Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

Medium max 7.8

ELSA-2022-6457 2 CVEs

Moderate: python3 security update (Oracle Linux 8)

[3.6.8-47.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8-47] - Security fix for CVE-2015-20107 Resolves: rhbz#2075390 [3.6.8-46] - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs…

Sep 14, 2022
Medium max 5.5

ELSA-2022-6460 3 CVEs

Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-372.26.1.0.1_6.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509…

Sep 14, 2022
Medium

ELSA-2022-6463 1 CVE

Moderate: gnupg2 security update (Oracle Linux 8)

[2.2.20-3] - Fix CVE-2022-34903 (#2108447)

Sep 14, 2022
Medium max 7.5

ELSA-2022-6521 1 CVE

Moderate: .NET 6.0 security and bugfix update (Oracle Linux 9)

[6.0.109-1.0.1] - Add missing Oracle RIDs - Build all packages on source-build even when in servicing [6.0.109-1] - Update to .NET SDK 6.0.109 and Runtime 6.0.9 - Resolves: RHBZ#2123791

Sep 14, 2022
High max 7.0

ELSA-2022-9772 1 CVE

Important: istio security update (Oracle Linux 7)

istio [1.13.7-1] - Added Oracle specific files for 1.13.7-1 olcne [1.5.5-1] - Upgrade Istio from 1.13.5 to 1.13.7 to resolve the CVE-2022-31045 [1.5.4-3] - Fix bug in gen-certs-helper script to change permission of node.key to allow opc user to copy over [1.5…

Sep 8, 2022
High max 7.0

ELSA-2022-9774 1 CVE

Important: istio security update (Oracle Linux 7)

istio [1.13.7-1] - Added Oracle specific files for 1.13.7-1 olcne [1.4.7-1] - Upgrade Istio from 1.13.5 to 1.13.7 to resolve the CVE-2022-31045 [1.4.6-2] - Fix bug in gen-certs-helper script to change permission of node.key to allow opc user to copy over - Up…

Sep 8, 2022
High max 7.0

ELSA-2022-9771 1 CVE

Important: istio security update (Oracle Linux 8)

istio [1.13.7-1] - Added Oracle specific files for 1.13.7-1 olcne [1.5.5-1] - Upgrade Istio from 1.13.5 to 1.13.7 to resolve the CVE-2022-31045 [1.5.4-3] - Fix bug in gen-certs-helper script to change permission of node.key to allow opc user to copy over [1.5…

Sep 8, 2022
High max 7.0

ELSA-2022-9773 1 CVE

Important: istio security update (Oracle Linux 8)

istio [1.13.7-1] - Added Oracle specific files for 1.13.7-1 olcne [1.4.7-1] - Upgrade Istio from 1.13.5 to 1.13.7 to resolve the CVE-2022-31045 [1.4.6-2] - Fix bug in gen-certs-helper script to change permission of node.key to allow opc user to copy over - Up…

Sep 8, 2022
High

ELSA-2022-20694 1 CVE

Important: golang security update (Oracle Linux 7)

[1.18.5-1.0.1] - golang-1.18.5 package initial release - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> [1.18.4-1.0.1] - golang-1.18.4 package initial release - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> [1.18.3-1.0.1] - golang-1.18.3-…

Sep 7, 2022
High

ELSA-2022-6381 1 CVE

Important: open-vm-tools security update (Oracle Linux 7)

[11.0.5-3.0.1] - fix spaces in vmware udev rule for scsi devices [Orabug: 24461968] - Fix vmware udev rule in 99-vmware-scsi-timeout.rules file. [Orabug: 22815019] - Increase timeout for scsi devices on VMWare guests by adding a udev rule. - Created a new fil…

Sep 7, 2022
High

ELSA-2022-6358 1 CVE

Important: open-vm-tools security update (Oracle Linux 9)

[11.3.5-1.0.1.el9_0.1] - Fix spaces in vmware udev rule for scsi devices [Orabug: 24461968] - Fix vmware udev rule in 99-vmware-scsi-timeout.rules file. [Orabug: 22815019] - Increase timeout for scsi devices on VMWare guests by adding a udev rule. [Orabug: 21…

