Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

  • High
    ELSA-2023-12681 0 CVEs

    Important: GraalVM Security update (Oracle Linux 9)

  • High
    ELSA-2023-12680 0 CVEs

    Important: GraalVM Security update (Oracle Linux 9)

  • High
    ELSA-2023-12682 0 CVEs

    Important: GraalVM Security update (Oracle Linux 9)

  • High
    ELSA-2023-12683 0 CVEs

    Important: GraalVM Security update (Oracle Linux 9)

  • High
    ELSA-2023-12686 0 CVEs

    Important: GraalVM Security update (Oracle Linux 9)

  • High max 7.8
    ELSA-2023-4377 5 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-284.25.1.0.1_2] - Fix KVM: x86/mmu: Fix race condition in direct_page_fault [Orabug: 35673032] {CVE-2022-45869} [5.14.0-284.25.1_2] - KVM: x86/mmu: Fix race condition in direct_page_fault - prlimit: do_prlimit needs to have a speculation check {CVE-20…

  • High
    ELSA-2023-12684 0 CVEs

    Important: GraalVM Security update (Oracle Linux 9)

  • High
    ELSA-2023-12679 0 CVEs

    Important: GraalVM Security update (Oracle Linux 9)

  • High max 9.8
    ELSA-2023-4382 1 CVE

    Important: openssh security update (Oracle Linux 7)

    [7.4p1-23.0.1] - enlarge format buffer size for certificate serial number so the log message can record any 64-bit integer without truncation (openssh bz#3012) [Orabug: 30448895] [7.4p1-23 + 0.10.3-2] - Avoid remote code execution in ssh-agent PKCS#11 support…

  • Medium max 5.9
    ELSA-2023-4328 1 CVE

    Moderate: samba security and bug fix update (Oracle Linux 8)

    [4.17.5-3.0.1] - Fix memleak in _nss_winbind_initgroups_dyn [Orabug: 34727815] - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs in OL8 [Orabug: 30205755] [4.17.5-3] - resolves: rhbz#2223601 - Fix trust relationship between worksta…

  • High max 9.8
    ELSA-2023-4419 1 CVE

    Important: openssh security update (Oracle Linux 8)

    [8.0p1-19] - Release bump [8.0p1-18] - Avoid remote code execution in ssh-agent PKCS#11 support Resolves: CVE-2023-38408

  • High max 8.6
    ELSA-2023-4418 1 CVE

    Important: mod_auth_openidc:2.3 security update (Oracle Linux 8)

    cjose [0.6.1-3] - CVE-2023-37464 cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE Resolves: rhbz#2223308 mod_auth_openidc [2.4.9.4-1] - Resolves: rhbz#2025368 - Rebase to new version

  • Medium max 5.9
    ELSA-2023-4325 1 CVE

    Moderate: samba security and bug fix update (Oracle Linux 9)

    [4.17.5-103.0.1] - Fix memleak in _nss_winbind_initgroups_dyn [Orabug: 34994509] [4.17.5-103] - resolves: rhbz#2223600 - Fix trust relationship between workstation and DC - resolves: rhbz#2222895 - Fix CVE-2023-3347

  • Medium max 6.5
    ELSA-2023-4349 2 CVEs

    Moderate: libxml2 security update (Oracle Linux 9)

    [2.9.13-3.1] - Fix CVE-2023-28484 (#2186694) - Fix CVE-2023-29469 (#2186694)

  • Medium max 7.5
    ELSA-2023-4330 4 CVEs

    Moderate: 18 security, bug fix, and enhancement update (Oracle Linux 9)

    nodejs [1:18.16.1-1] - Rebase to 18.16.1 Resolves: rhbz#2188292 rhbz#2187683 Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590 - Replace /usr/etc/npmrc symlink with builtin configuration Resolves: rhbz#2222285 nodejs-nodemon nodejs-packagi…

  • Medium max 6.1
    ELSA-2023-4350 1 CVE

    Moderate: python-requests security update (Oracle Linux 9)

