Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

  • High
    ELSA-2021-4056 3 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-305.25.1_4.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

  • High max 4.7
    ELSA-2021-9534 4 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.57.1] - target; fix print statement warning (John Donnelly) [Orabug: 33495661] - enic;: fix warning on module_param disable_vlan0, (John Donnelly) [Orabug: 33495661] - bnx2fc: correct BNX2FC_TM_TIMEOUT to be 60 sec (John Donnelly) [Orabug: 3349566…

  • Medium
    ELSA-2021-4033 1 CVE

    Moderate: binutils security update (Oracle Linux 7)

    [2.27-44.base.0.3.1] - Forward-port patches to 2.27-44.base.1 - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> [2.27-44.base.0.2.1] - Forward-port patches to 2.27-44.base.1 - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> [2.27-44.base.1] …

  • Medium max 8.8
    ELSA-2021-4097 1 CVE 1 exploited

    Moderate: webkit2gtk3 security and bug fix update (Oracle Linux 8)

    [2.30.4-3] - Fix crashing on aarch64 - Resolves: #2010825 [2.30.4-2] - Fix CVE-2021-30858 - Resolves: #2006427

  • High max 5.7
    ELSA-2021-3819 1 CVE

    Important: .NET 5.0 security and bugfix update (Oracle Linux 8)

    [5.0.208-1.0.1] - Merge Oracle Linux modifications [5.0.208-1] - Update to .NET SDK 5.0.208 and Runtime 5.0.11 - Resolves: RHBZ#2011060

  • Medium
    ELSA-2021-4060 4 CVEs

    Moderate: libsolv security update (Oracle Linux 8)

    [0.7.11-3] - Backport patch: testcase_read: error out if repos are added or the system is changed too late

  • Medium
    ELSA-2021-4058 1 CVE

    Moderate: samba security update (Oracle Linux 8)

    [4.13.3-5] - resolves: #2003507 - Fix CVE-2021-20254

  • Medium
    ELSA-2021-4057 1 CVE

    Moderate: python3 security update (Oracle Linux 8)

    [3.6.8-39.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8-39] - Security fix for CVE-2021-3733: Denial of service when identifying crafted invalid RFCs Resolves: rhbz#1995234

  • Medium max 7.5
    ELSA-2021-4059 2 CVEs

    Moderate: curl security update (Oracle Linux 8)

    [7.61.1-18.el8_4.2] - fix STARTTLS protocol injection via MITM (CVE-2021-22947) - fix protocol downgrade required TLS bypass (CVE-2021-22946)

  • High max 8.8
    ELSA-2021-4044 1 CVE

    Important: flatpak security update (Oracle Linux 7)

    [1.0.9-12] - Fix CVE-2021-41133 (#2012864)

  • High max 8.8
    ELSA-2021-4042 1 CVE

    Important: flatpak security update (Oracle Linux 8)

    [1.8.5-4] - Fix CVE-2021-41133 (#2012867)

  • High max 7.5
    ELSA-2021-9528 2 CVEs

    Important: openssl security update (Oracle Linux 7)

    [1.0.2k-22_fips] - Change Epoch from 1 to 10 - Fix DH self-test to add shared secret comparison [Orabug: 32467026] - Add DH support changes for SP 800-56A rev3 requirements [Orabug: 32467059] - Add TLS KDF self-test [Orabug: 32467193] - Add EC keys pairwise c…

  • High max 8.5
    ELSA-2021-3956 14 CVEs 1 exploited

    Important: xstream security update (Oracle Linux 7)

    [1.3.1-16] - Fix workaround - Resolves: CVE-2021-39148 [1.3.1-15] - Fix remote code execution vulnerabilities - Resolves: CVE-2021-39139 - Resolves: CVE-2021-39140 - Resolves: CVE-2021-39141 - Resolves: CVE-2021-39144 - Resolves: CVE-2021-39145 - Resolves: CV…

  • High max 9.8
    ELSA-2021-3791 6 CVEs

    Important: firefox security update (Oracle Linux 7)

    [91.2.0-4.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.2.0-4] - Disable webrender on the s390x due to wrong c…

  • High max 9.8
    ELSA-2021-3841 7 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [91.2.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.2.0-1] - Update to 91.2.0 build1 [91.1.2-1] - Update to 91.1.2 build1 [91.1.0-1] - Update to 91.1.0 build2

  • High max 6.8
    ELSA-2021-3892 10 CVEs

    Important: java-11-openjdk security and bug fix update (Oracle Linux 7)

