Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

High max 8.7

ELSA-2026-69387 1 CVE

Important: freerdp security update (Oracle Linux 8)

[2:2.11.7-13] - Fix RPC gateway fragment size and capacity checks (CVE-2026-55193) Resolves: RHEL-247353

Sep 23, 2026
Medium max 7.0

ELSA-2026-69655 1 CVE

Moderate: libxml2 security, bug fix, and enhancement update (Oracle Linux 8)

[2.9.7-21.8] - Lower xpath recursion limits (RHEL-249282) [2.9.7-21.8] - Fix CVE-2026-6653 (RHEL-215616)

Sep 23, 2026
Medium max 4.4

ELSA-2026-69964 1 CVE

Moderate: coreutils security update (Oracle Linux 8)

[8.30-21.0.1] - clean up empty file if cp is failed [Orabug 15973168] - df --local: recognize afs, auristorfs, and smb3 as remote fs (#1798030) - fix formatting of sha512sum(1) man page (#1688744) [8.30-21] - sort: fix buffer under-read CVE-2025-5278 (RHEL-21…

Sep 23, 2026
Medium max 5.0

ELSA-2026-70390 4 CVEs

Moderate: tar security, bug fix, and enhancement update (Oracle Linux 8)

[2:1.30-13] - Backport upstream fix for CVE-2026-5704 (file injection hidden from -t) - Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix) Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks). - Upstream fix for build w…

Sep 23, 2026
High max 5.9

ELSA-2026-69266 3 CVEs

Important: openssh security, bug fix, and enhancement update (Oracle Linux 8)

[8.0p1-33.0.1] - Update upstream references [Orabug: 36587718] [8.0p1-33] - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-248257 [8.0p1-32] - Improve fix for CVE-2023-38408, avoid invoking const…

Sep 23, 2026
High max 8.8

ELSA-2026-69923 16 CVEs

Important: postgresql:15 security update (Oracle Linux 8)

pgaudit [1.7.0-1] - Update to 1.7.0 - Support postgresql 15 - Related: #2128241 [1.5.0-1] - Update to version 1.5.0 Related: #1855776 [1.4.0-4] - Bump release for rebuild against libpq-12.1-3 [1.4.0-3] - BuildRequires libpq-devel [1.4.0-2] - BuildRequires pos…

Sep 23, 2026
High max 8.8

ELSA-2026-69924 14 CVEs

Important: postgresql:12 security update (Oracle Linux 8)

[12.22-10.0.1] - Add backport of CVE-2025-8714 [Orabug: 38667546] [12.22-10] - Backport fixes for multiple CVEs - Resolves: CVE-2026-14662, CVE-2026-14664, CVE-2026-14668, CVE-2026-14669 - Resolves: CVE-2026-14670, CVE-2026-14671, CVE-2026-14677, CVE-2026-146…

Sep 23, 2026
High max 8.8

ELSA-2026-69876 16 CVEs

Important: postgresql:16 security update (Oracle Linux 8)

pgaudit [16.0-1] - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3636 pg_repack [1.5.1-1] - Update to 1.5.1 postgres-decoderbufs [2.4.0-1.Final] - Initial import for postgresql 16 stream - Related: RHEL-3636 postgre…

Sep 23, 2026
High max 7.5

ELSA-2026-69277 1 CVE

Important: corosync security update (Oracle Linux 8)

[3.1.8-1.2] - Resolves: RHEL-251531 - totempg: Replace assert with check in deliver_fn (fixes CVE-2026-81665)

Sep 23, 2026
High max 5.9

ELSA-2026-70191 1 CVE

Important: runc security update (Oracle Linux 9)

[4:1.4.2-3] - rebuild for CVE-2026-56860 - Resolves: RHEL-241703

Sep 23, 2026
High max 7.5

ELSA-2026-70391 5 CVEs

Important: containernetworking-plugins security update (Oracle Linux 9)

[1:1.9.0-4] - rebuild for CVE-2026-56853 CVE-2026-56858 CVE-2026-56862 CVE-2026-56860 CVE-2026-33818 - Resolves: RHEL-241203 - Resolves: RHEL-241309 - Resolves: RHEL-241445 - Resolves: RHEL-241826 - Resolves: RHEL-242374

Sep 23, 2026
High max 9.1

ELSA-2026-69961 9 CVEs

Important: podman security update (Oracle Linux 9)

[5.8.2-7.0.1] - Rework CNI/Netavark detection logic [JIRA: EVG-3769] - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.8.2-7] - update to the latest u…

Sep 23, 2026
High max 8.8

ELSA-2026-69914 16 CVEs

Important: postgresql:15 security update (Oracle Linux 9)

pgaudit [1.7.0-1] - Initial import for postgresql 15 module - Update to 1.7.0 - Support postgresql 15 - Related: #2128410 pg_repack [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47350 [1.4.8-1] - Update to version 1.4.8 …

