Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

Medium max 7.8

ELSA-2023-3481 1 CVE

Moderate: emacs security update (Oracle Linux 7)

[1:24.3-23.1] - Fix htmlfontify.el command injection vulnerability (#2175177)

Jun 7, 2023
High max 7.8

ELSA-2023-12375 7 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.75.3] - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Gwangun Jung) [Orabug: 35354791] {CVE-2023-2248} [4.1.12-124.75.2] - prlimit: do_prlimit needs to have a speculation check (Greg Kroah-Hartman) [Orabug: 35354303] {CVE-20…

Jun 7, 2023
High max 8.8

ELSA-2023-3433 2 CVEs 2 exploited

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.38.5-1.4] - Add patch for CVE-2023-28204 Resolves: #2209744 - Add patch for CVE-2023-32373 Resolves: #2209727

Jun 6, 2023
High max 8.8

ELSA-2023-3425 1 CVE

Important: cups-filters security update (Oracle Linux 8)

[1.20.0-29.0.1] - header/footer not being printed in banner page. [Orabug: 28265099] (isaac.chen@oracle.com) - Fixes [Orabug: 29163824] source indentation not following convention (isaac.chen@oracle.com) [1.20.0-29.2] - CVE-2023-24805 cups-filters: remote cod…

Jun 6, 2023
High max 8.8

ELSA-2023-3432 2 CVEs 2 exploited

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.38.5-1.2] - Add patch for CVE-2023-28204 Resolves: #2209747 - Add patch for CVE-2023-32373 Resolves: #2209730

Jun 6, 2023
High max 8.8

ELSA-2023-3423 1 CVE

Important: cups-filters security update (Oracle Linux 9)

[1.28.7-11.0.1] - header/footer not being printed in banner page. [Orabug: 28265099] (isaac.chen@oracle.com) - Fixes [Orabug: 29163824] source indentation not following convention (isaac.chen@oracle.com) [1.28.7-11.1] - CVE-2023-24805 cups-filters: remote cod…

Jun 6, 2023
High max 8.2

ELSA-2023-23649 6 CVEs

Important: olcne security update (Oracle Linux 7)

[1.6.1-9] - Updated the CVE ID's in Istio-1.16.4 changelog entry * [1.6.1-8] - Update Istio config to include 1.15.7 to support upgrade from 1.5.x to 1.6.x * [1.6.1-7] - Bugfix:Append a slash in oci-instance-metada query url * [1.6.1-6] - Fixed helm installat…

Jun 2, 2023
High max 8.2

ELSA-2023-12355 6 CVEs

Important: istio security update (Oracle Linux 7)

istio [1.16.4-1] - Added Oracle specific files for 1.16.4-1 kubernetes [1.25.7-2] - libct/cg: add misc controller to v1 drivers (upstream runc patch) olcne [1.6.1-9] - Updated the CVE ID's in Istio-1.16.4 changelog entry [1.6.1-8] - Update Istio config to inc…

Jun 2, 2023
High max 8.2

ELSA-2023-12357 6 CVEs

Important: istio security update (Oracle Linux 7)

istio [1.15.7-1] - Added Oracle specific files for 1.15.7-1 kubernetes [1.24.8-2] - libct/cg: add misc controller to v1 drivers (upstream runc patch) [1.24.8-1] - Added Oracle specific build files for Kubernetes olcne [1.5.12-6] - Updated the CVE ID's in Isti…

Jun 2, 2023
High max 8.2

ELSA-2023-12354 6 CVEs

Important: istio security update (Oracle Linux 8)

istio [1.16.4-1] - Added Oracle specific files for 1.16.4-1 kubernetes [1.25.7-2] - libct/cg: add misc controller to v1 drivers (upstream runc patch) olcne [1.6.1-9] - Updated the CVE ID's in Istio-1.16.4 changelog entry [1.6.1-8] - Update Istio config to inc…

Jun 2, 2023
High max 8.2

ELSA-2023-23648 6 CVEs

Important: olcne security update (Oracle Linux 8)