    [2.25.1-7] - Security fix for CVE-2023-32681 Resolves: rhbz#2209469

  • Medium max 7.2
    ELSA-2023-4327 2 CVEs

    Moderate: 15 security update (Oracle Linux 9)

    pgaudit pg_repack postgres-decoderbufs postgresql [15.3-1] - update to 15.3 - Fixes CVE-2023-2454 and CVE-2023-2455 Resolves: #2214875

  • High max 9.8
    ELSA-2023-4412 1 CVE

    Important: openssh security update (Oracle Linux 9)

    [8.7p1-30] - Avoid remote code execution in ssh-agent PKCS#11 support Resolves: CVE-2023-38408

  • Medium max 7.5
    ELSA-2023-4331 4 CVEs

    Moderate: nodejs security, bug fix, and enhancement update (Oracle Linux 9)

    [1:16.20.1-1] - Rebase to 16.20.1 Resolves: rhbz#2188291 Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590 - Replace /usr/etc/npmrc symlink with builtin configuration Resolves: rhbz#2177781

  • Medium max 3.3
    ELSA-2023-4347 1 CVE

    Moderate: libeconf security update (Oracle Linux 9)

    [0.4.1-3] - Fix stack-based buffer overflow in read_file(). Resolves: #2212467 (CVE-2023-22652)

  • High max 8.6
    ELSA-2023-4411 1 CVE

    Important: cjose security update (Oracle Linux 9)

    [0.6.1-13] - CVE-2023-37464 cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE Resolves: rhbz#2223308

  • Medium max 5.9
    ELSA-2023-4354 2 CVEs

    Moderate: curl security update (Oracle Linux 9)

    [7.76.1-23.el9_2.2] - unify the upload/method handling (CVE-2023-28322) - fix host name wildcard checking (CVE-2023-28321)

  • Critical
    ELSA-2023-12689 1 CVE

    Critical: linux-firmware security update (Oracle Linux 7)

    [20230516-999.22.git6c9e0ed5.el7] - remove amd-ucode/README (Orabug: 35645306) - Resolves 'Zenbleed' (Orabug: 35650345) {CVE-2023-20593}

  • Critical
    ELSA-2023-12690 1 CVE

    Critical: linux-firmware security update (Oracle Linux 7)

    [20230516-999.22.git6c9e0ed5.el7] - remove amd-ucode/README (Orabug: 35645306) - Resolves 'Zenbleed' (Orabug: 35650345) {CVE-2023-20593}

  • High
    ELSA-2023-4326 1 CVE

    Important: iperf3 security update (Oracle Linux 7)

    [3.1.7-3] - Resolves: #2224558 - iperf3: memory allocation hazard and crash (CVE-2023-38403)

  • High max 7.8
    ELSA-2023-12688 7 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.77.2] - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Zheng Wang) [Orabug: 35514108] {CVE-2023-35824} - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Takashi Iwai) [Orabug: 35477742] {…

  • Critical
    ELSA-2023-12691 1 CVE

    Critical: linux-firmware security update (Oracle Linux 8)

    [20230516-999.22.git6c9e0ed5.el8] - remove amd-ucode/README (Orabug: 35645306) - Resolves 'Zenbleed' (Orabug: 35650345) {CVE-2023-20593}

  • Critical
    ELSA-2023-12692 1 CVE

    Critical: linux-firmware security update (Oracle Linux 9)

    [20230516-999.23.git6c9e0ed5.el9] - Firmware files need to be uncompressed for early kernel load to work - Resolves 'Zenbleed' (Orabug: 35650345) {CVE-2023-20593} [20230516-999.22.git6c9e0ed5.el9] - Move the README removal, it needs to happen during build (Or…

  • Medium max 7.5
    ELSA-2023-4175 6 CVEs

    Moderate: java-11-openjdk security and bug fix update (Oracle Linux 8)

    [1:11.0.20.0.8-2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:11.0.20.0.8-2] - Bump release number so we are newer than 9.0 - Related: rhbz#2221106 [1:11.0.20.0.8-1] - Update to jdk-11.0.20.0+8 (GA) - Update release notes to 11.0.20.0+8 - Drop local…

  • Medium max 7.5
    ELSA-2023-4177 7 CVEs

    Moderate: java-17-openjdk security and bug fix update (Oracle Linux 9)

