Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

High max 7.8

ELSA-2023-1551 1 CVE

Important: tigervnc security update (Oracle Linux 8)

[1.12.0-9.3] - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability Resolves: bz#2180304 [1.12.0-9.2] - Add sanity check when cleaning up keymap changes Resolves: bz#2169962

Apr 4, 2023
High max 5.5

ELSA-2023-1572 1 CVE

Important: pesign security update (Oracle Linux 8)

[0.112-27.0.1] - Update Oracle Linux test certificates [Orabug: 31928433] - Apply pesigcheck-Mark-the-imported-certificate-as-trusted.patch [Orabug: 31928433] - update Oracle Linux certificates (Alexey Petrenko) - remove obsoletes of pesign-rh-test-certs [Ora…

Apr 4, 2023
Medium max 7.4

ELSA-2023-1569 1 CVE

Moderate: gnutls security and bug fix update (Oracle Linux 8)

[3.6.16-6] - Fix x86_64 CPU feature detection when AVX is not available (#2131152) - Fix timing side-channel in TLS RSA key exchange (#2162598)

Apr 4, 2023
High max 7.8

ELSA-2023-1592 1 CVE

Important: tigervnc security update (Oracle Linux 9)

[1.12.0-5.2] - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability Resolves: bz#2180308

Apr 4, 2023
High max 5.8

ELSA-2023-12226 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-100.96.32] - crypto: Report fips module name and version for aarch64 (Saeed Mirzamohammadi) [Orabug: 35225251] - uek-rpm: Enable RFC7919 config for aarch64 (Saeed Mirzamohammadi) [Orabug: 35225251] [5.15.0-100.96.31] - uek-rpm: Update linux-firmware d…

Apr 4, 2023
High max 7.9

ELSA-2023-1470 3 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

- [5.14.0-162.22.2_1.OL9] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.g…

Mar 28, 2023
High max 7.4

ELSA-2023-12205 1 CVE

Important: openssl security update (Oracle Linux 7)

[1.0.2k-26_fips] - Change Epoch from 1 to 10 - Fix DH self-test to add shared secret comparison [Orabug: 32467026] - Add DH support changes for SP 800-56A rev3 requirements [Orabug: 32467059] - Add TLS KDF self-test [Orabug: 32467193] - Add EC keys pairwise c…

Mar 22, 2023
High max 8.8

ELSA-2023-1401 5 CVEs

Important: thunderbird security update (Oracle Linux 7)

[102.9.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [102.9.0-1] - Update to 102.9.0 build1

Mar 22, 2023
High max 8.8

ELSA-2023-1403 5 CVEs

Important: thunderbird security update (Oracle Linux 8)

[102.9.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [102.9.0-1] - Update to 102.9.0 build1

Mar 22, 2023
High max 7.5

ELSA-2023-1405 4 CVEs

Important: openssl security update (Oracle Linux 8)

[1:1.1.1k-9] - Fixed Timing Oracle in RSA Decryption Resolves: CVE-2022-4304 - Fixed Double free after calling PEM_read_bio_ex Resolves: CVE-2022-4450 - Fixed Use-after-free following BIO_new_NDEF Resolves: CVE-2023-0215 - Fixed X.400 address type confusion i…

Mar 22, 2023
High max 8.8

ELSA-2023-1407 5 CVEs

Important: thunderbird security update (Oracle Linux 9)

[102.9.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [102.9.0-1] - Update to 102.9.0 build1

Mar 22, 2023
High max 7.8

ELSA-2023-12207 12 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.317.5.3] - udf: Fix file corruption when appending just after end of preallocated extent (Jan Kara) [Orabug: 35192150] - selftests/ftrace: Fix bash specific '==' operator (Masami Hiramatsu (Google)) [Orabug: 35192150] - net: Fix unwanted sign ext…

Mar 21, 2023
High max 7.9

ELSA-2023-12206 13 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.317.5.3] - udf: Fix file corruption when appending just after end of preallocated extent (Jan Kara) [Orabug: 35192150] - selftests/ftrace: Fix bash specific '==' operator (Masami Hiramatsu (Google)) [Orabug: 35192150] - net: Fix unwanted sign ext…

Mar 21, 2023
High max 8.8

ELSA-2023-1368 1 CVE

Important: nss security and bug fix update (Oracle Linux 9)

[3.79.0-17] - fix consistency return errors. We shouldn't lock the FIPS token if the application asked for invalid DH parameters on on keygen. [3.79.0-16] - Add check for RSA PSS Salt required by FIPS - Update fips_algorithms.sh according to the review. [3.79…