[1.6.1-9] - Updated the CVE ID's in Istio-1.16.4 changelog entry * [1.6.1-8] - Update Istio config to include 1.15.7 to support upgrade from 1.5.x to 1.6.x * [1.6.1-7] - Bugfix:Append a slash in oci-instance-metada query url * [1.6.1-6] - Fixed helm installat…

Jun 2, 2023
High max 8.2

ELSA-2023-12356 6 CVEs

Important: istio security update (Oracle Linux 8)

istio [1.15.7-1] - Added Oracle specific files for 1.15.7-1 kubernetes [1.24.8-2] - libct/cg: add misc controller to v1 drivers (upstream runc patch) [1.24.8-1] - Added Oracle specific build files for Kubernetes olcne [1.5.12-6] - Updated the CVE ID's in Isti…

Jun 2, 2023
High max 6.0

ELSA-2023-12358 1 CVE

Important: virt:kvm_utils2 security update (Oracle Linux 8)

hivex libguestfs libguestfs-winsupport libiscsi libnbd libtpms libvirt libvirt-dbus libvirt-python nbdkit netcf perl-Sys-Virt qemu-kvm [6.1.1-6-el8] - CVE-2023-1544 is not applicable to Oracle QEMU 6.1.1 (Karl Heubaum) [Orabug: 35305727] {CVE-2023-1544} - vir…

Jun 2, 2023
High max 7.8

ELSA-2023-12368 2 CVEs

Important: qemu security update (Oracle Linux 7)

[15:4.2.1-26.el7] - migration: check magic value for deciding the mapping of channels (manish.mishra) [Orabug: 34735462] - io: Add support for MSG_PEEK for socket channel (manish.mishra) [Orabug: 34735462] - migration: Move channel setup out of postcopy_try_r…

Jun 1, 2023
High max 7.8

ELSA-2023-3349 1 CVE

Important: kernel security and bug fix update (Oracle Linux 8)

[4.18.0-477.13.1_8.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

Jun 1, 2023
Medium max 7.5

ELSA-2023-3082 2 CVEs

Moderate: pcs security update (Oracle Linux 8)

[0.10.15-4.0.1.el8_8.1] - Replace HAM-logo.png with a generic one [0.10.15-4.el8_8.1] - Fix displaying differences between configuration checkpoints in pcs config checkpoint diff command - Fix pcs stonith update-scsi-devices command which was broken since Pac…

May 29, 2023
Medium

ELSA-2023-3083 2 CVEs

Moderate: go-toolset:ol8 security and bug fix update (Oracle Linux 8)

delve [1.9.1-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.9.1-1] - Rebase to 1.9.1 - Related: rhbz#2131026 golang [1.19.6-1] - Rebase to Go 1.19.6 - Resolves: rhbz#2174430 [1.19.4-2] - Fix memory leaks in EVP_{sign,verify}_raw - Res…

May 25, 2023
Medium max 5.9

ELSA-2023-3106 1 CVE

Moderate: curl security and bug fix update (Oracle Linux 8)

[7.61.1-30.el8_8.2] - sftp: do not specify O_APPEND when not in append mode (#2187717) [7.61.1-30.el8_8.1] - fix FTP too eager connection reuse (CVE-2023-27535)

May 25, 2023
High max 9.8

ELSA-2023-3319 1 CVE

Important: go-toolset:ol8 security update (Oracle Linux 8)

delve [1.9.1-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.9.1-1] - Rebase to 1.9.1 - Related: rhbz#2131026 golang [1.19.9-1] - Rebase to Go 1.19.9 - Resolves: rhbz#2204473 go-toolset [1.19.9-1] - Rebase to Go 1.19.9 - Resolves: rhbz…

May 25, 2023
High max 7.5

ELSA-2023-3087 37 CVEs

Important: mysql:8.0 security, bug fix, and enhancement update (Oracle Linux 8)

mecab [0.996-2.12] - Bump version for 'mysql' module rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'AppStream' repo - Resolves: #2180411 mecab-ipadic mysql [8.0.32-1] - Update to MySQL 8.0.32 [8.0.31-1] - Update to MySQL 8.0.31

