Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

  • High
    ELSA-2023-4062 5 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [102.13.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [102.13.0-2] - Update to 102.13.0 build2 [102.13.0-1] - Update to 102.13.0 build1

  • Medium max 7.5
    ELSA-2023-4233 6 CVEs

    Moderate: java-11-openjdk security and bug fix update (Oracle Linux 7)

    [1:11.0.20.0.8-1.0.1] - link atomic for ix86 build [1:11.0.20.0.8-1] - Update to jdk-11.0.20.0+8 (GA) - Update release notes to 11.0.20.0+8 - Switch to GA mode for release - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. ** - Resolves: rhbz#2221106 […

  • Medium max 3.7
    ELSA-2023-4166 2 CVEs

    Moderate: java-1.8.0-openjdk security and bug fix update (Oracle Linux 7)

    [1:1.8.0.382.b05-1] - Update to shenandoah-jdk8u372-b05 (GA) - Update release notes for shenandoah-8u372-b05. - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. ** - Resolves: rhbz#2221106 [1:1.8.0.382.b04-0.1.ea] - Update to shenandoah-jdk8u382-b04 (E…

  • High
    ELSA-2023-4079 5 CVEs

    Important: firefox security update (Oracle Linux 7)

    [102.13.0-2.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [102.13.0-2] - Update to 102.13.0 build2 [102.13.0-1] - …

  • High max 7.5
    ELSA-2023-4152 1 CVE

    Important: bind security update (Oracle Linux 7)

    [2:9.11.4-26.P2.14] - Prevent the cache going over the configured limit (CVE-2023-2828)

  • High max 8.8
    ELSA-2023-4202 2 CVEs 2 exploited

    Important: webkit2gtk3 security update (Oracle Linux 8)

    [2.38.5-1.5] - Disable JIT (CVE-2023-32435, CVE-2023-32439)

  • High max 7.5
    ELSA-2023-4100 1 CVE

    Important: bind9.16 security update (Oracle Linux 8)

    [32:9.16.23-14.1] - Improve RBT overmem cache cleaning (CVE-2023-2828)

  • Medium max 7.8
    ELSA-2023-3837 1 CVE

    Moderate: systemd security and bug fix update (Oracle Linux 8)

    [239-74.0.4.2] - Fix CVE-2023-26604 - pager: set whenver we invoke a pager (lukas.lipinsky@oracle.com) (#2175624) - pager: make pager secure when under euid is changed or explicitly requested (lukas.lipinsky@oracle.com) (#2175624) - pager: lets check SYSTEMD_…

  • High max 7.5
    ELSA-2023-4102 1 CVE

    Important: bind security update (Oracle Linux 8)

    [32:9.11.36-8.1] - Improve RBT overmem cache cleaning (CVE-2023-2828)

  • High max 9.8
    ELSA-2023-12595 3 CVEs

    Important: pcs security update (Oracle Linux 9)

    [0.11.4-7] - Fix displaying differences between configuration checkpoints in "pcs config checkpoint diff" command - Fix "pcs stonith update-scsi-devices" command which was broken since Pacemaker-2.1.5-rc1 - Fixed loading of cluster status in the web interface…

  • High max 8.8
    ELSA-2023-4201 2 CVEs 2 exploited

    Important: webkit2gtk3 security update (Oracle Linux 9)

    [2.38.5-1.3] - Disable JIT (CVE-2023-32435, CVE-2023-32439)

  • High max 7.0
    ELSA-2023-12579 3 CVEs

    Important: aardvark-dns security update (Oracle Linux 8)

    runc [1:1.1.4-1.0.1] - rootless: fix /sys/fs/cgroup mounts to prevent CVE-2023-25809 - rootfs: prohibit symlinks that conflicts with readonlyPaths and/or maskedPaths to prevent CVE-2023-27561 - Prohibit /proc and /sys to be symlinks to prevent CVE-2023-28642 …

  • High max 8.6
    ELSA-2023-4035 5 CVEs

    Important: nodejs:18 security update (Oracle Linux 8)

    nodejs [1:18.14.2-3] - Update bundled c-ares to 1.19.1 Resolves: CVE-2022-4904 Resolves: CVE-2023-31124 CVE-2023-31130 CVE-2023-31147 CVE-2023-32067

  • High max 8.1
    ELSA-2023-4058 1 CVE

    Important: .NET 7.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [7.0.109-1.0.1] - Set TargetRid based on os release major version, add OL arm64 RuntimeIdentifier [Orabug: 34671152] [7.0.109-1] - Update to .NET SDK 7.0.109 and Runtime 7.0.9 - Resolves: RHBZ#2219632

