Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

  • High max 8.1
    ELSA-2022-4795 1 CVE

    Important: rsyslog security update (Oracle Linux 9)

    [8.2102.0-101.1] - Address CVE-2022-24903, Heap-based overflow in TCP syslog server resolves: rhbz#2081402

  • High max 7.5
    ELSA-2022-1729 6 CVEs

    Important: java-17-openjdk security update (Oracle Linux 9)

    [1:17.0.3.0.7-1] - April 2022 security update to jdk 17.0.3+7 - Update to jdk-17.0.3.0+7 tarball - Update release notes to 17.0.3.0+7 - Add missing README.md and generate_source_tarball.sh - Resolves: rhbz#2073578

  • High max 7.5
    ELSA-2022-4588 3 CVEs

    Important: .NET 6.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [6.0.105-1.0.1] - Add missing Oracle RIDs - Build all packages on source-build even when in servicing [6.0.105-1] - Update to .NET SDK 6.0.105 and Runtime 6.0.5 - Resolves: RHBZ#2082268 [6.0.104-1] - Update to .NET SDK 6.0.104 and Runtime 6.0.4 - Resolves: RH…

  • Medium max 5.5
    ELSA-2022-5050 1 CVE

    Moderate: .NET 6.0 security and bugfix update (Oracle Linux 9)

    [6.0.106-1.0.1] - Add missing Oracle RIDs - Build all packages on source-build even when in servicing [6.0.106-1] - Update to .NET SDK 6.0.106 and Runtime 6.0.6 - Resolves: RHBZ#2093433

  • Medium
    ELSA-2022-5250 1 CVE

    Moderate: libxml2 security update (Oracle Linux 9)

    [2.9.13-1.1] - Fix CVE-2022-29824 (#2082299)

  • Critical max 8.8
    ELSA-2022-4772 2 CVEs

    Critical: thunderbird security update (Oracle Linux 9)

    [91.9.1-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Reference oracle-indexhtml within Requires [Orabug: 33802044] [91.9.1-1] - Update to 91.9.1 build1

  • High
    ELSA-2022-4771 1 CVE

    Important: postgresql security update (Oracle Linux 9)

    [13.7-1] - Resolves: CVE-2022-1552 - Update to 13.7 - Release notes: https://www.postgresql.org/docs/release/13.7/

  • Medium
    ELSA-2022-5252 1 CVE

    Moderate: libarchive security update (Oracle Linux 9)

    [3.5.3-2] - Resolves: CVE-2022-26280

  • Medium max 8.1
    ELSA-2022-5245 4 CVEs

    Moderate: curl security update (Oracle Linux 9)

    [7.76.1-14.el9_0.4] - fix too eager reuse of TLS and SSH connections (CVE-2022-27782) [7.76.1-14.el9_0.3] - fix leak of SRP credentials in redirects (CVE-2022-27774) [7.76.1-14.el9_0.2] - add missing tests to Makefile [7.76.1-14.el9_0.1] - fix credential leak…

  • Medium
    ELSA-2022-5251 2 CVEs

    Moderate: pcre2 security update (Oracle Linux 9)

    [10.37-5] - Explicitly require uft subpackages in tools subpackage [10.37-4] - Resolves: CVE-2022-1586 CVE-2022-1587

  • High max 8.8
    ELSA-2022-4582 1 CVE

    Important: gzip security update (Oracle Linux 9)

    [1.10-9] - fix an arbitrary-file-write vulnerability in zgrep Resolves: CVE-2022-1271

  • High max 9.8
    ELSA-2022-4590 6 CVEs

    Important: firefox security update (Oracle Linux 9)

    [91.9.0-1.0.1] - Replaced upstream package with oracle-indexhtml [Orabug: 33802044] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Removed Upstream references [91.9.0-1] - Update to 91.9.0

  • Medium max 7.5
    ELSA-2022-5244 2 CVEs

    Moderate: expat security update (Oracle Linux 9)

    [ 2.2.10-12.2] - Improve fix for CVE-2022-25313 - Related: CVE-2022-25313 [ 2.2.10-12.1] - Fix multiple CVEs - Resolves: CVE-2022-25314 - Resolves: CVE-2022-25313

  • Medium max 8.4
    ELSA-2022-5242 6 CVEs

    Moderate: vim security update (Oracle Linux 9)

