Oracle Linux Security Advisories (ELSA)

8,321 results · Feed

• High max 7.8
  ELSA-2022-17956 8 CVEs

  Important: go-toolset:ol8addon security update (Oracle Linux 8)

  go-toolset [1.18.3-1] - Update to golang 1.18.3 golang [1.18.3-1.0.1] - Rebase to 1.18.3 by adding upstream patches to the 1.18.0 openssl-fips - Modify Patch51852 to remove portions already upstream - Use base_version to distinguish the version of the tarball…

  Jul 12, 2022
• High max 5.6
  ELSA-2022-9591 3 CVEs

  Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

  [5.15.0-0.30.20] - floppy: use a statically allocated error counter (Willy Tarreau) [Orabug: 34218638] {CVE-2022-1652} - x86: Disable RET on kexec (Konrad Rzeszutek Wilk) [Orabug: 34335631] {CVE-2022-23816} {CVE-2022-29901} - x86/bugs: do not enable IBPB-on-e…

  Jul 12, 2022
• High max 5.6
  ELSA-2022-9590 3 CVEs

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

  [5.15.0-0.30.20] - floppy: use a statically allocated error counter (Willy Tarreau) [Orabug: 34218638] {CVE-2022-1652} - x86: Disable RET on kexec (Konrad Rzeszutek Wilk) [Orabug: 34335631] {CVE-2022-29901} {CVE-2022-23816} - x86/bugs: do not enable IBPB-on-e…

  Jul 12, 2022
• High
  ELSA-2022-9582 1 CVE

  Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

  [4.14.35-2047.515.3.el7] - uek-rpm: Enable Pensando EMMC reset controller (Thomas Tai) [Orabug: 34325721] - mfd: pensando_elbasr: Add Pensando Elba System Resource Chip (Brad Larson) [Orabug: 34325721] - dsc-drivers: update drivers for 1.15.9-C-65 (Shannon Ne…

  Jul 11, 2022
• High max 10.0
  ELSA-2022-9587 6 CVEs

  Important: olcne security update (Oracle Linux 7)

  olcne [1.4.6-2] - Fix bug in gen-certs-helper script to change permission of node.key to allow opc user to copy over - Update gen-certs-helper script to skip printing olcne_transfer_script execution - Cleanup grpc connection when node not found and use substr…

  Jul 11, 2022
• High
  ELSA-2022-9583 1 CVE

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

  [4.14.35-2047.515.3] - uek-rpm: Enable Pensando EMMC reset controller (Thomas Tai) [Orabug: 34325721] - mfd: pensando_elbasr: Add Pensando Elba System Resource Chip (Brad Larson) [Orabug: 34325721] - dsc-drivers: update drivers for 1.15.9-C-65 (Shannon Nelson…

  Jul 11, 2022
• High max 10.0
  ELSA-2022-9586 6 CVEs

  Important: olcne security update (Oracle Linux 8)

  olcne [1.4.6-2] - Fix bug in gen-certs-helper script to change permission of node.key to allow opc user to copy over - Update gen-certs-helper script to skip printing olcne_transfer_script execution - Cleanup grpc connection when node not found and use substr…

  Jul 11, 2022
• High
  ELSA-2022-5526 1 CVE

  Important: squid:4 security update (Oracle Linux 8)

  squid [7:4.15-3.1] - Resolves: #2100782 - CVE-2021-46784 squid:4/squid: DoS when processing gopher server responses

  Jul 8, 2022
• High max 5.9
  ELSA-2022-9564 1 CVE

  Important: libgcrypt security update (Oracle Linux 8)

  [ 1.8.5-7_fips] - Add API to provide hash calculation in RSA/DSA/ECDSA signature operations [Orabug: 33081130] - Change Epoch from 1 to 10 [1.8.5-7] - Fix CVE-2021-33560 (#2018525)

  Jul 7, 2022
• High
  ELSA-2022-5527 1 CVE

  Important: squid security update (Oracle Linux 9)

  [7:5.2-1.1] - Resolves: #2100784 - CVE-2021-46784 squid: DoS when processing gopher server responses

  Jul 7, 2022
• High max 6.7
  ELSA-2022-5232 3 CVEs

  Important: kernel security and bug fix update (Oracle Linux 7)

  [3.10.0-1160.71.1.0.1] - debug: lock down kgdb [Orabug: 34270798] {CVE-2022-21499} [3.10.0-1160.71.1.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenk…

  Jul 6, 2022
• High max 5.5
  ELSA-2022-9557 3 CVEs

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

  [4.1.12-124.64.1] - iscsi-target: Fix the issue with shutdown_session removal (Gulam Mohamed) [Orabug: 29661566] - scsi: target: fix hang when multiple threads try to destroy the same iscsi session (Gulam Mohamed) [Orabug: 29661566] - scsi: target: remove boi…