Sep 23, 2026
High max 8.8

ELSA-2026-69607 15 CVEs

Important: postgresql security update (Oracle Linux 9)

[13.23-6] - Fix CVE-2026-14662 - Fix CVE-2026-14664 - Fix CVE-2026-14668 - Fix CVE-2026-14669 - Fix CVE-2026-14670 - Fix CVE-2026-14671 - Fix CVE-2026-14677 - Fix CVE-2026-14679 - Fix CVE-2026-14680 - Fix CVE-2026-15742 - Fix CVE-2026-16239 - Fix CVE-2026-184…

Sep 23, 2026
High max 8.8

ELSA-2026-70186 16 CVEs

Important: postgresql16 security update (Oracle Linux 10)

[16.15-1.0.1] - Replace upstream reference [Orabug: 37044148] [16.15-1] - Update to 16.15

Sep 23, 2026
High max 7.5

ELSA-2026-70201 11 CVEs

Important: podman security update (Oracle Linux 10)

[5.8.2-9.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-9] - bump golang.org/x/text to v0.39.0 to fix CVE-2026-56852 - Resolves: RHEL-250818 [7:5.8.2-8] - update to the latest upstream commit 66780e9b - Resolves…

Sep 23, 2026
Low max 3.9

ELSA-2026-69553 2 CVEs

Low: libarchive security update (Oracle Linux 10)

[3.7.7-11] - Related: CVE-2026-16517 and CVE-2026-15028

Sep 23, 2026
High max 9.8

ELSA-2026-69125 6 CVEs

Important: curl security update (Oracle Linux 10)

[8.12.1-4.6] - fix cookie injection via trailing dot super cookies (CVE-2026-8924) - fix digest auth state leak on origin or credential change (CVE-2026-11856) - fix netrc password lookup for non-matching login (CVE-2026-8926) [8.12.1-4.5] - fix proxy auth no…

Sep 23, 2026
High max 9.1

ELSA-2026-70753 1 CVE

Important: perl-DBI security update (Oracle Linux 10)

[1.643-26.6] - Fix CVE-2026-73194: enforce placeholder range limit on :N style placeholders Resolves: RHEL-247316

Sep 23, 2026
High max 7.1

ELSA-2026-69608 1 CVE

Important: openexr security update (Oracle Linux 9)

[3.1.1-3.4] - fix CVE-2026-68515

Sep 22, 2026
High max 7.5

ELSA-2026-67873 1 CVE

Important: corosync security update (Oracle Linux 9)

[3.1.10-1.2] - Resolves: RHEL-251542 - totempg: Replace assert with check in deliver_fn (fixes CVE-2026-81665)

Sep 22, 2026
High max 5.9

ELSA-2026-69130 5 CVEs

Important: openssh security update (Oracle Linux 9)

[9.9p1-11.0.1] - Restore pam_ssh_agent_rel values that were used for initial release - Fix PerSourcePenalties grace-exceeded using the crash penalty value [Orabug: 39825354] - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM…

Sep 22, 2026
High max 9.6

ELSA-2026-69462 28 CVEs

Important: firefox security update (Oracle Linux 9)

[140.16.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.16.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

Sep 22, 2026
High max 7.5

ELSA-2026-69540 1 CVE

Important: rsyslog security update (Oracle Linux 9)

[8.2510.0-2.0.1.el9_8.2] - Fixes rsyslog segfault during shutdown when relp is configured with TLS [Orabug: 37588023] [8.2510.0-2.2] - Fix CVE-2026-78002: heap buffer overflow in RainerScript replace() function Resolves: RHEL-246641 [8.2510.0-2.1] - Backport:…

Sep 22, 2026
High max 9.6

ELSA-2026-69461 28 CVEs

Important: firefox security update (Oracle Linux 10)

[140.16.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.16.0-1] - Update to 140.16.0 ESR

Sep 22, 2026
High max 9.8

ELSA-2026-54248 33 CVEs

Important: firefox security update (Oracle Linux 7)

[140.13.0-1.0.1] - Update to 140.13.0 ESR [Orabug: 39947841][CVE-2026-15718][CVE-2026-15719] [CVE-2026-16349][CVE-2026-16350][CVE-2026-16351][CVE-2026-16352][CVE-2026-16353] [CVE-2026-16354][CVE-2026-16355][CVE-2026-16356][CVE-2026-16357][CVE-2026-16358] [CVE…

Sep 21, 2026
High max 7.5

ELSA-2026-55758 3 CVEs

Important: 389-ds-base security update (Oracle Linux 7)