    [8.2.2637-16.0.1] - - Remove upstream references [Orabug: 31197557] [2:8.2.2637-16.2] - CVE-2022-1621 vim: heap buffer overflow - CVE-2022-1629 vim: buffer over-read [2:8.2.2637-16.1] - CVE-2022-0554 vim: Use of Out-of-range Pointer Offset in vim prior - CVE-…

  • High max 7.5
    ELSA-2022-9513 1 CVE

    Important: pcs security update (Oracle Linux 9)

    [0.11.1-10.el9_0.1] - Updated bundled rubygems: sinatra, rack-protection - Resolves: rhbz#2081333 [0.11.1-10] - Fixed snmp client - Fixed translating resource roles in colocation constraint - Resolves: rhbz#2048640 [0.11.1-9] - Fixed cluster destroy in web ui…

  • High max 8.8
    ELSA-2022-4940 1 CVE

    Important: xz security update (Oracle Linux 9)

    [5.2.5-8] - Fix arbitrary file write vulnerability Resolves: CVE-2022-1271

  • High max 7.5
    ELSA-2022-1728 5 CVEs

    Important: java-11-openjdk security update (Oracle Linux 9)

    [1:11.0.15.0.10-1] - Update to jdk-11.0.15.0+10 - Update release notes to 11.0.15.0+10 - Switch to GA mode for release - Rebase RH1996182 FIPS patch after JDK-8254410 - Resolves: rhbz#2073594

  • High max 9.8
    ELSA-2022-4873 7 CVEs

    Important: firefox security update (Oracle Linux 9)

    [91.10.0-1.0.1] - Replaced upstream package with oracle-indexhtml [Orabug: 33802044] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Removed Upstream references [91.10.0-1] - Update to 91.10.0 build1

  • High
    ELSA-2022-5249 4 CVEs

    Important: kernel security and bug fix update (Oracle Linux 9)

    [5.14.0-70.17.1.0.1_0.OL9] - lockdown: also lock down previous kgdb use (Daniel Thompson) [Orabug: 34290418] {CVE-2022-21499} [5.14.0-70.17.1_0.OL9] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RH…

  • High max 7.5
    ELSA-2022-2137 5 CVEs

    Important: java-1.8.0-openjdk security update (Oracle Linux 9)

    [1:1.8.0.332.b09-1] - Update to shenandoah-jdk8u332-b09 (GA) - Update release notes for 8u332-b09. - Resolves: rhbz#2074649

  • Critical max 8.8
    ELSA-2022-4765 2 CVEs

    Critical: firefox security update (Oracle Linux 9)

    [91.9.1-1.0.1] - Replaced upstream package with oracle-indexhtml [Orabug: 33802044] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Removed Upstream references [91.9.1-1] - Update to 91.9.1 build1

  • High
    ELSA-2022-4591 1 CVE

    Important: subversion security update (Oracle Linux 9)

    [1.14.1-5] - Fix for CVE-2022-24070 (#2076565)

  • Medium
    ELSA-2022-5257 1 CVE

    Moderate: libinput security update (Oracle Linux 9)

    [1.19.3-2] - CVE-2022-1215: fix a format string vulnerability (#2076816)

  • High max 7.5
    ELSA-2022-4899 1 CVE

    Important: compat-openssl11 security and bug fix update (Oracle Linux 9)

    [1:1.1.1k-4.0.1] - Backport upstream PRs 18446 and 18481 which update certificates used for the self-tests [Orabug: 34326055] [1:1.1.1k-4] - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates Resolves: rhbz#2063147…

  • High max 8.1
    ELSA-2022-5099 8 CVEs

    Important: grub2 security update (Oracle Linux 9)

    [2.06-27.0.5.el9_0.7] - Replaced bugzilla.oracle.com references [Orabug: 34202300] - Update provided certificate version to 202204 [JIRA: OLDIS-16371] - Various coverity fixes [JIRA: OLDIS-16371] - bump SBAT generation - Update bug url [Orabug: 34202300] - Re…

  • Medium
    ELSA-2022-5239 2 CVEs

    Moderate: 389-ds-base security, bug fix, and enhancement update (Oracle Linux 7)

