Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

  • Medium max 7.5
    ELSA-2021-5206 1 CVE

    Moderate: log4j security update (Oracle Linux 7)

    [0:1.2.17-17] - Fix remote code execution vulnerability - Resolves: CVE-2021-4104

  • High
    ELSA-2021-9623 1 CVE

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [5.4.17-2136.302.6.1] - rds/ib: Use both iova and key in free_mr socket call (aru kolappan) [Orabug: 33667276] [5.4.17-2136.302.6] - Revert fs: align IOCB_* flags with RWF_* flags (Prasad Singamsetty) [Orabug: 33627551] [5.4.17-2136.302.5] - Revert drm: Initi…

  • High
    ELSA-2021-9621 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.302.6.1] - rds/ib: Use both iova and key in free_mr socket call (aru kolappan) [Orabug:33667276] [5.4.17-2136.302.6] - Revert fs: align IOCB_* flags with RWF_* flags (Prasad Singamsetty) [Orabug: 33627551] [5.4.17-2136.302.5] - Revert drm: Initia…

  • Medium
    ELSA-2021-5195 1 CVE

    Moderate: ipa security and bug fix update (Oracle Linux 7)

    [4.6.8-5.0.1] - Blank out header-logo.png product-name.png - Replace login-screen-logo.png [Orabug: 20362818] [4.6.8-5.el7_9.10] - Resolves: 2025848 - RHEL 8.6 IPA Replica Failed to configure PKINIT setup against a RHEL 7.9 IPA server - Fix cert_request for K…

  • High
    ELSA-2021-5192 2 CVEs

    Important: samba security and bug fix update (Oracle Linux 7)

    [4.10.16-17] - related: #2019673 - Add missing checks for IPA DC server role [4.10.16-16] - resolves: #2019661 - Fix CVE-2016-2124 - resolves: #2019673 - Fix CVE-2020-25717 - resolves: #2021428 - Add missing PAC buffer types to krb5pac.idl

  • High
    ELSA-2021-9619 2 CVEs

    Important: httpd security update (Oracle Linux 7)

    [2.4.6-97.0.5.2] - scoreboard: fix null pointer deference [Orabug: 33561206][CVE-2021-34798] - fix ap_escape_quote logic [Orabug: 33617690][CVE-2021-39275]

  • Medium
    ELSA-2021-5142 1 CVE

    Moderate: idm:DL1 security update (Oracle Linux 8)

    ipa [4.9.6-10.0.1] - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674] [4.9.6-10] - Bump realease version due to build issue. Related: RHBZ#2021489 [4.9.6-9] - Hardening for CVE-2020-25717, part 3 Related: RHBZ#2021489 [4.9.6-8] - Hardening f…

  • High max 7.5
    ELSA-2021-5160 2 CVEs

    Important: go-toolset:ol8 security and bug fix update (Oracle Linux 8)

    golang [1.16.12-1] - Rebase to Go 1.16.12 - Resolves: rhbz#2031125 go-toolset [1.16.12-1] - Rebase to Go 1.16.12 - Resolves: rhbz#2031125

  • Medium max 9.8
    ELSA-2021-5171 7 CVEs

    Moderate: nodejs:16 security, bug fix, and enhancement update (Oracle Linux 8)

    nodejs [16.13.1-3.0.1] - Libraries must not be group-writeable. Change node-gyp permission to 0755 [Orabug: 28451433] [1:16.13.1-3] - Resolves: RHBZ#2027610 - Add corepack to spec [1:16.13.1-2] - Resolves: RHBZ#2027610 - Update npm version test [1:16.13.1-1] …

  • High
    ELSA-2021-5082 3 CVEs

    Important: samba security update (Oracle Linux 8)

    [4.14.5-7] - related: rhbz#2021171 - Fix CVE-2020-25717 - Fix running ktest (selftest) [4.14.5-6] - related: rhbz#2021171 - Fix CVE-2020-25717 - Add missing checks for IPA DC server role

  • High
    ELSA-2021-5046 10 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [91.4.0-3.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.4.0-3] - Bump NVR for ppc64 build [91.4.0-2] - Update to 91.4.0 build2 [91.4.0-1] - Update to 91.4.0 build1

  • High
    ELSA-2021-5045 10 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [91.4.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.4.0-2] - Update to 91.4.0 build2 [91.4.0-1] - Update to 91.4.0 build1

  • High
    ELSA-2021-5013 9 CVEs

    Important: firefox security update (Oracle Linux 8)

    [91.4.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.4.0-1] - Update to 91.4.0 build1

  • High
    ELSA-2021-5014 9 CVEs

    Important: firefox security update (Oracle Linux 7)

    [91.4.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.4.0-1] - Update to 91.4.0 build1

