ELSA-2026-74457 1 CVE

    Moderate: ghostscript security update (Oracle Linux 9)

    [9.54.0-19.1] - RHEL-264921 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 (JPXDecode) output adapter

  • High max 7.8
    ELSA-2026-74424 2 CVEs

    Important: libvirt security, bug fix, and enhancement update (Oracle Linux 9)

    [11.10.0-12.7.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] [11.10.0-12.7.el9_8] - remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245282, CVE-2026-18917) - qemu: Always assume support for 'QEMU_CAPS…

  • Medium max 7.1
    ELSA-2026-74438 3 CVEs

    Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.54.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 9.8
    ELSA-2026-71233 13 CVEs 1 exploited

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.60.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 8.8
    ELSA-2026-73997 1 CVE

    Important: gvfs security update (Oracle Linux 8)

    [1.36.2-22] - Fix heap buffer overflow in SFTP backend (CVE-2026-84268) Resolves: RHEL-252300

  • High max 8.2
    ELSA-2026-74095 17 CVEs

    Important: rsync security, bug fix, and enhancement update (Oracle Linux 8)

    [3.1.3-28] - Resolves: RHEL-256903 - Fix latest CVEs in rsync in RHEL8 - Fixing a regression introduced with the security patches

  • High max 10.0
    ELSA-2026-73971 44 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [140.16.0-1] - Add Oracle prefs file [140.16.0-1] - Update to 140.16.0 ESR [140.15.0-1] - Update to 140.15.0 ESR - Fix ML-DSA certificate validation Resolves: RHEL-252227

  • Critical max 9.6
    ELSA-2026-74084 322 CVEs 1 exploited

    Critical: webkit2gtk3 security update (Oracle Linux 8)

    [2.54.0-1] - Update to 2.54.0

  • High max 7.0
    ELSA-2026-73426 1 CVE

    Important: gdb security update (Oracle Linux 9)

    [16.3-3.1.0.1] - Merge Oracle patches for ol9-u8. Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Oracle history: March-06-2026 Claudiu Zissulescu <claudiu.zissulescu-ianculescu@oracle.com> - 16.3-3.0.1 - Merge Oracle patches for ol9-u8. Reviewed-by:…

  • High max 8.8
    ELSA-2026-74370 2 CVEs

    Important: gvfs security update (Oracle Linux 9)

    [1.48.1-8.1] - Backport several CVE fixes (CVE-2026-84268, CVE-2026-88924) Resolves: RHEL-252312, RHEL-257348

  • Medium max 6.5
    ELSA-2026-73955 1 CVE

    Moderate: openssh security update (Oracle Linux 9)

    [9.9p1-12.0.1] - Restore pam_ssh_agent_rel values that were used for initial release - Fix PerSourcePenalties grace-exceeded using the crash penalty value [Orabug: 39825354] - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM…

  • High max 8.7
    ELSA-2026-74441 1 CVE

    Important: libpcap security update (Oracle Linux 9)

    [14:1.10.0-4.1] - Fix CVE-2026-0799: add bounds checks for BPF scratch memory register indices in the BPF interpreter Related: RHEL-256935

  • High max 7.5
    ELSA-2026-74001 2 CVEs

    Important: expat security update (Oracle Linux 10)

    [2.7.3-61] - CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing [2.7.3-60] - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input [2.7.3-59] - Fix CVE-2026-56132: out-of-bound scaffolding index sto…

  • High max 8.7
    ELSA-2026-74442 1 CVE

    Important: libpcap security update (Oracle Linux 10)

    [14:1.10.4-7.1] - Fix CVE-2026-0799: validate BPF scratch memory register indices in the BPF interpreter to prevent out-of-bounds memory access Resolves: RHEL-256921

  • High max 7.0
    ELSA-2026-73427 1 CVE

    Important: gdb security update (Oracle Linux 10)

    [16.3-3.1.0.1] Merge Oracle patches for ol10-u2 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Oracle history: March-4-2026 Claudiu Zissulescu <claudiu.zissulescu-ianculescu@oracle.com> - 16.3-3.0.1 Merge Oracle patches for ol10-u2 Reviewed-by: Davi…

  • Medium max 9.8
    ELSA-2026-74464 1 CVE

    Moderate: ghostscript security update (Oracle Linux 10)

    [10.02.1-16.1] - RHEL-264925 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 JPXDecode output adapter

  • High max 8.8
    ELSA-2026-73998 2 CVEs

    Important: gvfs security update (Oracle Linux 10)

    [1.54.4-4.1] - Backport several CVE fixes (CVE-2026-84268, CVE-2026-88924) Resolves: RHEL-252305, RHEL-257341 [1.54.4-4] - udisks2: Correct add to hash table for items which can clash in the monitor (RHEL-143935)

  • Medium max 5.1
    ELSA-2026-73511 2 CVEs

    Moderate: gawk security update (Oracle Linux 8)

    [4.2.1-5] - Fix use-after-free in do_getline_redir() (CVE-2026-40467) Resolves: RHEL-222601 [4.2.1-4.1] - Fix integer overflow in do_sub() and parse_escape() (CVE-2026-40468) Resolves: RHEL-222771