    [1.3.10.2-16] - Bump version to 1.3.10.2-16 - Resolves: Bug 2077395 - CVE-2022-0918 389-ds:1.4/389-ds-base: sending crafted message could result in DoS - Resolves: Bug 2014768 - Log the Auto Member invalid regex rules in the LDAP errors log - Resolves: Bug 20…

  • Medium max 7.5
    ELSA-2022-5234 1 CVE

    Moderate: python-virtualenv security update (Oracle Linux 7)

    [15.1.0-7] - Security fix for CVE-2019-20916 for the bundled pip wheel Resolves: rhbz#1868135

  • Low
    ELSA-2022-5163 1 CVE

    Low: httpd:2.4 security update (Oracle Linux 8)

    httpd [2.4.37-47.0.1.2] - Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-47.2] - Resolves: #2097247 - CVE-2020-13950 httpd:2.4/httpd: mod_proxy NULL pointer dereference

  • High max 5.5
    ELSA-2022-9507 4 CVEs

    Important: microcode_ctl security update (Oracle Linux 7)

    [2:2.1-73.13.0.5] - ensure UEK also rebuilds initramfs [Orabug: 34280052] [2:2.1-73.13.0.3] - update 06-55-04 to 0x2006d05 - update 06-55-07 to 0x5003302 - update 06-6a-04 to 0xb000280 - update 06-6a-06 to 0xd000375 [2:2.1-73.13.0.2] - roll back 06-6a-06 to 0…

  • High max 5.5
    ELSA-2022-9508 4 CVEs

    Important: microcode_ctl security update (Oracle Linux 8)

    [4:20220207-1.0.4] - ensure UEK also rebuilds initramfs [Orabug: 34280058]

  • High
    ELSA-2022-5162 1 CVE

    Important: postgresql security update (Oracle Linux 7)

    [9.2.24-8] - Resolves: CVE-2022-1552 - Backport upstrem fix: a117cebd638dd02e5c2e791c25e43745f233111b

  • High max 6.7
    ELSA-2022-9496 1 CVE

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-372.9.1.0.2.el8.OL8] - debug: lockdown kgdb [Orabug: 34270802] {CVE-2022-21499} [4.18.0-372.9.1.0.1.el8.OL8] - mei: me: disable driver on the ign firmware (Alexander Usyskin) [Orabug: 34176425]

  • High
    ELSA-2022-5056 1 CVE

    Important: cups security and bug fix update (Oracle Linux 8)

    [1:2.2.6-45.2] - CVE-2022-26691 cups: authorization bypass when using 'local' authorization [1:2.2.6-45.1] - 2073531 - 30-second delays printing to Windows 2016 server via HTTPS

  • High max 6.7
    ELSA-2022-9495 1 CVE

    Important: kernel security update (Oracle Linux 7)

    [3.10.0-1160.66.1.0.2.el7] - debug: lock down kgdb [Orabug: 34270798] {CVE-2022-21499}

  • High
    ELSA-2022-9494 2 CVEs

    Important: olcne security update (Oracle Linux 8)

    [1.4.5-1] - Address qemu CVE-2022-26353, CVE-2021-3748

  • High
    ELSA-2022-9491 2 CVEs

    Important: olcne security update (Oracle Linux 7)

    [1.5.3-1] - Address qemu CVE-2022-26353, CVE-2021-3748

  • High
    ELSA-2022-9492 2 CVEs

    Important: olcne security update (Oracle Linux 7)

    [1.4.5-1] - Address qemu CVE-2022-26353, CVE-2021-3748

  • High
    ELSA-2022-9493 2 CVEs

    Important: olcne security update (Oracle Linux 8)

    [1.5.3-1] - Address qemu CVE-2022-26353, CVE-2021-3748

  • Medium max 5.5
    ELSA-2022-5046 1 CVE

    Moderate: .NET 6.0 security and bugfix update (Oracle Linux 8)

    [6.0.106-1.0.1] - Add missing Oracle RIDs [6.0.106-1] - Update to .NET SDK 6.0.106 and Runtime 6.0.6 - Resolves: RHBZ#2093432 [6.0.105-1] - Update to .NET SDK 6.0.105 and Runtime 6.0.5 - Resolves: RHBZ#2082267

  • High max 8.8
    ELSA-2022-5052 1 CVE

    Important: xz security update (Oracle Linux 7)

    [5.2.2-2] - Fix CVE-2022-1271 Resolves: CVE-2022-1271