Sep 7, 2022
High max 7.5

ELSA-2022-9761 9 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.66.3] - fuse: fix pipe buffer lifetime for direct_io (Miklos Szeredi) [Orabug: 33981149] {CVE-2022-1011} - vt: drop old FONT ioctls (Jiri Slaby) [Orabug: 34408794] {CVE-2021-33656} - video: of_display_timing.h: include errno.h (Hsin-Yi Wang) [Orab…

Sep 6, 2022
High

ELSA-2022-20693 1 CVE

Important: golang security update (Oracle Linux 7)

[1.17.13-1.0.1] - golang-1.17.13 release - Update tarball and version number in specfile - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> [1.17.12-1.0.1] - golang-1.17.12-1 release - Update tarball and version number in specfile - Reviewed-by: Indu …

Sep 6, 2022
High

ELSA-2022-6357 1 CVE

Important: open-vm-tools security update (Oracle Linux 8)

[11.3.5-1.0.1.el8_6.1] - Fix spaces in vmware udev rule for scsi devices [Orabug: 24461968] - Fix vmware udev rule in 99-vmware-scsi-timeout.rules file. [Orabug: 22815019] - Increase timeout for scsi devices on VMWare guests by adding a udev rule. [Orabug: 21…

Sep 6, 2022
High

ELSA-2022-9754 1 CVE

Important: pcs security update (Oracle Linux 8)

[0.10.12-6.0.1.el8_6.2] - Replace HAM-logo.png with a generic one [0.10.12-6.el8_6.2] - Fixed ruby socket permissions - Resolves: rhbz#2116837

Sep 1, 2022
High

ELSA-2022-9753 1 CVE

Important: pcs security update (Oracle Linux 9)

[0.11.1-10.el9_0.2] - Fixed ruby socket permissions - Resolves: rhbz#2116839

Sep 1, 2022
Medium max 9.8

ELSA-2022-6224 5 CVEs

Moderate: openssl security and bug fix update (Oracle Linux 9)

[3.0.1-41.0.1] - Replace upstream references [Orabug: 34340177] [1:3.0.1-41] - Zeroize public keys as required by FIPS 140-3 Resolves: rhbz#2115861 - Add FIPS indicator for HKDF Resolves: rhbz#2118388 [1:3.0.1-40] - Deal with DH keys in FIPS mode according FI…

Aug 30, 2022
High

ELSA-2022-6206 1 CVE

Important: systemd security update (Oracle Linux 8)

[239-58.0.1.4] - Disable unprivileged BPF by default [Orabug: 32870980] - backport upstream pstore tmpfiles patch [Orabug: 31420486] - udev rules: fix memory hot add and remove [Orabug: 31310273] - fix to enable systemd-pstore.service [Orabug: 30951066] - jou…

Aug 29, 2022
High

ELSA-2022-6170 1 CVE

Important: rsync security update (Oracle Linux 7)

[3.1.2-11] - Resolves: #2111170 - remote arbitrary files write inside the directories of connecting peers

Aug 25, 2022
High

ELSA-2022-6160 1 CVE

Important: systemd security update (Oracle Linux 7)

[219-78.0.9.el7_9.7] - Core: explicitly trigger changing udev systemd_wants property [Orabug: 31858125] - Disable unprivileged BPF by default [Orabug: 32871008] - Resolve missing installation files for systemd-pstore [Orabug 32497787] - Change to have file tm…

Aug 25, 2022
High max 8.8

ELSA-2022-6179 5 CVEs

Important: firefox security update (Oracle Linux 7)

[91.13.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Enabled aarch64 build [91.13.0-1] - Update to 91.13.0 b…

Aug 25, 2022
High max 8.8

ELSA-2022-6169 5 CVEs

Important: thunderbird security update (Oracle Linux 7)

[91.13.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [91.13.0-1] - Update to 91.13.0 build1

Aug 25, 2022
High max 8.8

ELSA-2022-6164 5 CVEs

Important: thunderbird security update (Oracle Linux 8)

[91.13.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.13.0-1] - Update to 91.13.0 build1

Aug 25, 2022
Medium max 8.1

ELSA-2022-6158 1 CVE

Moderate: php:7.4 security update (Oracle Linux 8)

php [7.4.19-4] - fix uninitialized array in pg_query_params() leading to RCE CVE-2022-31625

