Oracle Linux Security Advisories (ELSA)

8,321 results · Feed

• Medium max 8.6
  ELSA-2023-2654 8 CVEs

  Moderate: nodejs:18 security, bug fix, and enhancement update (Oracle Linux 9)

  nodejs [1:18.14.2-2] - Provide simduft - Resolves: #2159389 [1:18.14.2-1] - Rebase to 18.14.2 - Resolves: #2159389 - Resolves: CVE-2022-25881, CVE-2022-4904, CVE-2023-23936, CVE-2023-24807 - Resolves: CVE-2023-23918, CVE-2023-23919, CVE-2023-23920 nodejs-node…

  May 17, 2023
• High max 7.5
  ELSA-2023-3148 1 CVE

  Important: libreswan security update (Oracle Linux 9)

  [4.9-4.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.9-4] - Just bumping up the version as an incorrect 9.3 build was created. - Related: rhbz#2187171 [4.9-3] - Fix CVE-2023-30570:Malicious IKEv1 Aggressive Mode packets can crash libreswa…

  May 17, 2023
• High
  ELSA-2023-3147 1 CVE

  Important: apr-util security update (Oracle Linux 9)

  [1.6.1-20.1] - Resolves: #2196575 - CVE-2022-25147 apr-util: out-of-bounds writes in the apr_base64

  May 17, 2023
• High max 8.8
  ELSA-2023-3150 7 CVEs

  Important: thunderbird security update (Oracle Linux 9)

  [102.11.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [102.11.0-1] - Update to 102.11.0 build1

  May 17, 2023
• High max 7.5
  ELSA-2023-2621 37 CVEs

  Important: mysql security update (Oracle Linux 9)

  [8.0.32-1] - Update to MySQL 8.0.32 [8.0.31-1] - Update to MySQL 8.0.31

  May 17, 2023
• Medium
  ELSA-2023-2645 1 CVE

  Moderate: openssh security update (Oracle Linux 9)

  [8.7p1-29] - Resolve possible self-DoS with some clients Resolves: rhbz#2186473

  May 17, 2023
• Medium max 8.6
  ELSA-2023-2655 6 CVEs

  Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update (Oracle Linux 9)

  nodejs [1:16.19.1-1] - Rebase to 16.19.1 - Resolves: rhbz#2153714 - Resolves: CVE-2023-23918 CVE-2023-23919 CVE-2023-23936 CVE-2023-24807 CVE-2023-23920 - Resolves: CVE-2022-25881 CVE-2022-4904 nodejs-nodemon [2.0.20-3] - Patch bundled glob-parent - Resolves:…

  May 17, 2023
• Medium max 6.5
  ELSA-2023-2633 1 CVE

  Moderate: libreswan security update (Oracle Linux 9)

  [4.9-2.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.9-2] - Fix CVE-2023-23009: remote DoS via crafted TS payload with an incorrect selector length (rhbz#2173674)

  May 17, 2023
• High max 6.0
  ELSA-2023-12328 1 CVE

  Important: qemu-kvm security update (Oracle Linux 9)

  [6.1.1-6.el9] - Update changelog (Karl Heubaum) [Orabug: 35343538] - ebpf: fix compatibility with libbpf 1.0+ (Shreesh Adiga) [Orabug: 35268538] - ebpf: replace deprecated bpf_program__set_socket_filter (Haochen Tong) [Orabug: 35268538] - CVE-2023-1544 is not…

  May 16, 2023
• High max 7.8
  ELSA-2023-12342 2 CVEs

  Important: virt:kvm_utils security update (Oracle Linux 8)

  hivex libguestfs libguestfs-winsupport libiscsi libnbd libvirt [5.7.0-40] - build: change dependency to allow post install erasing of /usr/bin/nc (Wim ten Have) [Orabug: 35289777] - util: Make virFileClose() quiet on success (Andrea Bolognani) [Orabug: 350908…

  May 15, 2023
• Medium max 5.9
  ELSA-2023-2326 9 CVEs

  Moderate: freerdp security update (Oracle Linux 9)

  [2:2.4.1-5] - Fix 'implicit declaration of function' errors (#2136155, #2145140) [- 2:2.4.1-4] - CVE-2022-39282: Fix length checks in parallel driver (#2136152) - CVE-2022-39283: Add missing length check in video channel (#2136154) - CVE-2022-39316, CVE-2022-…