  • Medium
    ELSA-2021-9575 1 CVE

    Moderate: openssh security update (Oracle Linux 7)

    [7.4p1-22.0.1_fips] - Change Epoch from 1 to 10 - Enable fips KDF POST [Orabug: 32461750] - Disable diffie-hellman-group-exchange-sha256 KEX FIPS method [Orabug: 32461739] [7.4p1-22.0.1] - enlarge format buffer size for certificate serial number so the log me…

  • High
    ELSA-2021-9577 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.58.2] - ovl: prevent private clone if bind mount is not allowed (Miklos Szeredi) [Orabug: 33560431] {CVE-2021-3732} [4.1.12-124.58.1] - sunrpc: move NO_CRKEY_TIMEOUT to the auth->au_flags (Scott Mayhew) [Orabug: 33443537] - xen/netfront: stop tx q…

  • High max 8.8
    ELSA-2021-4913 3 CVEs

    Important: mailman security update (Oracle Linux 7)

    [3:2.1.15-30.2] - Fix for CVE-2021-44227 - Resolves: #2026866 [3:2.1.15-30.1] - Fix for CVE-2016-6893 - Fix for CVE-2021-42097 - Resolves: #2024884, #2020688

  • High max 8.8
    ELSA-2021-4916 1 CVE

    Important: mailman:2.1 security update (Oracle Linux 8)

    [3:2.1.29-12.2] - Fix for CVE-2021-44227 - Resolves: #2026871 [3:2.1.29-12.1] - Fix for CVE-2021-42096 - Fix for CVE-2021-42097 - Resolves: #2021139, #2020692

  • Critical
    ELSA-2021-4904 1 CVE

    Critical: nss security update (Oracle Linux 7)

    [3.67.0-4] - fix CVE-2021-43527

  • Critical
    ELSA-2021-4903 1 CVE

    Critical: nss security update (Oracle Linux 8)

    [3.67.0-7] - Fix CVE 2021 43527

  • High
    ELSA-2021-9568 14 CVEs

    Important: virt:kvm_utils security update (Oracle Linux 8)

    hivex [1.3.18] - Resolves: bz#1810193 (Upgrade components in virt:rhel module:stream for RHEL-8.3 release) [1.3.18] - Resolves: bz#1810193 (Upgrade components in virt:rhel module:stream for RHEL-8.3 release) libguestfs [1:1.40.2-25.0.1] - Replace upstream ref…

  • Medium
    ELSA-2021-4785 1 CVE

    Moderate: rpm security update (Oracle Linux 7)

    [4.11.3-48] - Fix double-free in previously added patch (#2004228) [4.11.3-47] - Improve range checks on signature and main header tags (#2004228) - Fixes CVE-2021-20271

  • Medium
    ELSA-2021-4782 1 CVE

    Moderate: openssh security update (Oracle Linux 7)

    [7.4p1-22.0.1] - enlarge format buffer size for certificate serial number so the log message can record any 64-bit integer without truncation (openssh bz#3012) [Orabug: 30448895] [7.4p1-22 + 0.10.3-2] - avoid segfault in Kerberos cache cleanup (#1999263) - fi…

  • Medium
    ELSA-2021-4788 1 CVE

    Moderate: krb5 security update (Oracle Linux 7)

    [1.15.1-51.0.1] - Add recursion limit for ASN.1 indefinite lengths [Orabug: 32582360] [1.15.1-51] - Fix KDC null deref on TGS inner body null server (CVE-2021-37750) - Resolves: #1997599

  • High
    ELSA-2021-4777 1 CVE

    Important: kernel security and bug fix update (Oracle Linux 7)

    [3.10.0-1160.49.1.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and…

  • Medium
    ELSA-2021-4432 1 CVE

    Moderate: bluez security update (Oracle Linux 8)

    [5.56-1] + bluez-5.56-1 - Fixing (#1965057) - Removing bccmd, enabling hid2hci as upstream removed the support in bluez-5.56

  • High
    ELSA-2021-4826 2 CVEs

    Important: mailman:2.1 security update (Oracle Linux 8)

    [3:2.1.29-12.1] - Fix for CVE-2021-42096 - Fix for CVE-2021-42097 - Resolves: #2021139, #2020692

  • High
    ELSA-2021-9565 3 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [5.4.17-2136.301.1.2.el7] - Revert 'net/rds: Allocate pages on HCA NUMA nodeid' (Gerd Rausch) [Orabug: 33561324] - Revert 'net/rds: Allocate rds_ib_{incoming,frag}_slab on HCA NUMA nodeid' (Gerd Rausch) [Orabug: 33561324] - Revert 'net/rds: Use the same vecto…