  Jul 5, 2022
• High max 7.5
  ELSA-2022-5467 1 CVE

  Important: php:7.4 security update (Oracle Linux 8)

  php [7.4.19-3] - fix password of excessive length triggers buffer overflow leading to RCE CVE-2022-31626

  Jul 4, 2022
• High max 7.5
  ELSA-2022-5468 1 CVE

  Important: php:8.0 security update (Oracle Linux 8)

  php [8.0.13-3] - fix password of excessive length triggers buffer overflow leading to RCE CVE-2022-31626

  Jul 4, 2022
• High max 8.1
  ELSA-2022-5095 8 CVEs

  Important: grub2, mokutil, shim, and shim-unsigned-x64 security update (Oracle Linux 8)

  [2.02-123.0.4.el8_6.8] - enable multiboot2 [Orabug: 34285558] - backport arm64: Fix EFI loader kernel image allocation [Orabug: 33702462] - backport Arm: check for the PE magic for the compiled arch [Orabug: 33702462] - Backport some better script logic for B…

  Jul 4, 2022
• Medium
  ELSA-2022-5263 2 CVEs

  Moderate: qemu-kvm security and bug fix update (Oracle Linux 9)

  [6.2.0-11.el9_0.3] - kvm-RHEL-disable-seqpacket-for-vhost-vsock-device-in-rhe.patch [bz#2071102] - kvm-virtio-net-fix-map-leaking-on-error-during-receive.patch [bz#2075635] - kvm-vhost-vsock-detach-the-virqueue-element-in-case-of-e.patch [bz#2075640] - Resolv…

  Jul 4, 2022
• Medium max 9.8
  ELSA-2022-5235 3 CVEs

  Moderate: python security update (Oracle Linux 7)

  [2.7.5-92.0.1] - Add Oracle Linux distribution in platform.py [orabug 20812544] [2.7.5-92] - Security fix for CVE-2021-3177 Resolves: rhbz#1918168 [2.7.5-91] - Security fixes for CVE-2020-26116, CVE-2020-26137 and CVE-2022-0391 - Test fixes for the latest exp…

  Jul 2, 2022
• High
  ELSA-2022-5316 2 CVEs

  Important: kernel security and bug fix update (Oracle Linux 8)

  [4.18.0-372.13.1.0.1_6.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509…

  Jul 2, 2022
• High max 9.8
  ELSA-2022-5481 8 CVEs

  Important: firefox security update (Oracle Linux 9)

  [91.11.0-2.0.1] - Replaced upstream package with oracle-indexhtml [Orabug: 33802044] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Removed Upstream references [91.11.0-2] - Update to 91.11.0 build2

  Jul 2, 2022
• High max 9.8
  ELSA-2022-5482 9 CVEs

  Important: thunderbird security update (Oracle Linux 9)

  [91.11.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Reference oracle-indexhtml within Requires [Orabug: 33802044] [91.11.0-2] - Update to 91.11.0 build2 [91.11.0-1] - Update to 91.11.0 build1

  Jul 2, 2022
• High max 9.8
  ELSA-2022-5480 9 CVEs

  Important: thunderbird security update (Oracle Linux 7)

  [91.11.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [91.11.0-2] - Update to 91.11.0 build2 [91.11.0-1] - Update to 91.11.0 build1

  Jul 1, 2022
• High max 9.8
  ELSA-2022-5479 8 CVEs

  Important: firefox security update (Oracle Linux 7)

  [91.11.0-2.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Enabled aarch64 build [91.11.0-2] - Update to 91.11.0 b…

  Jul 1, 2022
• Medium max 5.9
  ELSA-2022-5311 1 CVE

  Moderate: libgcrypt security update (Oracle Linux 8)

  [1.8.5-7] - Fix CVE-2021-33560 (#2018525)

  Jul 1, 2022
• Medium
  ELSA-2022-5331 1 CVE

  Moderate: libinput security update (Oracle Linux 8)

  [1.16.3-3] - Fix a format string vulnerability in the device name logging (#2076815) CVE-2022-1215

  Jul 1, 2022
• Medium
  ELSA-2022-5338 1 CVE

  Moderate: ruby:2.6 security, bug fix, and enhancement update (Oracle Linux 8)

  ruby [2.6.10-109] - Upgrade to Ruby 2.6.10. Resolves: rhbz#2088415 - Fix buffer overrun in String-to-Float conversion. Resolves: CVE-2022-28739 - Fix FTBFS due to an incompatible load directive. - Fix a fiddle import test on an optimized glibc on Power 9.