  May 15, 2023
• Medium
  ELSA-2023-2589 1 CVE

  Moderate: autotrace security update (Oracle Linux 9)

  [0.31.1-65] - Resolves: rhbz#2121828 Fix the gating tests by using only local test Upstream testsuite will not work as this package code is very old [0.31.1-64] - Resolves: rhbz#2121828 CVE-2022-32323 - heap-buffer overflow via the ReadImage() at input-bmp.c

  May 15, 2023
• Low
  ELSA-2023-2582 1 CVE

  Low: lua security update (Oracle Linux 9)

  [5.4.4-3] - Apply upstream patch for CVE-2022-28805

  May 15, 2023
• Medium max 8.8
  ELSA-2023-2248 9 CVEs

  Moderate: xorg-x11-server security and bug fix update (Oracle Linux 9)

  [1.20.11-17] - Fix xvfb-run script with --listen-tcp Resolves: rhbz#2172116 [1.20.11-16] - CVE-2023-0494 (#2166973) [1.20.11-15] - Follow-up fix for CVE-2022-46340 (#2151776) [1.20.11-14] - CVE fix for: CVE-2022-4283 (#2151801), CVE-2022-46340 (#2151776), CVE…

  May 15, 2023
• Medium max 7.8
  ELSA-2023-2366 1 CVE

  Moderate: emacs security and bug fix update (Oracle Linux 9)

  [1:27.2-8] - Use a 64KB page size for pdump (#1979804) [1:27.2-7] - Fix ctags local command execute vulnerability (#2149387)

  May 15, 2023
• Low max 7.5
  ELSA-2023-2523 1 CVE

  Low: openssl security and bug fix update (Oracle Linux 9)

  [3.0.7-6.0.1] - Replace upstream references [Orabug: 34340177] [1:3.0.7-6] - Fixes RNG slowdown in FIPS mode Resolves: rhbz#2168224 [1:3.0.7-5] - Fixed X.509 Name Constraints Read Buffer Overflow Resolves: CVE-2022-4203 - Fixed Timing Oracle in RSA Decryption…

  May 15, 2023
• Medium max 7.5
  ELSA-2023-2204 5 CVEs

  Moderate: Image Builder security, bug fix, and enhancement update (Oracle Linux 9)

  cockpit-composer [45-1.0.1] - Make per page documentation links point to Oracle Linux [Orabug: 32013095], [Orabug:34398922] [45-1] - New upstream release [44-1] - New upstream release [43-1] - New upstream release [42-1] - New upstream release osbuild [81-1] …

  May 15, 2023
• Medium max 7.5
  ELSA-2023-2167 5 CVEs

  Moderate: grafana security and enhancement update (Oracle Linux 9)

  [9.0.9-2] - resolve CVE-2022-39229 grafana: Using email as a username can prevent other users from signing in - resolve CVE-2022-2880 CVE-2022-41715 grafana: various flaws [9.0.9-1] - update to 9.0.9 tagged upstream community sources, see CHANGELOG - resolve …

  May 15, 2023
• Medium max 5.7
  ELSA-2023-2161 1 CVE

  Moderate: fence-agents security and bug fix update (Oracle Linux 9)

  [4.10.0-43] - fence_vmware_soap: set login_timeout lower than default pcmk_monitor_timeout (20s) to remove tmp dirs Resolves: rhbz#2122944 [4.10.0-42] - fencing/fence_wti: add --plug-separator to be able to avoid characters that are in node name(s) Resolves: …

  May 15, 2023
• Medium max 8.8
  ELSA-2023-2249 9 CVEs

  Moderate: xorg-x11-server-Xwayland security update (Oracle Linux 9)

  [21.1.3-7] - Fix CVE-2023-0494 (#2166974) [21.1.3-6] - Follow-up fix for CVE-2022-46340 (#2151778) [21.1.3-5] - CVE fix for: CVE-2022-4283 (#2151803), CVE-2022-46340 (#2151778), CVE-2022-46341 (#2151783), CVE-2022-46342 (#2151786), CVE-2022-46343 (#2151793), …