Mar 21, 2023
High max 8.8

ELSA-2023-1333 5 CVEs

Important: firefox security update (Oracle Linux 7)

[102.9.0-3.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [102.9.0-3] - Update to 102.9.0 build2 [102.9.0-2] - remo…

Mar 20, 2023
High max 7.4

ELSA-2023-1335 1 CVE

Important: openssl security update (Oracle Linux 7)

[1:1.0.2k-26] - Fixes CVE-2023-0286 X.400 address type confusion in X.509 GeneralName - Resolves: rhbz#2176790

Mar 20, 2023
High max 8.8

ELSA-2023-1332 1 CVE

Important: nss security update (Oracle Linux 7)

[3.79.0-5] - fix CVE-2023-0767

Mar 20, 2023
High max 8.8

ELSA-2023-1336 5 CVEs

Important: firefox security update (Oracle Linux 8)

[102.9.0-3.0.1] - Updated homepages to use https [Orabug: 34648274] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [102.9.0-3] - Update to 102.9.0 build2 [102.9.0-2] - removed disable-openh264-dow…

Mar 20, 2023
High max 8.8

ELSA-2023-1337 5 CVEs

Important: firefox security update (Oracle Linux 9)

[102.9.0-3.0.1] - Updated homepages to use https [Orabug: 34648274] [102.9.0-3] - Update to 102.9.0 build2 [102.9.0-2] - removed disable-openh264-download [102.9.0-1] - Update to 102.9.0 build1

Mar 20, 2023
High max 7.8

ELSA-2023-12199 11 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.523.4.1] - mm: kvmalloc does not fallback to vmalloc for incompatible gfp flags (Michal Hocko) [Orabug: 35164196] [4.14.35-2047.523.4] - rds: ib: Keep IB MRs on clean_list unless we are tearing down the pool (Hakon Bugge) [Orabug: 34987235] - rd…

Mar 17, 2023
High max 7.8

ELSA-2023-12200 11 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.523.4.1] - mm: kvmalloc does not fallback to vmalloc for incompatible gfp flags (Michal Hocko) [Orabug: 35164196] [4.14.35-2047.523.4] - rds: ib: Keep IB MRs on clean_list unless we are tearing down the pool (Hakon Bugge) [Orabug: 34987235] - rd…

Mar 17, 2023
High max 6.5

ELSA-2023-12195 4 CVEs

Important: virt:kvm_utils2 security update (Oracle Linux 8)

qemu-kvm [6.1.1-5-el8] - hw/pvrdma: Protect against buggy or malicious guest driver (Yuval Shaia) [Orabug: 35064352] {CVE-2022-1050} - hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion (Philippe Mathieu-Daude) [Orabug: 35060182] - hw/displa…

Mar 17, 2023
High max 7.9

ELSA-2023-12196 8 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-8.91.4.1] - uek-rpm: Add opbmc to core rpm (Somasundaram Krishnasamy) [Orabug: 35157130] [5.15.0-8.91.4] - selftests/vm: remove ARRAY_SIZE define from individual tests (Shuah Khan) [Orabug: 35088471] - selftests: Provide local define of __cpuid_count(…

Mar 16, 2023
High max 8.8

ELSA-2023-1252 1 CVE

Important: nss security update (Oracle Linux 8)

[3.79.0-11] - Fix CVE-2023-0767

Mar 15, 2023
High max 7.8

ELSA-2023-1091 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1160.88.1.0.1.OL7] - debug: lock down kgdb [Orabug: 34270798] {CVE-2022-21499} [3.10.0-1160.88.1.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.pet…

Mar 8, 2023
High max 5.5

ELSA-2023-1093 1 CVE

Important: pesign security update (Oracle Linux 7)

[0.109-11.0.1] - RPM macro fix (Petr Benes) - updates for Oracle Linux test certificate (Alexey Petrenko) - update Oracle Linux certificates (Alexey Petrenko) [0.109-11] - Backport newer, deprecated pesign-authorize - Resolves: CVE-2022-3560

Mar 8, 2023
High max 8.1

ELSA-2023-1090 1 CVE

Important: samba security update (Oracle Linux 7)

[4.10.16-24.0.1] - Fix memory leak in _nss_winbind_initgroups_dyn [Orabug: 34228871] [4.10.16-24] - related: #2154364 - Add additional patches for CVE-2022-38023 [4.10.16-23] - resolves: #2154364 - Fix CVE-2022-38023

Mar 8, 2023
Medium max 9.8

ELSA-2023-1095 1 CVE

Moderate: zlib security update (Oracle Linux 7)