  • High max 7.0
    ELSA-2023-12578 3 CVEs

    Important: buildah security update (Oracle Linux 8)

    runc [1:1.1.4-1.0.1] - rootless: fix /sys/fs/cgroup mounts to prevent CVE-2023-25809 - rootfs: prohibit symlinks that conflicts with readonlyPaths and/or maskedPaths to prevent CVE-2023-27561 - Prohibit /proc and /sys to be symlinks to prevent CVE-2023-28642 …

  • High max 7.5
    ELSA-2023-4034 4 CVEs

    Important: nodejs:16 security update (Oracle Linux 8)

    nodejs [1:16.19.1-2] - Update bundled c-ares to 1.19.1 Resolves: CVE-2023-31124 CVE-2023-31130 CVE-2023-31147 CVE-2023-32067

  • High max 7.5
    ELSA-2023-3811 1 CVE

    Important: python39:3.9 and python39-devel:3.9 security update (Oracle Linux 8)

    python39 [3.9.16-1.1] - Security fix for CVE-2023-24329

  • Critical max 9.4
    ELSA-2023-4030 1 CVE

    Critical: grafana security update (Oracle Linux 9)

    [9.0.9-3] - resolve CVE-2023-3128 grafana: Remove Email Lookup from oauth integrations (rhbz#2213701 rhbz#2213626)

  • High max 8.1
    ELSA-2023-4057 1 CVE

    Important: .NET 7.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [7.0.109-1.0.1] - Set TargetRid based on os release major version, add OL arm64 RuntimeIdentifier [Orabug: 34671152] [7.0.109-1] - Update to .NET SDK 7.0.109 and Runtime 7.0.9 - Resolves: RHBZ#2219632

  • High max 7.5
    ELSA-2023-4099 1 CVE

    Important: bind security update (Oracle Linux 9)

    [32:9.16.23-11.1] - Improve RBT overmem cache cleaning (CVE-2023-2828)

  • High
    ELSA-2023-4063 5 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [102.13.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [102.13.0-2] - Update to 102.13.0 build2 [102.13.0-1] - Update to 102.13.0 build1

  • High max 8.1
    ELSA-2023-4059 1 CVE

    Important: .NET 6.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [6.0.120-1.0.1] - Add missing Oracle Linux Runtime IDs [6.0.120-1] - Update to .NET SDK 6.0.120 and Runtime 6.0.20 - Resolves: RHBZ#2219637

  • High
    ELSA-2023-4076 5 CVEs

    Important: firefox security update (Oracle Linux 8)

    [102.13.0-2.0.1] - Updated homepages to use https [Orabug: 34648274] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [102.13.0-2] - Update to 102.13.0 build2 [102.13.0-1] - Update to 102.13.0 build1

  • High
    ELSA-2023-4064 5 CVEs

    Important: thunderbird security update (Oracle Linux 9)

    [102.13.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [102.13.0-2] - Update to 102.13.0 build2 [102.13.0-1] - Update to 102.13.0 build1

  • High
    ELSA-2023-4071 5 CVEs

    Important: firefox security update (Oracle Linux 9)

    [102.13.0-2.0.1] - Updated homepages to use https [Orabug: 34648274] [102.13.0-2] - Update to 102.13.0 build2 [102.13.0-1] - Update to 102.13.0 build1

  • High max 8.1
    ELSA-2023-4060 1 CVE

    Important: .NET 6.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [6.0.120-1.0.1] - Add missing Oracle Linux Runtime IDs [6.0.120-1] - Update to .NET SDK 6.0.120 and Runtime 6.0.20 - Resolves: RHBZ#2219637

  • High max 7.8
    ELSA-2023-12591 2 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

    [5.4.17-2136.321.4.el8] - tick/common: Align tick period during sched_timer setup (Thomas Gleixner) [Orabug: 35520079] - net/rds: Fix endless rds_send_xmit() loop if cp_index > 0 (Gerd Rausch) [Orabug: 35510149] [5.4.17-2136.321.3.el8] - selinux: don't use ma…

  • High max 7.8
    ELSA-2023-12588 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.321.4] - tick/common: Align tick period during sched_timer setup (Thomas Gleixner) [Orabug: 35520079] - net/rds: Fix endless rds_send_xmit() loop if cp_index > 0 (Gerd Rausch) [Orabug: 35510149] [5.4.17-2136.321.3] - selinux: don't use make's gro…