  May 15, 2023
• Medium
  ELSA-2023-2293 1 CVE

  Moderate: pki-core security, bug fix, and enhancement update (Oracle Linux 9)

  jss [5.3.0-1] - Rebase to JSS 5.3.0 [5.3.0-0.3.beta2] - Rebase to JSS 5.3.0-beta2 - Bug 2017098 - pki pkcs12-cert-add command failing with 'Unable to validate PKCS #12 file: Digests do not match' exception [5.3.0-0.2.beta1] - Rebase to JSS 5.3.0-beta1 ldapjdk…

  May 15, 2023
• High max 7.5
  ELSA-2023-2165 5 CVEs

  Important: edk2 security, bug fix, and enhancement update (Oracle Linux 9)

  [20221207gitfff6d81270b5-9] - edk2-remove-amd-sev-feature-flag-from-secure-boot-builds-.patch [bz#2169247] - Resolves: bz#2169247 ([edk2] Install a sev guest with enrolled secure boot failed) [20221207gitfff6d81270b5-8] - edk2-OvmfPkg-disable-dynamic-mmio-win…

  May 15, 2023
• Low max 5.9
  ELSA-2023-2478 2 CVEs

  Low: curl security update (Oracle Linux 9)

  [7.76.1-23] - fix HTTP multi-header compression denial of service (CVE-2023-23916) [7.76.1-22] - smb/telnet: fix use-after-free when HTTP proxy denies tunnel (CVE-2022-43552) [7.76.1-21] - fix POST following PUT confusion (CVE-2022-32221) [7.76.1-20] - contro…

  May 15, 2023
• Medium max 6.3
  ELSA-2023-2373 1 CVE

  Moderate: wireshark security and bug fix update (Oracle Linux 9)

  [1:3.4.10-4] - Resolves: #2152064 - CVE-2022-3190 wireshark: f5ethtrailer Infinite loop in legacy style dissector [1:3.4.10-3] - Resolves: #2083581 - capinfos aborts in FIPS [1:3.4.10-2] - Resolves: #2160648 - Enhanced TMT testing for centos-stream

  May 15, 2023
• Medium max 7.5
  ELSA-2023-2177 1 CVE

  Moderate: grafana-pcp security and enhancement update (Oracle Linux 9)

  [5.1.1-1] - update to 5.1.1 tagged upstream community sources, see CHANGELOG - resolve CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY [5.0.0-4] - update to 5.0.0 tagged upstream community sources, see CHANGELOG - install plugin in …

  May 15, 2023
• Medium max 7.5
  ELSA-2023-2261 4 CVEs

  Moderate: bind security and bug fix update (Oracle Linux 9)

  [32:9.16.23-11] - Correct backport issue in statistics rendering fix (#2126912) [32:9.16.23-10] - Handle subtle difference between upstream and rhel (CVE-2022-3094) [32:9.16.23-9] - Prevent flooding with UPDATE requests (CVE-2022-3094) - Handle RRSIG queries …

  May 15, 2023
• Medium max 4.7
  ELSA-2023-2378 1 CVE

  Moderate: postgresql-jdbc security update (Oracle Linux 9)

  [42.2.27-1] - rebase to 42.2.27 - fix for CVE-2022-41946

  May 15, 2023
• Medium max 6.5
  ELSA-2023-2502 2 CVEs

  Moderate: dhcp security and enhancement update (Oracle Linux 9)

  [12:4.4.2-18.b1] - Fix for CVE-2022-2928 - Fix for CVE-2022-2929 - Use systemd-sysusers for dhcp user and group (#2095396)

  May 15, 2023
• Medium
  ELSA-2023-2259 1 CVE

  Moderate: poppler security and bug fix update (Oracle Linux 9)

  [21.01.0-14] - Check for overflow when computing number of symbols - in JBIG2 text region - Resolves: #2126364

  May 15, 2023
• Medium max 6.7
  ELSA-2023-2179 5 CVEs

  Moderate: libguestfs-winsupport security update (Oracle Linux 9)

  [9.2-1] - Rebase to ntfs-3g 2022.5.17 - Fixes: CVE-2021-46790, CVE-2022-30783, CVE-2022-30784, CVE-2022-30785, CVE-2022-30786, CVE-2022-30787, CVE-2022-30788, CVE-2022-30789 resolves: rhbz#2127235 rhbz#2127242 (also 2127264 2127250 2127257)