[1.3.11.1-5.0.13] - Security update for CVE-2026-11770 CVE-2026-11788 CVE-2026-15722 [Orabug: 39892253] [1.3.11.1-5.0.11] - Security update for CVE-2026-11610 CVE-2026-11774 [Orabug: 39697075] [1.3.11.1-5.0.9] - Security fix for CVE-2026-9064 [Orabug: 3957020…

Sep 21, 2026
High max 8.8

ELSA-2026-69098 37 CVEs

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.52.5-1] - Update to 2.52.5 [2.52.4-1] - Update to 2.52.4 [2.52.3-1] - Update to 2.52.3 [2.50.4-1] - Update to 2.50.4 [2.50.3-1] - Update to 2.50.3 [2.50.1-1] - Update to 2.50.1 [2.50.0-1] - Update to 2.50.0 [2.48.5-1] - Update to 2.48.5 [2.48.3-1] - Update…

Sep 21, 2026
High max 7.8

ELSA-2026-69123 1 CVE

Important: sudo security update (Oracle Linux 9)

[1.9.17p2-3.1] - CVE-2026-82474 sudo: execveat(2) intercept/log_subcmds bypass Resolves: RHEL-255647

Sep 21, 2026
High max 9.1

ELSA-2026-69126 2 CVEs

Important: curl security update (Oracle Linux 9)

[7.76.1-40.el9_8.7] - add sasl service name to connection reuse checks (CVE-2026-8458) [7.76.1-40.el9_8.6] - detect proxy changes read from environment (CVE-2026-8927)

Sep 21, 2026
High max 7.8

ELSA-2026-69100 2 CVEs

Important: gstreamer1-plugins-base security update (Oracle Linux 9)

[1.22.12-8.2] - Fix CVE-2026-18297: opusdec channel position bounds check Resolves: RHEL-246587 - Fix crash in RTSP auth credential parsing (CVE-2026-85150) Resolves: RHEL-253753 [1.22.12-8.1] - Sync with c9s release -5..-8: fix for CVE-2026-2921 in riff pale…

Sep 21, 2026
Medium max 9.8

ELSA-2026-69259 6 CVEs

Moderate: tomcat update (Oracle Linux 10)

[1:10.1.49-4] - Resolves: RHEL-192817 tomcat: HTTP/2 request headers not validated (CVE-2026-41293) - Resolves: RHEL-192648 tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) - Resolves: RHEL-238208 tomcat: Information disc…

Sep 21, 2026
High max 7.5

ELSA-2026-69308 5 CVEs

Important: yggdrasil security update (Oracle Linux 10)

[0.4.9.2-3] - Rebuild yggdrasil against updated golang [0.4.9.2-2] - Rebuild yggdrasil against updated golang

Sep 21, 2026
High max 7.5

ELSA-2026-69541 1 CVE

Important: rsyslog security update (Oracle Linux 10)

[8.2510.0-5.2] - Fix CVE-2026-78002: heap buffer overflow in RainerScript replace() function Resolves: RHEL-246633

Sep 21, 2026
High max 7.5

ELSA-2026-69099 2 CVEs

Important: yggdrasil-worker-package-manager security update (Oracle Linux 10)

[0.2.3-8] - Rebuild against updated golang

Sep 20, 2026
High max 8.2

ELSA-2026-67943 1 CVE

Important: python-lxml security update (Oracle Linux 8)

[4.2.3-5] - Security fix for CVE-2026-49825: missing xlink:href in known HTML link attributes Resolves: RHEL-251508 [4.2.3-4] - Security fix for CVE-2021-43818 Resolves: rhbz#2032569 [4.2.3-3] - Security fix for CVE-2021-28957 Resolves: rhbz#1941534 [4.2.3-2]…

Sep 18, 2026
High max 9.8

ELSA-2026-68531 22 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.164.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Sep 18, 2026
High max 9.8

ELSA-2026-68570 31 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.49.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Sep 18, 2026
Medium max 9.8

ELSA-2026-68651 8 CVEs

Moderate: tomcat9 security update (Oracle Linux 10)

[1:9.0.120-1] - Resolves: RHEL-192649 Tomcat9: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) - Resolves: RHEL-192818 Tomcat9: HTTP/2 request headers not validated (CVE-2026-41293) - Resolves: RHEL-219582 Tomcat9: Insufficient …

Sep 18, 2026
High max 8.8

ELSA-2026-500330 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.359.3.2] - sctp: prevent peer transport count overflow (Asim Viladi Oglu Manizada) [Orabug: 40036878] {CVE-2026-74469} - pppoe: reload header pointer after dev_hard_header() (Asim Viladi Oglu Manizada) [Orabug: 40036877] {CVE-2026-68121} - xfrm: …

Sep 17, 2026