  • High
    ELSA-2021-9564 3 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.301.1.2] - Revert 'net/rds: Allocate pages on HCA NUMA nodeid' (Gerd Rausch) [Orabug: 33561324] - Revert 'net/rds: Allocate rds_ib_{incoming,frag}_slab on HCA NUMA nodeid' (Gerd Rausch) [Orabug: 33561324] - Revert 'net/rds: Use the same vector fo…

  • High max 5.7
    ELSA-2021-9562 1 CVE

    Important: python3 security update (Oracle Linux 7)

    [3.6.8-18.0.5] - Remove the 'getfile' feature of pydoc [Orabug: 33182027][CVE-2021-3426]

  • Low max 6.9
    ELSA-2021-9552 2 CVEs 1 exploited

    Low: pcs security update (Oracle Linux 8)

    [0.10.10-4.0.1] - Replace HAM-logo.png with a generic one [0.10.10-4] - Fixed unfencing in - Resolves: rhbz#bz1991654 [0.10.10-3] - Added add/remove syntax for command - Resolves: rhbz#1992668 [0.10.10-2] - Fixed create resources with depth operation attribut…

  • Medium max 7.5
    ELSA-2021-9553 2 CVEs

    Moderate: resource-agents security update (Oracle Linux 8)

    [4.1.1-98] - storage-mon: new resource agent Resolves: rhbz#1509319 [4.1.1-97] - podman: fix possible race during container creation Resolves: rhbz#1972743 [4.1.1-96] - LVM-activate: fix drop-in check to avoid re-creating drop-in Resolves: rhbz#1972035 [4.1.1…

  • Medium
    ELSA-2021-4585 1 CVE

    Moderate: gcc-toolset-10-gcc security update (Oracle Linux 8)

    [10.3.1-1.2.0.1] - Fix Orabug 32423691- gcc10 SEGV for every test in sregress: ORA-7445_ksmplru_add_batchksm same bug as PR tree-optimization/100053: gcc11-pr100053.patch - Fix Orabug 31197798 (Profile data size way too big) same bug as PR gcov-profile/95348:…

  • Medium
    ELSA-2021-4743 1 CVE

    Moderate: llvm-toolset:ol8 security update (Oracle Linux 8)

    clang [12.0.1-4.0.1] - Use all available CPU cores for build - Recognize Oracle Linux distros [OraBug: 29422714] [12.0.1-4] - Trojan source clang-tidy patchset fix [12.0.1-3] - Trojan source clang-tidy patchset

  • Medium
    ELSA-2021-4595 1 CVE

    Moderate: binutils security update (Oracle Linux 8)

    [2.30-108.0.2.1] - Forward-port Oracle patches from 2.30-108.0.2 to 2.30-108.0.2.1 - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> [2.30-108.0.2] - Forward-port the following update: * Thu Oct 07 2021 Nick Alcock <nick.alcock@oracle.com> - 2.30-93.…

  • High
    ELSA-2021-4537 1 CVE

    Important: httpd:2.4 security update (Oracle Linux 8)

    httpd [2.4.37-43.0.1] - Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262] - Replace index.html with Oracle's index page oracle_index.html. [2.4.37-43] - Related: #2007235 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via a crafted request uri-path…

  • Medium
    ELSA-2021-4590 1 CVE

    Moderate: rust-toolset:ol8 security update (Oracle Linux 8)

    rust [1.54.0-3] - Lint against Unicode control codepoints. rust-toolset [1.54.0-1] - Update to Rust and Cargo 1.54.0. [1.53.0-1] - Update to Rust and Cargo 1.53.0.

  • High max 5.8
    ELSA-2021-4622 2 CVEs

    Important: freerdp security update (Oracle Linux 8)

    [2:2.2.0-7] - Updated: Refactored RPC gateway parser (rhbz#2017948) + fixed issues discovered by Covscan [2:2.2.0-6] - Refactored RPC gateway parser (rhbz#2017948) [2:2.2.0-5] - Revert: Refactored RPC gateway parser (rhbz#2017948) [2:2.2.0-4] - Refactored RPC…

  • High max 6.8
    ELSA-2021-4135 8 CVEs

    Important: java-17-openjdk security update (Oracle Linux 8)

    [1:17.0.1.0.12-2] - Extend LTS check to exclude EPEL. - Related: rhbz#2013841 [1:17.0.1.0.12-2] - Set LTS designator. - Related: rhbz#2013841 [1:17.0.1.0.12-1] - Drop JDK-8272332/RH2004078 patch which is upstream in 17.0.1 - Resolves: rhbz#2013841 [1:17.0.1.0…

  • Medium
    ELSA-2021-4649 1 CVE

    Moderate: gcc-toolset-10-binutils security update (Oracle Linux 8)

    [2.35-8.6] - Add ability to control the display of unicode characters. (#2009176)