    [1:17.0.8.0.7-2.0.1] - OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036) - OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041) - OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049…

  • Critical
    ELSA-2023-12654 1 CVE

    Critical: linux-firmware security update (Oracle Linux 7)

    [20230516-999.20.git6c9e0ed5.el7] - cd72938cb480 linux-firmware: Update AMD fam17h cpu microcode - 92624e57af69 linux-firmware: Update AMD cpu microcode

  • Critical
    ELSA-2023-12657 1 CVE

    Critical: linux-firmware security update (Oracle Linux 7)

    [20230516-999.20.git6c9e0ed5.el7] - cd72938cb480 linux-firmware: Update AMD fam17h cpu microcode - 92624e57af69 linux-firmware: Update AMD cpu microcode [20230516-999.19.git6c9e0ed5.el7] - Rebase to upstream - Revert removal of old iwlwifi firmwares (Orabug: …

  • Medium max 3.7
    ELSA-2023-4176 2 CVEs

    Moderate: java-1.8.0-openjdk security and bug fix update (Oracle Linux 8)

    [1:1.8.0.382.b05-2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:1.8.0.382.b05-2] - CVE-2023-22045 and CVE-2023-22049 fixed - Release bump for Oracle rebuild [1:1.8.0.382.b05-1] - Update to shenandoah-jdk8u372-b05 (GA) - Update release notes for shen…

  • Critical
    ELSA-2023-12655 1 CVE

    Critical: linux-firmware security update (Oracle Linux 8)

    [20230516-999.20.git6c9e0ed5.el8] - cd72938cb480 linux-firmware: Update AMD fam17h cpu microcode - 92624e57af69 linux-firmware: Update AMD cpu microcode [20230516-999.19.git6c9e0ed5.el8] - Rebase to upstream - Revert removal of old iwlwifi firmwares (Orabug: …

  • Medium max 7.5
    ELSA-2023-4159 7 CVEs

    Moderate: java-17-openjdk security and bug fix update (Oracle Linux 8)

    [1:17.0.8.0.7-2.0.1] - OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036) - OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041) - OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049…

  • Medium max 7.5
    ELSA-2023-4158 6 CVEs

    Moderate: java-11-openjdk security and bug fix update (Oracle Linux 9)

    [1:11.0.20.0.8-2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] - Fix tzdata requirement copy-and-paste error that led to two BuildRequires and no Requires [1:11.0.20.0.8-2] - Bump release number so we are newer than 9.0 - Related: rhbz#2221106 [1:11.0.2…

  • Critical
    ELSA-2023-12656 1 CVE

    Critical: linux-firmware security update (Oracle Linux 9)

    [20230516-999.20.git6c9e0ed5.el9] - cd72938cb480 linux-firmware: Update AMD fam17h cpu microcode - 92624e57af69 linux-firmware: Update AMD cpu microcode [20230516-999.19.git6c9e0ed5.el9] - Rebase to upstream - Revert removal of old iwlwifi firmwares (Orabug: …

  • Medium max 3.7
    ELSA-2023-4178 2 CVEs

    Moderate: java-1.8.0-openjdk security and bug fix update (Oracle Linux 9)

    [1:1.8.0.382.b05-2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:1.8.0.382.b05-2] - CVE-2023-22045 and CVE-2023-22049 fixed - Release bump for Oracle rebuild [1:1.8.0.382.b05-1] - Update to shenandoah-jdk8u372-b05 (GA) - Update release notes for shen…

  • Medium max 7.0
    ELSA-2023-3847 1 CVE

    Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-477.15.1_8.OL8] - net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() (Hangyu Hua) {CVE-2023-28466}

  • High max 7.8
    ELSA-2023-3723 6 CVEs

    Important: kernel security and bug fix update (Oracle Linux 9)

    - [5.14.0-284.18.1_2] - cifs: fix wrong unlock before return from cifs_tree_connect() - docs: Remove the unnecessary unicode character - perf vendor events intel: Refresh ivytown metrics and events - perf vendor events: Update Intel ivytown - perf vendor even…