Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

High

ELSA-2022-9198 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.511.5.4] - x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp) [Orabug: 33922122] {CVE-2021-26341} - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp) [Orabug: 33922122] {CVE-20…

Mar 8, 2022
High

ELSA-2022-9200 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.304.4.4] - arm64: Use the clearbhb instruction in mitigations (James Morse) [Orabug: 33921646] - arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly) [Orabug: 33921646] - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (J…

Mar 8, 2022
High

ELSA-2022-9199 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.304.4.4] - arm64: Use the clearbhb instruction in mitigations (James Morse) [Orabug: 33921646] - arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly) [Orabug: 33921646] - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (J…

Mar 8, 2022
High max 6.9

ELSA-2022-9177 2 CVEs 1 exploited

Important: jquery-ui security update (Oracle Linux 7)

[1.10.4.custom-4.0.1] - Backport jQuery CVE-2020-11022 and CVE-2020-11023 fixes to bundled jQuery v1.10.2 [Orabug: 33869588] [1.10.4.custom-4] - removed %%defattr from specfile - removed Group from specfile - removed BuildRoot from specfiles * Tue May 10 2016…

Mar 1, 2022
High max 7.8

ELSA-2022-9179 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.511.5.2] - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33876756] {CVE-2022-0492} - scsi: libiscsi: Hold back_lock when calling iscsi_complete_task (Gulam Mohamed) [Orabug: 33876755] [4.14.35-2047.511.5.1] - …

Feb 28, 2022
High max 7.8

ELSA-2022-9180 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.511.5.2.el7] - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33876756] {CVE-2022-0492} - scsi: libiscsi: Hold back_lock when calling iscsi_complete_task (Gulam Mohamed) [Orabug: 33876755] [4.14.35-2047.511.5.1…

Feb 28, 2022
Medium max 7.0

ELSA-2022-0672 3 CVEs

Moderate: ruby:2.5 security update (Oracle Linux 8)

ruby [2.5.9-109] - Properly fix command injection vulnerability in Rdoc. Related: CVE-2021-31799 [2.5.9-108] - Fix command injection vulnerability in RDoc. Resolves: CVE-2021-31799 - Fix StartTLS stripping vulnerability in Net::IMAP Resolves: CVE-2021-32066 -…

Feb 28, 2022
High

ELSA-2022-9181 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.304.4.2] - netfilter: nf_tables_offload: incorrect flow offload action array size (Pablo Neira Ayuso) [Orabug: 33899500] {CVE-2022-25636}

Feb 28, 2022
High

ELSA-2022-9182 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

- 5.4.17-2136.304.4.2.el7 - netfilter: nf_tables_offload: incorrect flow offload action array size (Pablo Neira Ayuso) [Orabug: 33899500] {CVE-2022-25636}

Feb 28, 2022
High

ELSA-2022-9172 15 CVEs

Important: virt:kvm_utils security update (Oracle Linux 8)

hivex [1.3.18-21] - Bounds check for block exceeding page length (CVE-2021-3504) resolves: rhbz#1950501 libguestfs [1.40.2-28.0.1] - Replace upstream references from description tag - Config supermin to use host yum.conf in ol8 [Orabug: 29319324] - Set DISTRO…

Feb 25, 2022
High

ELSA-2022-0666 1 CVE

Important: cyrus-sasl security update (Oracle Linux 7)

[2.1.26-24.0.1] - Check against gssapi null pointer [Orabug: 33270138] [2.1.26-24] - Fix for CVE-2022-24407 - Resolves: rhbz#2055842

Feb 24, 2022
High

ELSA-2022-0658 1 CVE

Important: cyrus-sasl security update (Oracle Linux 8)

[2.1.27-6] - Fix for CVE-2022-24407 - Resolves: rhbz#2055846

Feb 24, 2022
Low

ELSA-2022-0628 1 CVE

Low: 389-ds-base security and bug fix update (Oracle Linux 7)

[1.3.10.2-15] - Bump version to 1.3.10.2-15 - Resolves: Bug 2049812 - Fix csn generator to limit time skew drift - Resolves: Bug 2048530 - CVE-2021-4091 389-ds-base: double-free of the virtual attribute context in persistent search

Feb 23, 2022
Medium

ELSA-2022-0621 2 CVEs

Moderate: openldap security update (Oracle Linux 7)