[1.2.7-21] - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c - Resolves: CVE-2022-37434

Mar 8, 2023
Medium max 7.4

ELSA-2023-1141 1 CVE

Moderate: gnutls security and bug fix update (Oracle Linux 9)

[3.7.6-18] - Update gnutls-3.7.8-fips-pct-dh.patch to the upstream version (#2168610) [3.7.6-17] - Fix timing side-channel in TLS RSA key exchange (#2162600) [3.7.6-16] - fips: extend PCT to DH key generation (#2168610) [3.7.6-14] - fips: remove library path …

Mar 8, 2023
High max 7.8

ELSA-2023-12160 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.72.2] - net: sched: atm: dont intepret cls results when asked to drop (Jamal Hadi Salim) [Orabug: 34983616] {CVE-2023-23455} - Bluetooth: L2CAP: Fix u8 overflow (Sungwoo Kim) [Orabug: 34880763] {CVE-2022-45934} [4.1.12-124.72.1] - target: Invoke t…

Mar 7, 2023
Medium max 6.5

ELSA-2023-1140 1 CVE

Moderate: curl security update (Oracle Linux 8)

[7.61.1-25.el8_7.3] - fix HTTP multi-header compression denial of service (CVE-2023-23916)

Mar 7, 2023
High max 7.5

ELSA-2023-18908 8 CVEs

Important: ol8addon security update (Oracle Linux 8)

delve [1.9.1-1.0.1] - Bump version of delve from 1.8.3 to 1.9.1 [1.8.3-1.0.1] - Bump version of delve from 1.7.2 to 1.8.3 [1.7.2-1.0.1] - Bump version of delve from 1.6.0 to 1.7.2, enable aarch64 [1.6.0-1.0.1] - Bump upstream version of delve from 1.5.0 to 1.…

Mar 7, 2023
Medium

ELSA-2023-1068 1 CVE

Moderate: libjpeg-turbo security update (Oracle Linux 9)

[2.0.90-6] - Fix CVE-2021-46822 - Resolves: CVE-2021-46822

Mar 6, 2023
High max 5.5

ELSA-2023-1067 1 CVE

Important: pesign security update (Oracle Linux 9)

[115-6.0.1] - Update Oracle Linux test certificates [Orabug: 31928433] [115-6] - Fix chmod invocation - Resolves: CVE-2022-3560 [115-5] - Deprecate pesign-authorize and drop ACL use - Resolves: CVE-2022-3560

Mar 6, 2023
Medium max 8.8

ELSA-2023-12150 1 CVE

Moderate: pcs security update (Oracle Linux 9)

[0.11.3-4.el9_1.2] - Updated bundled rubygems: mustermann, rack, rack_protection, sinatra, tilt - Added license for rubygem ruby2_keywords - Resolves: rhbz#2159426

Mar 1, 2023
High max 7.8

ELSA-2023-0951 5 CVEs

Important: kernel security and bug fix update (Oracle Linux 9)

- [5.14.0-162.18.1_1.OL9] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.g…

Mar 1, 2023
Medium max 5.5

ELSA-2023-0954 2 CVEs

Moderate: systemd security update (Oracle Linux 9)

[250-12.0.2.3] - Backport upstream pstore dmesg fix [Orabug: 34868110] - Remove upstream references [Orabug: 33995357] - Disable unprivileged BPF by default [Orabug: 32870980] - udev rules: fix memory hot add and remove [Orabug: 31310273] - set 'RemoveIPC=no'…

Mar 1, 2023
High max 9.8

ELSA-2023-0978 2 CVEs

Important: git security update (Oracle Linux 7)

[1.8.3.1-24] - Fixes CVE-2022-23521 and CVE-2022-41903 - Resolves: #2162067

Feb 28, 2023
High max 7.8

ELSA-2023-12143 1 CVE

Important: sudo security update (Oracle Linux 8)

[1.8.6p3-29.0.4.el6_10.3] - Fixed Privilege escalation CVE-2023-22809 for sudoedit [Orabug: 35037922]

Feb 28, 2023
Medium max 7.5

ELSA-2023-0946 8 CVEs

Moderate: openssl security and bug fix update (Oracle Linux 9)

[3.0.1-47.0.1] - Replace upstream references [Orabug: 34340177] [1:3.0.1-47] - Fixed X.509 Name Constraints Read Buffer Overflow Resolves: CVE-2022-4203 - Fixed Timing Oracle in RSA Decryption Resolves: CVE-2022-4304 - Fixed Double free after calling PEM_read…

Feb 28, 2023