Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

Medium

ELSA-2021-4270 1 CVE

Moderate: rust-toolset:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

rust-toolset [1.54.0-1] - Update to Rust and Cargo 1.54.0. [1.53.0-1] - Update to Rust and Cargo 1.53.0. rust [1.54.0-2] - Make std-static-wasm* arch-specific to avoid s390x. [1.54.0-1] - Update to 1.54.0. [1.53.0-2] - Use llvm-ranlib to fix wasm archives. [1…

Nov 16, 2021
Medium

ELSA-2021-4325 1 CVE

Moderate: lasso security and enhancement update (Oracle Linux 8)

[2.6.0-12] - Fix a dead code issue in the signature wrapping patch - Resolves: rhbz#1951653 - CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses [rhel-8] [2.6.0-11] - Bump release to force the package through OSCI as the pr…

Nov 16, 2021
Medium max 7.5

ELSA-2021-4409 1 CVE

Moderate: libgcrypt security and bug fix update (Oracle Linux 8)

[1.8.5-6] - Fix for CVE-2021-33560 (#1971421) - Enable HW optimizations in FIPS (#1976137) - Performance enchancements for ChaCha20 and Poly1305 (#1855231) [1.8.5-5] - Performance enchancements for AES-GCM, CRC32 and SHA2 (#1855231)

Nov 16, 2021
Medium max 5.4

ELSA-2021-4213 5 CVEs

Moderate: php:7.4 security, bug fix, and enhancement update (Oracle Linux 8)

libzip php [7.4.19-1] - rebase to 7.4.19 #1944110

Nov 16, 2021
Medium

ELSA-2021-4393 1 CVE

Moderate: cups security and bug fix update (Oracle Linux 8)

[1:2.2.6-40] - 1955964 - PreserveJobHistory doesnt work with seconds - 1927452 - CVE-2020-10001 cups: access to uninitialized buffer in ipp.c [rhel-8] [1:2.2.6-39] - 1941437 - cupsd doesnt log job ids when logging into journal - 1782216 - Print queue is pause…

Nov 16, 2021
Medium max 7.5

ELSA-2021-4424 2 CVEs

Moderate: openssl security and bug fix update (Oracle Linux 8)

[1:1.1.1k-4] - Fixes bugs in s390x AES code. - Uses the first detected address family if IPv6 is not available - Reverts the changes in https://github.com/openssl/openssl/pull/13305 as it introduces a regression if server has a DSA key pair, the handshake fai…

Nov 16, 2021
Medium max 5.5

ELSA-2021-4222 1 CVE

Moderate: container-tools:3.0 security and bug fix update (Oracle Linux 8)

buildah [1.19.9-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.19 (https://github.com/containers/buildah/commit/c1d6200) - fixes CVE-2021-3602 - Related: #1977943

Nov 16, 2021
Medium max 5.7

ELSA-2021-4399 1 CVE

Moderate: python3 security update (Oracle Linux 8)

[3.6.8-41.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8-41] - Security fix for CVE-2021-3733: Denial of service when identifying crafted invalid RFCs Resolves: rhbz#1995234 [3.6.8-40] - Adjusted the postun scriptlets to enable …

Nov 16, 2021
Low

ELSA-2021-4236 1 CVE

Low: tcpdump security and bug fix update (Oracle Linux 8)

[14:4.9.3-2] - Resolves: #1860216 - tcpdump can not parse mptcp options - Resolves: #1901635 - ppp decapsulator can be convinced to allocate a large amount of memory - Adding tedude test to gating

Nov 16, 2021
Medium

ELSA-2021-4288 1 CVE

Moderate: libjpeg-turbo security and bug fix update (Oracle Linux 8)

[1.5.3-12] - Add missing license file (#1982572) [1.5.3-11] - Fix CVE-2020-17541 (#1972289)