  May 15, 2023
• Medium max 7.5
  ELSA-2023-2357 10 CVEs

  Moderate: git-lfs security and bug fix update (Oracle Linux 9)

  [3.2.0-1] - Update to 3.2.0 - Resolves: #2139383 [2.13.3-4] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 [2.13.3-3] - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 [2.13.3-2] - Fixed name of source tarball - Fixed da…

  May 15, 2023
• High max 8.8
  ELSA-2023-2256 22 CVEs

  Important: webkit2gtk3 security and bug fix update (Oracle Linux 9)

  [2.38.5-1] - Update to 2.38.5 Related: #2127467 [2.38.4-1] - Update to 2.38.4 Related: #2127467 [2.38.3-1] - Update to 2.38.3 Related: #2127467 [2.38.2-1] - Update to 2.38.2 Related: #2127467 [2.38.1-2] - Fix use with aarch64 64 KiB page size Related: #212746…

  May 15, 2023
• Medium max 7.5
  ELSA-2023-2312 1 CVE

  Moderate: jackson security update (Oracle Linux 9)

  jackson-annotations [2.14.1-1] - Update to version 2.14.1 - Resolves: #2070122 jackson-core [2.14.1-1] - Update to version 2.14.1 - Resolves: #2070122 jackson-databind [2.14.1-1] - Update to version 2.14.1 - Resolves: #2070122 jackson-jaxrs-providers [2.14.1-…

  May 15, 2023
• Medium max 5.3
  ELSA-2023-2282 2 CVEs

  Moderate: podman security and bug fix update (Oracle Linux 9)

  [4.4.1-3.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [2:4.4.1-3] - update to the latest content of https://github.com/containers/podman/tree/v4.4.1-rhel (https://github.com/containers/podman/commit/e1703bb) - Related:…

  May 15, 2023
• Medium
  ELSA-2023-2216 2 CVEs

  Moderate: gdk-pixbuf2 security update (Oracle Linux 9)

  [2.42.6-3] - Backport fixes for CVE-2021-46829 and CVE-2021-44648 - Resolves: rhbz#2115213 - Resolves: rhbz#2044346

  May 15, 2023
• Medium
  ELSA-2023-2202 1 CVE

  Moderate: frr security, bug fix, and enhancement update (Oracle Linux 9)

  [8.3.1-5] - Resolves: #2147522 - It is not possible to run FRR as a non-root user [8.3.1-4] - Resolves: #2144500 - AVC error when reloading FRR with provided reload script [8.3.1-3] - Related: #2129743 - Adding missing rules for vtysh and other daemons [8.3.1…

  May 15, 2023
• Medium max 7.0
  ELSA-2023-2234 1 CVE

  Moderate: sysstat security and bug fix update (Oracle Linux 9)

  [12.5.4-5.0.1] - add mpstat -H option to also display physically hotplugged vCPUs [Orabug: 34683087] [12.5.4-5] - Fix --dec argument validation (rhbz#2080650) [12.5.4-4] - arithmetic overflow in allocate_structures() on 32 bit systems (CVE-2022-39377)

  May 15, 2023
• Medium max 8.5
  ELSA-2023-2319 4 CVEs

  Moderate: git security and bug fix update (Oracle Linux 9)

  May 15, 2023
• Medium
  ELSA-2023-2260 7 CVEs

  Moderate: gstreamer1-plugins-good security update (Oracle Linux 9)

  [1.18.4-6] - Fixes for CVE-2022-1920, CVE-2022-1921, CVE-2022-1922, CVE-2022-1923, CVE-2022-1924, CVE-2022-1925, CVE-2022-2122 Resolves: rhbz#2131034, rhbz#2131039, rhbz#2131045, rhbz#2131049, rhbz#2131054, rhbz#2131060, rhbz#2131064

  May 15, 2023
• Medium max 7.5
  ELSA-2023-2258 1 CVE

  Moderate: python-mako security update (Oracle Linux 9)

  [1.1.4-6] - Fix CVE-2022-40023 (#2133606)

  May 15, 2023