[2.4.44-25] - Fix CVE-2020-25709 openldap: assertion failure in Certificate List syntax validation (#2040539) - Fix CVE-2020-25710 openldap: assertion failure in CSN normalization with invalid input (#2040538)

Feb 23, 2022
High max 7.8

ELSA-2022-0620 9 CVEs 1 exploited

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1160.59.1.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and…

Feb 23, 2022
High max 9.8

ELSA-2022-0609 2 CVEs

Important: python-pillow security update (Oracle Linux 7)

[2.0.0-23gitd1c6db8] - Fixup for CVE-2022-22817 - Security fixes for CVE-2022-22815, CVE-2022-22816 Resolves: rhbz#2042522 [2.0.0-22gitd1c6db8] - Fix for CVE-2022-22817 Resolves: rhbz#2042527

Feb 23, 2022
High max 9.8

ELSA-2022-0643 2 CVEs

Important: python-pillow security update (Oracle Linux 8)

[5.1.1-18] - Fixup for CVE-2022-22817 - Security fixes for CVE-2022-22815, CVE-2022-22816 Resolves: rhbz#2042522 [5.1.1-17] - Fix for CVE-2022-22817 Resolves: rhbz#2042527

Feb 23, 2022
High max 9.6

ELSA-2022-0538 7 CVEs

Important: thunderbird security update (Oracle Linux 7)

[91.6.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [91.6.0-1] - Update to 91.6.0 build1

Feb 16, 2022
High max 9.6

ELSA-2022-0514 7 CVEs

Important: firefox security update (Oracle Linux 7)

[91.6.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Enabled aarch64 build [91.6.0-1] - Update to 91.6.0 buil…

Feb 16, 2022
High max 8.8

ELSA-2022-0543 6 CVEs

Important: ruby:2.6 security update (Oracle Linux 8)

ruby [2.6.9-108] - Upgrade to Ruby 2.6.9. - Skip JIT tests in RHEL 8. - Fix the issues required to start the 'make test-bundler' itself. - Fix Bundler dependency confusion. Resolves: CVE-2020-36327

Feb 16, 2022
High max 8.8

ELSA-2022-0545 1 CVE

Important: ruby:2.5 security update (Oracle Linux 8)

rubygem-bundler [1.16.1-4] - Fix Bundler dependency confusion. Resolves: CVE-2020-36327

Feb 16, 2022
High max 9.6

ELSA-2022-0535 7 CVEs

Important: thunderbird security update (Oracle Linux 8)

[91.6.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.6.0-1] - Update to 91.6.0 build1

Feb 15, 2022
High max 8.4

ELSA-2022-9148 6 CVEs 2 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.304.4.1] - Revert rds/ib: Kernel upgrade to rds_ib_conns info displayed by rds-info (Rohit Nair) [Orabug: 33832625] - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33832582] {CVE-2022-0492} [5.4.17-2136.304.4] …

Feb 14, 2022
High max 9.6

ELSA-2022-0510 7 CVEs

Important: firefox security update (Oracle Linux 8)

[91.6.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.6.0-1] - Update to 91.6.0 build1 [91.5.0-2] - Use default update channel to fix non working enterprise policies: rhbz#2044667

Feb 14, 2022
High max 8.4

ELSA-2022-9147 6 CVEs 2 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.304.4.1] - Revert rds/ib: Kernel upgrade to rds_ib_conns info displayed by rds-info (Rohit Nair) [Orabug: 33832625] - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33832582] {CVE-2022-0492} [5.4.17-2136.304.4] …

Feb 14, 2022
High max 7.5

ELSA-2022-0495 1 CVE

Important: .NET 5.0 security and bugfix update (Oracle Linux 8)

[5.0.211-1.0.1] - Support AArch64 on Oracle Linux [Orabug: 32738620] - Include new Oracle Linux runtime IDs Add 1000-Add-missing-OL-RIDs.patch [5.0.211-1] - Update to .NET SDK 5.0.211 and Runtime 5.0.14 - Resolves: RHBZ#2047767

Feb 9, 2022
High max 7.8

ELSA-2022-9142 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.302.7.2.3] - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33832574] {CVE-2022-0492}

Feb 9, 2022
High max 7.8

ELSA-2022-9141 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.302.7.2.3] - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman) [Orabug: 33832574] {CVE-2022-0492}

Feb 9, 2022
High

ELSA-2022-0473 1 CVE

Important: aide security update (Oracle Linux 7)