  Jul 1, 2022
• Medium max 7.3
  ELSA-2022-5319 2 CVEs

  Moderate: vim security update (Oracle Linux 8)

  [2:8.0.1763-19.0.1.2] - Remove upstream references [Orabug: 31197557] - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984] [2:8.0.1763-19.2] - CVE-2022-1621 vim: heap buffer overflow - CVE-2022-1629 vim: buffer over-read [2:8.…

  Jul 1, 2022
• High max 9.8
  ELSA-2022-5469 8 CVEs

  Important: firefox security update (Oracle Linux 8)

  [91.11.0-2.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.11.0-2] - Update to 91.11.0 build2 [91.11.0-1] - Update to 91.11.0 build1

  Jul 1, 2022
• Low max 7.5
  ELSA-2022-5326 1 CVE

  Low: compat-openssl10 security update (Oracle Linux 8)

  [1:1.0.2o-4] - Fix CVE-2022-0778: Infinite loop in BN_mod_sqrt() reachable when parsing certificates Resolves: rhbz#2077417

  Jul 1, 2022
• Medium
  ELSA-2022-5317 1 CVE

  Moderate: libxml2 security update (Oracle Linux 8)

  [2.9.7-13.1] - Fix CVE-2022-29824 (#2082297)

  Jul 1, 2022
• Medium max 5.3
  ELSA-2022-5337 3 CVEs

  Moderate: go-toolset:ol8 security and bug fix update (Oracle Linux 8)

  delve [1.7.2-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.7.2-1] - Rebase to 1.7.2 - Related: rhbz#2014088 golang [1.17.10-1] - Rebase to Go 1.17.10 - Resolves: rhbz#2091077 go-toolset [1.17.10-1] - Rebase to Go 1.17.10 - Resolves: …

  Jul 1, 2022
• High max 9.8
  ELSA-2022-5470 9 CVEs

  Important: thunderbird security update (Oracle Linux 8)

  [91.11.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.11.0-2] - Update to 91.11.0 build2 [91.11.0-1] - Update to 91.11.0 build1

  Jul 1, 2022
• High
  ELSA-2022-4990 1 CVE

  Important: cups security update (Oracle Linux 9)

  [1:2.3.3op2-13.1] - CVE-2022-26691 cups: authorization bypass when using 'local' authorization

  Jul 1, 2022
• High max 5.5
  ELSA-2022-9533 6 CVEs

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

  [5.15.0-0.30.19] - net/mlx4: Increase num_srq in low_mem_profile (Dave Kleikamp) [Orabug: 34052160] [5.15.0-0.30.18] - Revert ocfs2: mount shared volume without ha stack (Junxiao Bi) [Orabug: 33701900] - KVM: x86/speculation: Disable Fill buffer clear within …

  Jun 30, 2022
• Medium max 7.5
  ELSA-2022-5314 2 CVEs

  Moderate: expat security update (Oracle Linux 8)

  [2.2.5-8.0.1.2] - lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910314] [2.2.5-8.2] - Improve fix for CVE-2022-25313 - Related: CVE-2022-25313 [2.2.5-8.1] - Fix multiple CVEs - Resolves: CVE-2022-25314 - Resolves: CVE-2022-25313

  Jun 30, 2022
• High max 5.5
  ELSA-2022-9534 6 CVEs

  Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

  [5.15.0-0.30.19] - net/mlx4: Increase num_srq in low_mem_profile (Dave Kleikamp) [Orabug: 34052160] [5.15.0-0.30.18] - Revert ocfs2: mount shared volume without ha stack (Junxiao Bi) [Orabug: 33701900] - KVM: x86/speculation: Disable Fill buffer clear within …

  Jun 30, 2022
• Medium max 8.1
  ELSA-2022-5313 4 CVEs

  Moderate: curl security update (Oracle Linux 8)

  [7.61.1-22.el8_6.3] - fix too eager reuse of TLS and SSH connections (CVE-2022-27782) [7.61.1-22.el8_6.2] - fix invalid type in printf() argument detected by Coverity [7.61.1-22.el8_6.1] - fix credential leak on redirect (CVE-2022-27774) - fix auth/cookie lea…

  Jun 30, 2022
• High max 9.8
  ELSA-2022-4892 8 CVEs

  Important: thunderbird security update (Oracle Linux 9)

  [91.10.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Reference oracle-indexhtml within Requires [Orabug: 33802044] [91.10.0-1] - Update to 91.10.0 build1

  Jun 30, 2022
• High max 9.8
  ELSA-2022-4589 8 CVEs

  Important: thunderbird security update (Oracle Linux 9)

  [91.9.0-3.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Reference oracle-indexhtml within Requires [Orabug: 33802044] [91.9.0-3] - Update to 91.9.0 build3 [91.9.0-2] - Update to 91.9.0 build2 [91.9.0-1] - Updat…

  Jun 30, 2022
• High max 7.5
  ELSA-2022-4584 1 CVE

  Important: zlib security update (Oracle Linux 9)

  [1.2.11-31.1] - Fix CVE-2018-25032 Resolves: CVE-2018-25032

  Jun 30, 2022
• High max 7.5
  ELSA-2022-4592 1 CVE

  Important: rsync security update (Oracle Linux 9)

  [3.2.3-9.1] - Resolves: #2074784 - A flaw found in zlib v1.2.2.2 through zlib v1.2.11 when compressing certain inputs

  Jun 30, 2022