Nov 16, 2021
Medium max 7.5

ELSA-2021-4319 3 CVEs

Moderate: compat-exiv2-026 security update (Oracle Linux 8)

[0.26-6] - Fix out-of-bounds read in Exiv2::Jp2Image::printStructure Resolves: bz#1993283 - Fix out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header Resolves: bz#1993246

Nov 16, 2021
Low

ELSA-2021-4373 2 CVEs

Low: pcre security update (Oracle Linux 8)

[8.42-6] - Rebuild for BZ#1954441 [8.42-5] - Fix CVE-2019-20838 (a subject buffer overread in JIT when UTF is disabled and \X or \R has a greater than 1 fixed quantifier) (bug #1852252) - Fix CVE-2020-14155 (an integer overflow when parsing numbers after '(?C…

Nov 16, 2021
Medium

ELSA-2021-4241 4 CVEs

Moderate: libtiff security and bug fix update (Oracle Linux 8)

[4.0.9-20] - Rebuild for fixed binutils (#1954437) [4.0.9-19] - Fix CVE-2020-35521 (#1945539) - Fix CVE-2020-35522 (#1945555) - Fix CVE-2020-35523 (#1945542) - Fix CVE-2020-35524 (#1945546)

Nov 16, 2021
Medium max 6.1

ELSA-2021-4361 1 CVE

Moderate: NetworkManager security, bug fix, and enhancement update (Oracle Linux 8)

[1.32.10-4.0.1] - add connectivity check via Oracle servers [Orabug: 32051972] - Disable the build of NetworkManager-config-connectivity-* subpackage for 8.3 [1:1.32.10-4] - revert unapproved patches part of 'cloud-setup' change (rh #1977984) [1:1.32.10-3] - …

Nov 16, 2021
Medium max 6.3

ELSA-2021-4364 4 CVEs

Moderate: binutils security update (Oracle Linux 8)

[2.30-108.0.2] - Forward-port the following update: [2.30-93.0.4 - Backport fix for fencepost bug in CTF pptrtab usage causing coredumps - Backport test result fixes for new GCC-based CTF generation [Orabug: 33344570] - Reviewed-by: David Faust <david.faust@o…

Nov 16, 2021
Low

ELSA-2021-4386 1 CVE

Low: gcc security and bug fix update (Oracle Linux 8)

[8.5.0-3.0.2] - Fix Orabug 33451471 and backport CTF/BTF enhancements ctfc: Free CTF container elements in ctfc_delete_container () ctf: Do not warn for CTF not supported for GNU GIMPLE ICE in btf_finalize when compiling with -gbtf (PR debug/102507, Orabug 33…

Nov 16, 2021
Medium max 9.1

ELSA-2021-4358 3 CVEs

Moderate: glibc security, bug fix, and enhancement update (Oracle Linux 8)

[2.28-164.0.1] - Merge of RH patches for ol8-u5 beta release Review-exception: Routine merge - Provide glibc.pthread.mutex_spin_count tunable for pthread adaptive - spin mutex Orabug: 27982358. Reviewed-by: Qing Zhao <qing.zhao@oracle.com> - add Ampere emag t…

Nov 16, 2021
Low

ELSA-2021-4387 1 CVE

Low: libssh security update (Oracle Linux 8)

[0.9.4-3] - Fix CVE-2020-16135 NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL (#1862646)

Nov 16, 2021
Medium max 5.3

ELSA-2021-4511 3 CVEs

Moderate: curl security and bug fix update (Oracle Linux 8)

[7.61.1-22] - fix STARTTLS protocol injection via MITM (CVE-2021-22947) - fix protocol downgrade required TLS bypass (CVE-2021-22946) [7.61.1-21] - fix TELNET stack contents disclosure again (CVE-2021-22925) - fix TELNET stack contents disclosure (CVE-2021-22…

Nov 16, 2021
Medium max 8.2

ELSA-2021-4517 2 CVEs

Moderate: vim security update (Oracle Linux 8)