May 25, 2023
High max 7.8

ELSA-2023-3104 1 CVE

Important: emacs security update (Oracle Linux 8)

[1:26.1-10.2] - Bump release [1:26.1-10.1] - Bump release [1:26.1-10] - Fix ob-latex.el command injection vulnerability (#2180586) [1:26.1-9] - Fix MH-E mail composition with GNU Mailutils (#1991156) [1:26.1-8] - Fix ctags local command execute vulnerability …

May 25, 2023
High max 9.8

ELSA-2023-3318 1 CVE

Important: go-toolset and golang security update (Oracle Linux 9)

golang [1.19.9-2] - Fix TestEncryptOAEP and TLS failures in FIPS mode - Resolves: rhbz#2204476 [1.19.9-1] - Rebase to Go 1.19.9 - Resolves: rhbz#2204476 go-toolset [1.19.9-1] - Update to Go 1.19.9 - Related: rhbz#2204476

May 25, 2023
Medium max 7.5

ELSA-2023-2785 1 CVE

Moderate: grafana-pcp security update (Oracle Linux 8)

[3.2.0-3] - resolve CVE-2022-27664 grafana-pcp: golang: net/http: handle server errors after sending GOAWAY

May 24, 2023
Medium max 6.5

ELSA-2023-3000 2 CVEs

Moderate: dhcp security and bug fix update (Oracle Linux 8)

[12:4.3.6-49] - Fix for CVE-2022-2928 - Fix for CVE-2022-2929 - send back dhcp6.vendor-opts again (#2142024)

May 24, 2023
Medium max 7.5

ELSA-2023-3097 5 CVEs

Moderate: gssntlmssp security update (Oracle Linux 8)

[1.2.0-1] - New release 1.2.0 - Fix CVE-2023-25563: multiple out-of-bounds read when decoding NTLM fields - Fix CVE-2023-25564: memory corruption when decoding UTF16 strings - Fix CVE-2023-25565: incorrect free when decoding target information - Fix CVE-2023-…

May 24, 2023
Medium

ELSA-2023-2948 1 CVE

Moderate: device-mapper-multipath security and bug fix update (Oracle Linux 8)

[0.8.4-37] - Fix bugzilla linked to the changes (was previously linked to the wrong bug, 2162537) - Resolves: bz #2166468 [0.8.4-36] - Add 0129-libmultipath-select-resize-action-even-if-reload-is-.patch - Add 0130-libmultipath-cleanup-ACT_CREATE-code-in-selec…

May 24, 2023
High

ELSA-2023-3109 1 CVE

Important: apr-util security update (Oracle Linux 8)

[1.6.1-6.1] - Resolves: #2196572 - CVE-2022-25147 apr-util: out-of-bounds writes in the apr_base64

May 24, 2023
Medium max 7.5

ELSA-2023-2860 1 CVE

Moderate: python27:2.7 security update (Oracle Linux 8)

babel [2.5.1-10] - Fix CVE-2021-20095 Resolves: rhbz#1955615 [2.5.1-9] - Bumping due to problems with modular RPM upgrade path - Resolves: rhbz#1695587 [2.5.1-8] - Fix unversioned requires/buildrequires - Resolves: rhbz#1628242 [2.5.1-7] - Remove unversioned …

May 24, 2023
Medium max 6.3

ELSA-2023-2883 2 CVEs

Moderate: libtiff security update (Oracle Linux 8)

[4.0.9-27] - Fix various CVEs - Resolves: CVE-2022-3627 CVE-2022-3970

May 24, 2023
Medium max 4.7

ELSA-2023-2867 1 CVE

Moderate: postgresql-jdbc security update (Oracle Linux 8)

[42.2.14-2] - Fix CVE-2022-41946

May 24, 2023
Medium max 5.3

ELSA-2023-2866 3 CVEs

Moderate: git-lfs security and bug fix update (Oracle Linux 8)