[0.15.1-13.0.1] - Fix sha256 and sha512 output length [Orabug: 30820565] [0.15.1.1] - backported fix for CVE-2021-45417 resolves: rhbz#2041952

Feb 8, 2022
High max 9.8

ELSA-2022-0442 3 CVEs

Important: log4j security update (Oracle Linux 7)

[0:1.2.17-18] - Fix Unsafe deserialization flaw in Chainsaw log viewer - Fix SQL injection when application is configured to use JDBCAppender - Fix remote code execution when application is configured to use JMSSink - Resolves: CVE-2022-23307, CVE-2022-23305,…

Feb 8, 2022
High

ELSA-2022-0441 1 CVE

Important: aide security update (Oracle Linux 8)

[0.16.14.1] - backported fix for CVE-2021-45417 resolves: rhbz#2041956

Feb 7, 2022
High

ELSA-2022-9123 5 CVEs

Important: qemu security update (Oracle Linux 7)

[15:4.2.1-15.el7] - Document CVE-2021-4158 and CVE-2021-3947 as fixed (Mark Kanda) [Orabug: 33719302] [Orabug: 33754145] {CVE-2021-3947} {CVE-2021-4158} - hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 (Philippe Mathieu-Daude) [Orabug: 324394…

Feb 5, 2022
High

ELSA-2022-0418 1 CVE

Important: varnish:6 security update (Oracle Linux 8)

varnish [6.0.8-1.1] - Resolves: #2047648 - CVE-2022-23959 varnish:6/varnish: Varnish HTTP/1 Request Smuggling Vulnerability varnish-modules [0.15.0-6] - Related: #1982862 - rebuild for new varnish version

Feb 3, 2022
Medium max 7.8

ELSA-2022-0366 5 CVEs

Moderate: vim security update (Oracle Linux 8)

[8.0.1763-16.0.1.4] - - Remove upstream references [Orabug: 31197557] [2:8.0.1763-16.4] - CVE-2021-4193 vim: vulnerable to Out-of-bounds Read - CVE-2021-4192 vim: vulnerable to Use After Free [2:8.0.1763-16.3] - 2028341 - CVE-2021-3984 vim: illegal memory acc…

Feb 3, 2022
Medium

ELSA-2022-0368 1 CVE

Moderate: rpm security update (Oracle Linux 8)

[4.14.3-19.2] - Address covscan issues in binding sigs validation patch (#2022537) [4.14.3-19.1] - Validate and require subkey binding sigs on PGP pubkeys (#2022537) - Fixes CVE-2021-3521

Feb 2, 2022
Medium

ELSA-2022-0370 1 CVE

Moderate: cryptsetup security update (Oracle Linux 8)

[2.3.3-4.1] - patch: fix CVE-2021-4122. - Resolves: #2036906

Feb 2, 2022
Medium max 9.8

ELSA-2022-0350 9 CVEs

Moderate: nodejs:14 security, bug fix, and enhancement update (Oracle Linux 8)

nodejs [1:14.18.2-2] - Add missing fixes - Resolves: RHBZ#2027642, RHBZ#2027635 [1:14.18.2-1] - Resolves: RHBZ#2027609 - Resolves: RHBZ#2027649, RHBZ#2027646, RHBZ#2027642, RHBZ#2027635 - Rebase to new version to fix CVEs

Feb 2, 2022
High max 7.8

ELSA-2022-9088 6 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.60.1] - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) [Orabug: 33699627] [Orabug: 33762471] {CVE-2021-4155} - fix regression in 'epoll: Keep a reference on files added to the check list' (Al Viro) [Orabu…

Feb 1, 2022
Critical max 8.8

ELSA-2022-0328 1 CVE

Critical: samba security and bug fix update (Oracle Linux 7)

[4.10.16-18] - resolves: #2034800 - Fix usermap script regression caused by CVE-2020-25717 - resolves: #2036595 - Fix MIT realm regression caused by CVE-2020-25717 - resolves: #2046148 - Fix CVE-2021-44142

Feb 1, 2022
High

ELSA-2022-0323 1 CVE

Important: nginx:1.20 security update (Oracle Linux 8)

[1.20.1-1.0.1] - Remove Red Hat references [Orabug: 29498217] [1:1.20.1-1] - rebase to 1.20.1 (addressing CVE-2021-23017)

Feb 1, 2022