[8.0.1763-16.0.1] - - Remove upstream references [Orabug: 31197557] [2:8.0.1763-16] - 2004974 - CVE-2021-3796 vim: use-after-free in nv_replace() in normal.c [rhel-8.5.0] - 2004891 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c […

Nov 16, 2021
Medium

ELSA-2021-4251 14 CVEs

Moderate: openjpeg2 security update (Oracle Linux 8)

[2.4.0-4] - Fix Covscan defect [2.4.0-3] - Fix CVE-2021-3575 (#1969279) - Fix resource leak identified by Covscan [2.4.0-2] - Fix CVE-2021-29338 (#1951332) [2.4.0-1] - Rebase to 2.4.0 - Resolves: CVE-2018-5727 (#1538467) - Resolves: CVE-2018-5785 (#1538556) -…

Nov 16, 2021
Medium max 7.5

ELSA-2021-4324 1 CVE

Moderate: python-psutil security update (Oracle Linux 8)

[5.4.3-11] - Security fix for CVE-2019-18874: double free because of refcount mishandling Resolves: rhbz#1772014

Nov 16, 2021
Medium

ELSA-2021-4256 1 CVE

Moderate: graphviz security update (Oracle Linux 8)

[2.40.1-43] - Fixed races during pdf documentation build which should build docs correctly Related: CVE-2020-18032 [2.40.1-42] - Rebuilt, because pdf documentation were built incorrectly Related: CVE-2020-18032 [2.40.1-41] - Fixed buffer overflow in lib/commo…

Nov 16, 2021
Medium max 4.0

ELSA-2021-4153 1 CVE

Moderate: dnsmasq security and bug fix update (Oracle Linux 8)

[2.79-19] - Correct typo in man page (#1947039) [2.79-18] - Properly randomize outgoing ports also with bound interface (CVE-2021-3448) [2.79-17] - Fix sporadic bind-dynamic failures (#1887649) [2.79-16] - Fix network errors on queries both from ipv4 and ipv6…

Nov 16, 2021
Medium max 6.5

ELSA-2021-4292 7 CVEs

Moderate: squid:4 security, bug fix, and enhancement update (Oracle Linux 8)

libecap squid [7:4.15-1] - new version 4.15 - Resolves: #1964384 - squid:4 rebase to 4.15 [7:4.11-5] - Resolves: #1944261 - CVE-2020-25097 squid:4/squid: improper input validation may allow a trusted client to perform HTTP Request Smuggling

Nov 16, 2021
Medium

ELSA-2021-4191 7 CVEs

Moderate: virt:ol and virt-devel:ol security, bug fix, and enhancement update (Oracle Linux 8)

libguestfs-winsupport [8.2] - Resolves: bz#1810193 (Upgrade components in virt:rhel module:stream for RHEL-8.3 release) libguestfs [1.40.2-28.0.1] - Replace upstream references from description tag - Config supermin to use host yum.conf in ol8 [Orabug: 293193…

Nov 16, 2021
Medium max 7.5

ELSA-2021-4160 7 CVEs

Moderate: python39:3.9 and python39-devel:3.9 security update (Oracle Linux 8)

mod_wsgi [4.7.1-4] - Convert from Fedora to the python39 module in RHEL8 - Resolves: rhbz#1877430 [4.7.1-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild [4.7.1-2] - Rebuilt for Python 3.9 [4.7.1-1] - update to 4.7.1 (#1721376) numpy [1.…

Nov 16, 2021
Medium max 7.8

ELSA-2021-4162 10 CVEs

Moderate: python38:3.8 and python38-devel:3.8 security update (Oracle Linux 8)

Nov 16, 2021
High max 5.8

ELSA-2021-4619 2 CVEs

Important: freerdp security update (Oracle Linux 7)