    [1:11.0.13.0.8-1.0.1] - link atomic for ix86 build [1:11.0.13.0.8-1] - Revert addition of libharfbuzz.so after its removal by JDK-8255790 - Resolves: rhbz#2012332 [1:11.0.13.0.8-1] - Update to jdk-11.0.12.0+8 - Update release notes to 11.0.12.0+8 - Switch to …

  • High max 6.8
    ELSA-2021-3889 11 CVEs

    Important: java-1.8.0-openjdk security and bug fix update (Oracle Linux 7)

    [1:1.8.0.312.b07-1] - Update to aarch64-shenandoah-jdk8u312-b07 (EA) - Update release notes for 8u312-b07. - Switch to GA mode for final release. - This tarball is embargoed until 2021-10-19 @ 1pm PT. - Resolves: rhbz#2011826 [1:1.8.0.312.b05-0.3.ea] - Add pa…

  • High max 7.5
    ELSA-2021-3945 6 CVEs

    Important: redis:6 security update (Oracle Linux 8)

    [6.0.9-5] - fix denial of service via Redis Standard Protocol (RESP) request CVE-2021-32675 [6.0.9-4] - fix lua scripts can overflow the heap-based Lua stack CVE-2021-32626 - fix integer overflow issue with Streams CVE-2021-32627 - fix integer overflow bug in…

  • High max 6.8
    ELSA-2021-3893 11 CVEs

    Important: java-1.8.0-openjdk security and bug fix update (Oracle Linux 8)

    [1:1.8.0.312.b07-1] - Update to aarch64-shenandoah-jdk8u312-b07 (EA) - Update release notes for 8u312-b07. - Switch to GA mode for final release. - This tarball is embargoed until 2021-10-19 @ 1pm PT. - Resolves: rhbz#2011826 [1:1.8.0.312.b05-0.4.ea] - Allow …

  • High max 6.8
    ELSA-2021-3891 10 CVEs

    Important: java-11-openjdk security update (Oracle Linux 8)

    [1:11.0.13.0.8-1] - Update to jdk-11.0.12.0+8 - Update release notes to 11.0.12.0+8 - Switch to GA mode for final release. - This tarball is embargoed until 2021-10-19 @ 1pm PT. - Resolves: rhbz#2012333 [1:11.0.13.0.7-0.1.ea] - Update to jdk-11.0.13.0+7 - Upd…

  • High max 7.5
    ELSA-2021-3918 6 CVEs

    Important: redis:5 security update (Oracle Linux 8)

    [5.0.3-5] - fix denial of service via Redis Standard Protocol (RESP) request CVE-2021-32675 [5.0.3-4] - fix lua scripts can overflow the heap-based Lua stack CVE-2021-32626 - fix integer overflow issue with Streams CVE-2021-32627 - fix integer overflow bug in…

  • High max 9.8
    ELSA-2021-3838 7 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [91.2.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [91.2.0-1] - Update to 91.2.0 build1 [91.1.2-1] - Update to 91.1.2 build1 [91.1.0-1] - Update to 91.1.0 build2

  • High
    ELSA-2021-9488 8 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [4.14.35-2047.508.3.el7] - fuse: fix live lock in fuse_iget() (Amir Goldstein) [Orabug: 33396682] {CVE-2021-28950} - block: workaround to avoid self-deadlock in del_gendisk (Junxiao Bi) [Orabug: 33392821] - net: bonding: add new option arp_allslaves for arp_i…

  • High max 9.0
    ELSA-2021-3856 1 CVE 1 exploited

    Important: httpd security update (Oracle Linux 7)

    [2.4.6-97.0.1.1] - replace index.html with Oracle's index page oracle_index.html [2.4.6-97.1] - Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted request uri-path containing 'unix:'

  • High
    ELSA-2021-9485 8 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.14.35-2047.508.3] - fuse: fix live lock in fuse_iget() (Amir Goldstein) [Orabug: 33396682] {CVE-2021-28950} - block: workaround to avoid self-deadlock in del_gendisk (Junxiao Bi) [Orabug: 33392821] - net: bonding: add new option arp_allslaves for arp_ip_ta…

  • High max 6.3
    ELSA-2021-9487 2 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [5.4.17-2136.300.7.el7] - KVM: SVM: Fix mismerge in svm_update_pi_irte() (Liam Merwick) [Orabug: 33446526] - Revert KVM: x86: hyperv: Remove duplicate definitions of Reference TSC Page (Liam Merwick) [Orabug: 33450675] [5.4.17-2136.300.6] - Revert scsi: core:…

  • High max 6.3
    ELSA-2021-9486 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.300.7] - KVM: SVM: Fix mismerge in svm_update_pi_irte() (Liam Merwick) [Orabug: 33446526] - Revert KVM: x86: hyperv: Remove duplicate definitions of Reference TSC Page (Liam Merwick) [Orabug: 33450675] [5.4.17-2136.300.6] - Revert scsi: core: Cap…