  • High max 7.8
    ELSA-2023-12590 2 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [5.4.17-2136.321.4.el7] - tick/common: Align tick period during sched_timer setup (Thomas Gleixner) [Orabug: 35520079] - net/rds: Fix endless rds_send_xmit() loop if cp_index > 0 (Gerd Rausch) [Orabug: 35510149] [5.4.17-2136.321.3.el7] - selinux: don't use ma…

  • High max 7.5
    ELSA-2023-3780 1 CVE

    Important: python27:2.7 security update (Oracle Linux 8)

    babel [2.5.1-10] - Fix CVE-2021-20095 Resolves: rhbz#1955615 Cython [0.28.1-7] - Bumping due to problems with modular RPM upgrade path - Resolves: rhbz#1695587 numpy [1:1.14.2-16] - Fix include path - Related: rhbz#1907601 pytest python2 [2.7.18-13.0.1.1] - F…

  • Medium max 8.8
    ELSA-2023-3821 3 CVEs

    Moderate: ruby:2.7 security, bug fix, and enhancement update (Oracle Linux 8)

    ruby [2.7.8-139] - Upgrade to Ruby 2.7.8. Resolves: rhbz#2149262 - Fix HTTP response splitting in CGI. Resolves: CVE-2021-33621 - Fix ReDoS vulnerability in URI. Resolves: CVE-2023-28755 - Fix ReDoS vulnerability in Time. Resolves: CVE-2023-28756 rubygem-abrt…

  • High max 7.5
    ELSA-2023-3781 1 CVE

    Important: python38:3.8 and python38-devel:3.8 security update (Oracle Linux 8)

    babel [2.7.0-11] - Fix CVE-2021-20095 Resolves: rhbz#1955615 Cython [0.29.14-4] - Exclude unsupported i686 arch mod_wsgi [4.6.8-4] - Core dumped upon file upload >= 1GB Resolves: rhbz#2125171 numpy [1.17.3-6] - Adjusted the postun scriptlets to enable upgradi…

  • Low max 3.9
    ELSA-2023-3949 1 CVE 1 exploited

    Low: open-vm-tools security update (Oracle Linux 8)

    [12.1.5-1.0.2] - [CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module

  • Critical max 9.8
    ELSA-2023-3923 4 CVEs

    Critical: go-toolset and golang security update (Oracle Linux 9)

    golang [1.19.10-1.0.1] - New Go version 1.19.10 [CVE-2023-29402] [CVE-2023-29403] [CVE-2023-29404] [CVE-2023-29405] go-toolset [1.19.10-1.0.1] - New Go version 1.19.10 [CVE-2023-29402] [CVE-2023-29403] [CVE-2023-29404] [CVE-2023-29405]

  • Low max 3.9
    ELSA-2023-3948 1 CVE 1 exploited

    Low: open-vm-tools security update (Oracle Linux 9)

    [12.1.5-1.0.2] - [CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module

  • High max 7.8
    ELSA-2023-12566 7 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.76.2] - firewire: fix potential uaf in outbound_phy_packet_callback() (Chengfeng Ye) [Orabug: 35493606] {CVE-2023-3159} - ath9k: fix use-after-free in ath9k_hif_usb_rx_cb (Pavel Skripkin) [Orabug: 35448003] {CVE-2022-1679} - dm ioctl: fix nested l…

  • Critical max 9.8
    ELSA-2023-3922 4 CVEs

    Critical: go-toolset:ol8 security update (Oracle Linux 8)

    delve [1.9.1-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.9.1-1] - Rebase to 1.9.1 - Related: rhbz#2131026 golang [1.19.10-1.0.1] - New Go version 1.19.10 [CVE-2023-29402] [CVE-2023-29403] [CVE-2023-29404] [CVE-2023-29405] go-toolse…

  • High max 6.5
    ELSA-2023-25545 2 CVEs

    Important: olcne security update (Oracle Linux 7)

    [1.6.2-1] - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11 - Add all modules to registry-image-helper - update yq to 4.x

  • High max 6.5
    ELSA-2023-12562 2 CVEs

    Important: kubernetes security update (Oracle Linux 7)

    kubernetes [1.24.8-2] - libct/cg: add misc controller to v1 drivers (upstream runc patch) [1.24.8-1] - Added Oracle specific build files for Kubernetes olcne [1.5.13-1] - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.24.15 - Added script to support up…

  • High max 6.5
    ELSA-2023-12563 2 CVEs

    Important: kubernetes security update (Oracle Linux 7)

    kubernetes [1.25.11-1] - Added Oracle specific build files for Kubernetes olcne [1.6.2-1] - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11 - Add all modules to registry-image-helper - update yq to 4.x [1.6.1-9] - Updated the CVE ID's in Istio-1.1…