[2:2.2.0-5] - Update: Refactored RPC gateway parser (rhbz#2017944) + fix issues discovered by Covscan [2:2.2.0-4] - Refactored RPC gateway parser (rhbz#2017944) [2.1.1-3] - Add checks for bitmap and glyph width/heigth values (rhbz#2017951)

Nov 11, 2021
High

ELSA-2021-9545 1 CVE

Important: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-39.0.2.1] - mod_session: save one apr_strtok() [Orabug: 33338149][CVE-2021-26690]

Nov 11, 2021
High max 8.6

ELSA-2021-9525 5 CVEs

Important: olcne security update (Oracle Linux 7)

olcne [1.2.5-2] - Update Istio to 1.9.8 to address CVE-2021-32777, CVE-2021-32778, CVE-2021-32779, CVE-2021-32780 & CVE-2021-32781 - Update proxyv2 image to select iptables legacy or latest based on host operating system - Turn off Istio PodDisruptionBudget i…

Nov 10, 2021
High max 8.8

ELSA-2021-9526 6 CVEs

Important: olcne security update (Oracle Linux 7)

olcne [1.3.2-2] - Turn off default PodDisruptionBudget in istio template to unblock kubernetes module upgrade - Update Kubernetes version to 1.20.11 to address CVE-2021-25741 - Update Istio to 1.9.8, 1.10.4 to address CVE-2021-32777, CVE-2021-32778, CVE-2021-…

Nov 9, 2021
High max 8.8

ELSA-2021-9546 6 CVEs

Important: olcne istio istio kubernetes security update (Oracle Linux 8)

olcne [1.3.2-2] - Turn off default PodDisruptionBudget in istio template to unblock kubernetes module upgrade - Update Kubernetes version to 1.20.11 to address CVE-2021-25741 - Update Istio to 1.9.8, 1.10.4 to address CVE-2021-32777, CVE-2021-32778, CVE-2021-…

Nov 9, 2021
Low max 6.8

ELSA-2020-5004 1 CVE

Low: resource-agents security and bug fix update (Oracle Linux 7)

[4.1.1-61.4] - Upgrade bundled python-httplib2 to fix CVE-2020-11078 Resolves: rhbz#1850992 [4.1.1-61.2] - azure-lb: fix redirect issue Resolves: rhbz#1850779 [4.1.1-61.1] - gcp-vpc-move-vip: add support for multiple alias IPs - sybaseASE: run verify action d…

Nov 5, 2021
Medium

ELSA-2020-5453 1 CVE

Moderate: pacemaker security update (Oracle Linux 7)

[1.1.23-1.0.1] - Upstream reference in pacemaker crm_report binary [Orabug: 31611300] [1.1.23-1.1] - Prevent ACL bypass (CVE-2020-25654) - Resolves: rhbz#1892140

Nov 5, 2021
High

ELSA-2021-4134 6 CVEs

Important: thunderbird security update (Oracle Linux 7)

[91.3.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.3.0-2] - Update to 19.3.0 build2 [91.3.0-1] - Update to 91.3.0 build1

Nov 5, 2021
High

ELSA-2021-4130 6 CVEs

Important: thunderbird security update (Oracle Linux 8)

[91.3.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.3.0-2] - Update to 19.3.0 build2 [91.3.0-1] - Update to 91.3.0 build1

Nov 5, 2021
High

ELSA-2021-4116 6 CVEs

Important: firefox security update (Oracle Linux 7)

[91.3.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.3.0-1] - Update to 91.3.0 build1

Nov 4, 2021
High

ELSA-2021-9541 1 CVE

Important: httpd security update (Oracle Linux 7)

[2.4.6-97.0.3.1] - mod_session: save one apr_strtok() [Orabug: 33338149][CVE-2021-26690]

Nov 4, 2021
High

ELSA-2021-4123 6 CVEs

Important: firefox security update (Oracle Linux 8)

[91.3.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.3.0-1] - Update to 91.3.0 build1

Nov 4, 2021