[3.2.0-2] - Rebuild with Golang-1.19.4 - Resolves: #2163744 [3.2.0-1] - Update to version 3.2.0 - Resolves: #2139382 [2.13.3-2] - Define %gobuild macro with proper ldflags - Related: rhbz#2021549 [2.13.3-1] - Update to version 2.13.3 - Fixed round brackets in…

May 24, 2023
Medium max 5.9

ELSA-2023-2851 9 CVEs

Moderate: freerdp security update (Oracle Linux 8)

[2:2.2.0-10] - Fix 'implicit declaration of function' errors (#2136153, #2145139) [- 2:2.2.0-9] - CVE-2022-39282: Fix length checks in parallel driver (#2136151) - CVE-2022-39283: Add missing length check in video channel (#2136153) - CVE-2022-39316, CVE-2022…

May 24, 2023
High max 7.5

ELSA-2023-3246 5 CVEs

Important: git security update (Oracle Linux 8)

[2.39.3-1] - Update to 2.39.3 - Resolves: #2188364, #2188373, #2190157, #2190158

May 24, 2023
Low max 5.9

ELSA-2023-2963 2 CVEs

Low: curl security and bug fix update (Oracle Linux 8)

[7.61.1-30] - fix HTTP multi-header compression denial of service (CVE-2023-23916) [7.61.1-29] - h2: lower initial window size to 32 MiB (#2166254) [7.61.1-28] - smb/telnet: fix use-after-free when HTTP proxy denies tunnel (CVE-2022-43552) [7.61.1-27] - upon …

May 24, 2023
High max 7.5

ELSA-2023-2932 4 CVEs

Important: edk2 security update (Oracle Linux 8)

[20220126gitbb1bba3d77-4] - edk2-openssl-update.patch [bz#2164531 bz#2164543 bz#2164558 bz#2164581] - edk2-rh-openssl-add-crypto-bn-rsa_sup_mul.c-to-file-list.patch [bz#2164531 bz#2164543 bz#2164558 bz#2164581] - Resolves: bz#2164531 (CVE-2023-0286 edk2: open…

May 24, 2023
High max 8.8

ELSA-2023-3221 7 CVEs

Important: thunderbird security update (Oracle Linux 8)

[102.11.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [102.11.0-1] - Update to 102.11.0 build1

May 24, 2023
Medium max 7.5

ELSA-2023-2771 1 CVE

Moderate: unbound security and bug fix update (Oracle Linux 8)

[1.16.2-5] - Stop creating wrong devel manual pages (#2135322) [1.16.2-4] - Apply correctly previous change (CVE-2022-3204) [1.16.2-3] - Fix NRDelegation attack leading to uncontrolled resource consumption (CVE-2022-3204)

May 24, 2023
Medium max 7.5

ELSA-2023-2784 4 CVEs

Moderate: grafana security update (Oracle Linux 8)

[7.5.15-4] - resolve CVE-2022-39229 grafana: using email as a username can block other users from signing in - resolve CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY - resolve CVE-2022-41715 golang: regexp/syntax: limit memory used…

May 24, 2023
Medium max 8.8

ELSA-2023-2805 9 CVEs

Moderate: xorg-x11-server-Xwayland security update (Oracle Linux 8)

[21.1.3-10] - Fix CVE-2023-0494 (#2166972) [21.1.3-9] - Follow-up fix for CVE-2022-46340 (#2151777) [21.1.3-8] - CVE fix for: CVE-2022-4283 (#2151802), CVE-2022-46340 (#2151777), CVE-2022-46341 (#2151782), CVE-2022-46342 (#2151785), CVE-2022-46343 (#2151792),…

May 24, 2023
Medium max 7.5

ELSA-2023-2780 5 CVEs

Moderate: Image Builder security, bug fix, and enhancement update (Oracle Linux 8)

cockpit-composer [45-1.0.1] - Make per page documentation links point to Oracle Linux [Orabug: 32013095] [45-1] - New upstream release [44-1] - New upstream release [43-1] - New upstream release [42-1] - New upstream release [40-1] - New upstream release [39-…

May 24, 2023