Aug 25, 2022
High

ELSA-2022-6180 1 CVE

Important: rsync security update (Oracle Linux 8)

[3.1.3-14.3] - Resolves: #2111174 - remote arbitrary files write inside the directories of connecting peers

Aug 25, 2022
High max 8.8

ELSA-2022-6175 5 CVEs

Important: firefox security update (Oracle Linux 8)

[91.13.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.13.0-1] - Update to 91.13.0 build1

Aug 25, 2022
High max 8.8

ELSA-2022-6165 5 CVEs

Important: thunderbird security update (Oracle Linux 9)

[91.13.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Reference oracle-indexhtml within Requires [Orabug: 33802044] [91.13.0-1] - Update to 91.13.0 build1

Aug 25, 2022
High max 8.8

ELSA-2022-6174 5 CVEs

Important: firefox security update (Oracle Linux 9)

[91.13.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.13.0-1] - Update to 91.13.0 build1

Aug 25, 2022
Medium max 9.8

ELSA-2022-6157 3 CVEs

Moderate: curl security update (Oracle Linux 9)

[7.76.1-14.el9_0.5] - fix unpreserved file permissions (CVE-2022-32207) - fix HTTP compression denial of service (CVE-2022-32206) - fix FTP-KRB bad message verification (CVE-2022-32208)

Aug 25, 2022
High

ELSA-2022-6181 1 CVE

Important: rsync security update (Oracle Linux 9)

[3.2.3-9.2] - Resolves: #2111176 - remote arbitrary files write inside the directories of connecting peers

Aug 25, 2022
Medium max 6.5

ELSA-2022-6159 2 CVEs

Moderate: curl security update (Oracle Linux 8)

[7.61.1-22.el8_6.4] - fix HTTP compression denial of service (CVE-2022-32206) - fix FTP-KRB bad message verification (CVE-2022-32208)

Aug 24, 2022
Medium

ELSA-2022-20240 2 CVEs

Moderate: podman security update (Oracle Linux 7)

[1.6.4-36.0.1] - Reduce unnecessary writable mounts in NaiveDiffDriver [Orabug: 31025483] - handle redirect from the docker registry v2 [Orabug: 29874238] (nikita.gerasimov@oracle.com) - remove changes in NaiveDiffDriver [1.6.4-36] - update to the latest cont…

Aug 22, 2022
High max 6.2

ELSA-2022-9728 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.516.2.1] - rds: copy_from_user only once per rds_sendmsg system call (Hans Westgaard Ry) [Orabug: 33981856] {CVE-2022-21385}

Aug 19, 2022
High max 6.2

ELSA-2022-9731 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.516.2.1] - rds: copy_from_user only once per rds_sendmsg system call (Hans Westgaard Ry) [Orabug: 33981856] {CVE-2022-21385}

Aug 19, 2022
High max 6.2

ELSA-2022-9729 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

[5.15.0-1.43.4.2] - rds: copy_from_user only once per rds_sendmsg system call (Hans Westgaard Ry) [Orabug: 33981854] {CVE-2022-21385}

Aug 19, 2022
High max 6.2

ELSA-2022-9727 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.310.7.1] - rds: copy_from_user only once per rds_sendmsg system call (Hans Westgaard Ry) [Orabug: 33981855] {CVE-2022-21385}

Aug 19, 2022
High max 6.2

ELSA-2022-9730 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.310.7.1] - rds: copy_from_user only once per rds_sendmsg system call (Hans Westgaard Ry) [Orabug: 33981855] {CVE-2022-21385}

Aug 19, 2022
High max 6.2

ELSA-2022-9726 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-1.43.4.2] - rds: copy_from_user only once per rds_sendmsg system call (Hans Westgaard Ry) [Orabug: 33981854] {CVE-2022-21385}

Aug 19, 2022
High max 7.5

ELSA-2022-9720 1 CVE

Important: cri-o security update (Oracle Linux 8)

[1.22.5-1] - Addresses CVE-2022-1708

Aug 18, 2022
High max 7.5

ELSA-2022-9717 1 CVE

Important: cri-o security update (Oracle Linux 7)

[1.21.7-2] - Addresses CVE-2022-1708 [1.21.7-1] - Added Oracle Specifile Files for cri-o

Aug 17, 2022