  • Medium max 9.8
    ELSA-2021-3810 1 CVE

    Moderate: libxml2 security update (Oracle Linux 7)

    [2.9.1-6.0.3] - Rebuild to include attribution logo [Orabug: 33024216] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [2.9.1-6.6] - Fix CVE-2016-4658 (#1966916)

  • Low
    ELSA-2021-3807 1 CVE

    Low: 389-ds-base security and bug fix update (Oracle Linux 7)

    [1.3.10.2-13] - Bump version to 1.3.10.2-13 - Resolves: Bug 2005399 - Internal unindexed searches in syncrepl - Resolves: Bug 2005432 - CVE-2021-3652 389-ds:1.4/389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed - Resolves: Bug …

  • Medium max 7.5
    ELSA-2021-3798 2 CVEs

    Moderate: openssl security update (Oracle Linux 7)

    [1.0.2k-22] - fix CVE-2021-23841 openssl: NULL pointer dereference in X509_issuer_and_serial_hash() - fix CVE-2021-23840 openssl: integer overflow in CipherUpdate - Resolves: rhbz#1932132, rhbz#1932126

  • High max 9.0
    ELSA-2021-3816 2 CVEs 1 exploited

    Important: httpd:2.4 security update (Oracle Linux 8)

    httpd [2.4.37-39.1.0.1.1] - Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-39.1] - Resolves: #2007234 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via a crafted request ur…

  • High max 8.7
    ELSA-2021-3801 4 CVEs

    Important: kernel security and bug fix update (Oracle Linux 7)

    [3.10.0-1160.45.1.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and…

  • High max 9.8
    ELSA-2021-3771 1 CVE 1 exploited

    Important: grafana security update (Oracle Linux 8)

    [7.3.6-3] - resolve CVE-2021-39226 - resolve CVE-2021-27358

  • High max 9.8
    ELSA-2021-3755 6 CVEs

    Important: firefox security update (Oracle Linux 8)

    [91.2.0-4.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [91.2.0-4] - Disable webrender on the s390x due to wrong colors: rhbz#2009503 [91.2.0-3] - Update to 91.2.0 build1 [91.1.0-1] - Update…

  • High
    ELSA-2021-9475 5 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [5.4.17-2102.206.1] - Revert 'scsi: core: Cap scsi_host cmd_per_lun at can_queue' (Jack Vogel) [Orabug: 33403144] [5.4.17-2102.206.0] - Revert 'uek-rpm: Don't recompute build-ids for kernel-uek-debuginfo' (Jack Vogel) [Orabug: 33245043] - integrity: Load mokx…

  • High
    ELSA-2021-9474 5 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2102.206.1] - Revert 'scsi: core: Cap scsi_host cmd_per_lun at can_queue' (Jack Vogel) [Orabug: 33403144] [5.4.17-2102.206.0] - Revert 'uek-rpm: Don't recompute build-ids for kernel-uek-debuginfo' (Jack Vogel) [Orabug: 33245043] - integrity: Load mokx…

  • High max 8.0
    ELSA-2021-9473 8 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.56.1] - ocfs2: subsystem.su_mutex is required while accessing the item->ci_parent (alex chen) [Orabug: 29184589] {CVE-2017-18216} - bcache: fix potential deadlock problem in btree_gc_coalesce (Zhiqiang Liu) {CVE-2020-12771} - filldir[64]: remove W…

  • High
    ELSA-2021-9470 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.14.35-2047.507.7.6] - fuse: fix live lock in fuse_iget() (Amir Goldstein) [Orabug: 33406810] {CVE-2021-28950} - block: workaround to avoid self-deadlock in del_gendisk (Junxiao Bi) [Orabug: 33406819] - net: bonding: add new option arp_allslaves for arp_ip_…

  • High
    ELSA-2021-9471 1 CVE

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [4.14.35-2047.507.7.6.el7] - fuse: fix live lock in fuse_iget() (Amir Goldstein) [Orabug: 33406810] {CVE-2021-28950} - block: workaround to avoid self-deadlock in del_gendisk (Junxiao Bi) [Orabug: 33406819] - net: bonding: add new option arp_allslaves for arp…

  • High max 8.2
    ELSA-2021-3666 8 CVEs

    Important: nodejs:14 security and bug fix update (Oracle Linux 8)

    nodejs [1:14.17.5-1] - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939, CVE-2021-22940, - CVE-2021-23343, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672 - Resolves RHBZ#1847529 (make FIPS always available) - Resolves: RHBZ#1988599, RHBZ#1994000, RHBZ#1…