  • Medium max 5.1
    ELSA-2026-73512 3 CVEs

    Moderate: gawk security update (Oracle Linux 9)

    [5.1.0-6.1] - Fix use after free in io.c - Fix buffer overflow in extensions/readdir.c - Fix integer overflow in buildin.c Resolves: CVE-2026-40467 Resolves: CVE-2026-40468 Resolves: CVE-2026-40553

  • High max 8.1
    ELSA-2026-73766 2 CVEs

    Important: pki-core security update (Oracle Linux 9)

    [11.7.1-2.0.1] - Replaced upstream graphical references [Orabug: 33952704] [11.7.0-2] - RHEL-245465 CVE-2026-76561 pki-core: ExternalProcessConstraint executable allow-list - RHEL-248586 CVE-2026-80110 pki-core: ACLFilter sort order fix

  • High max 7.5
    ELSA-2026-73838 3 CVEs

    Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 9)

    nodejs [1:24.21.0-1] - Update to version 24.21.0 nodejs-nodemon [3.1.14-3] - Fix CVE-2026-69152 - brace-expansion [3.1.14-2] - Correction to sources for 3.1.14. [3.1.14-1] - Update to version 3.1.14 [3.0.3-3] - Keep BR on just npm [3.0.3-2] - Fix BR for nodej…

  • Medium max 5.1
    ELSA-2026-73429 3 CVEs

    Moderate: gawk security update (Oracle Linux 10)

    [5.3.0-6.1] - Fix use after free in io.c - Fix buffer overflow in extensions/readdir.c - Fix integer overflow in buildin.c Resolves: CVE-2026-40467 Resolves: CVE-2026-40468 Resolves: CVE-2026-40553

  • High max 8.1
    ELSA-2026-73765 2 CVEs

    Important: dogtag-pki security update (Oracle Linux 10)

    [11.9.0-5.0.1] - Treat Oracle Linux the same as RHEL when selecting the Tomcat app server version. [11.9.0-5] - RHEL-245469 CVE-2026-76561 dogtag-pki: ExternalProcessConstraint executable allow-list - RHEL-248585 CVE-2026-80110 dogtag-pki: ACLFilter sort orde…

  • Critical max 9.3
    ELSA-2026-73979 1 CVE

    Critical: freerdp security update (Oracle Linux 10)

    [2:3.10.3-12.13] - Abort after PROTOCOL_FAILED_NEGO (CVE-2026-91949) Resolves: RHEL-264913 [2:3.10.3-12.12] - Fix several regressions in CVE-2026-73241 Resolves: RHEL-257781

  • High max 7.5
    ELSA-2026-73428 3 CVEs

    Important: nodejs24 security, bug fix, and enhancement update (Oracle Linux 10)

    [24.21.0-1.0.1] - Add c-ares as dependency [orabug 39781256] - Update upstream references [1:24.21.0-1] - Update to version 24.21.0

  • High max 9.6
    ELSA-2026-71652 28 CVEs

    Important: firefox security update (Oracle Linux 8)

    [140.16.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.16.0-1] - Update to 140.16.0 ESR

  • High max 7.5
    ELSA-2026-72448 2 CVEs

    Important: expat security update (Oracle Linux 8)

    [2.5.0-4] - Fix CVE-2026-66046 in expat - Resolves: RHEL-260142 [2.5.0-3] - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input - Resolves: RHEL-268995

  • High max 8.8
    ELSA-2026-72274 2 CVEs

    Important: postgresql:12 security update (Oracle Linux 8)

    [12.22-12] - add postgresql-CVE-2026-18408.patch [12.22-11] - apply backport-of-the-patch-to-fix-CVE-2025-8714.patch [12.22-10] - Backport fixes for multiple CVEs - Resolves: CVE-2026-14662, CVE-2026-14664, CVE-2026-14668, CVE-2026-14669 - Resolves: CVE-2026-…

  • High max 7.5
    ELSA-2026-72285 1 CVE

    Important: ruby:3.3 security update (Oracle Linux 8)

    ruby [3.3.12-9] - Fix memory exhaustion via unknown DNS resource types in resolv. (CVE-2026-80212) Resolves: RHEL-252036 [3.3.12-8] - Upgrade to Ruby 3.3.12. Resolves: RHEL-170929 Resolves: RHEL-193664 [3.3.10-7] - Fix DoS via crafted IMAP responses in net-im…

  • High max 7.5
    ELSA-2026-72484 1 CVE

    Important: ruby:4.0 security update (Oracle Linux 9)

    ruby [4.0.6-35] - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion (CVE-2026-80212) Resolves: RHEL-252035 [4.0.6-34] - Upgrade to Ruby 4.0.6. Resolves: RHEL-211301 Resolves: RHEL-193663 [4.0.3-3…

  • High max 7.5
    ELSA-2026-72485 1 CVE

    Important: ruby:3.3 security update (Oracle Linux 9)

    ruby [3.3.12-9] - Fix memory exhaustion via unknown DNS resource types in resolv. (CVE-2026-80212) Resolves: RHEL-252039 [3.3.12-8] - Upgrade to Ruby 3.3.12. Resolves: RHEL-171335 Resolves: RHEL-193665 [3.3.10-7] - Fix DoS via crafted IMAP responses in net-im…