Oracle Linux Security Advisories (ELSA)

8,323 results · Feed

• High max 6.5
  ELSA-2021-9465 6 CVEs

  Important: squid security update (Oracle Linux 7)

  [7:3.5.20-17.0.1] - Mutiple CVE fixes for squid [Orabug: 33146289] - Resolves: CVE-2021-28651 squid: Bug 5104: Memory leak in RFC 2169 response parsing (#778) - Resolves: CVE-2021-28652 squid: Bug 5106: Broken cache manager URL parsing (#788) - Resolves: CVE-…

  Sep 24, 2021
• Medium
  ELSA-2021-3576 2 CVEs

  Moderate: krb5 security update (Oracle Linux 8)

  [1.18.2-8.3] - Fix KDC null deref on TGS inner body null server (CVE-2021-37750) - Resolves: #1997600 [1.18.2-8.2] - Rebuild for rpminspect; no code changes - Resolves: #1983728 [1.18.2-8.1] - Fix KDC null deref on bad encrypted challenge (CVE-2021-36222) - R…

  Sep 23, 2021
• Medium max 7.2
  ELSA-2021-3590 139 CVEs

  Moderate: mysql:8.0 security, bug fix, and enhancement update (Oracle Linux 8)

  mysql [8.0.26-1] - Update to MySQL 8.0.26 [8.0.25-1] - Update to MySQL 8.0.25 [8.0.24-1] - Update to MySQL 8.0.24 - Upstreamed patch: mysql-main-cast.patch [8.0.23-1] - Update to MySQL 8.0.23 - Created mysql-fix-includes-robin-hood.patch - Created mysql-main-…

  Sep 23, 2021
• High
  ELSA-2021-9460 7 CVEs

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

  [4.14.35-2047.507.7.5] - Bluetooth: defer cleanup of resources in hci_unregister_dev() (Tetsuo Handa) [Orabug: 33369947] {CVE-2021-3573} - Bluetooth: use correct lock to prevent UAF of hdev object (Lin Ma) [Orabug: 33369947] - Bluetooth: fix the erroneous flu…

  Sep 22, 2021
• High
  ELSA-2021-9458 7 CVEs

  Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

  [4.14.35-2047.507.7.5.el7] - Bluetooth: defer cleanup of resources in hci_unregister_dev() (Tetsuo Handa) [Orabug: 33369947] {CVE-2021-3573} - Bluetooth: use correct lock to prevent UAF of hdev object (Lin Ma) [Orabug: 33369947] - Bluetooth: fix the erroneous…

  Sep 22, 2021
• High max 6.3
  ELSA-2021-9459 21 CVEs

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

  [4.1.12-124.54.6.1] - fs/namespace.c: fix mountpoint reference counter race (Piotr Krysiuk) [Orabug: 33369433] {CVE-2020-12114} {CVE-2020-12114} - btrfs: only search for left_info if there is no right_info in try_merge_free_space (Josef Bacik) [Orabug: 333694…

  Sep 22, 2021
• High
  ELSA-2021-9457 1 CVE

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

  [5.4.17-2102.205.7.3] - btrfs: fix NULL pointer dereference when deleting device by invalid id (Qu Wenruo) [Orabug: 33281078] {CVE-2021-3739}

  Sep 22, 2021
• Medium
  ELSA-2021-3585 1 CVE

  Moderate: go-toolset:ol8 security update (Oracle Linux 8)

  go-toolset [1.15.14-2] - Revert to Go 1.15.14 - Related: rhbz#1995126 - Reverts: rhbz#1994087 [1.15.15-1] - Rebase to Go 1.15.15 - Resolves: rhbz#1994087 - Add reject leading zeros patch - Resolves: rhbz#1994010

  Sep 22, 2021
• High
  ELSA-2021-9461 1 CVE

  Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

  [5.4.17-2102.205.7.3.el7] - btrfs: fix NULL pointer dereference when deleting device by invalid id (Qu Wenruo) [Orabug: 33281078] {CVE-2021-3739}

  Sep 22, 2021
• High max 8.2
  ELSA-2021-3623 8 CVEs

  Important: nodejs:12 security and bug fix update (Oracle Linux 8)

  nodejs [1:12.22.5-1] - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939, CVE-2021-22940, - CVE-2021-23343, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672 - Resolves RHBZ#1951621 (make FIPS always available) - Resolves: RHBZ#1988595, RHBZ#1993992, RHBZ#1…

  Sep 22, 2021
• High max 8.7
  ELSA-2021-9452 11 CVEs

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

  [4.14.35-2047.507.7.4] - KVM: x86: Check kvm_rebooting in kvm_spurious_fault() (Sean Christopherson) [Orabug: 33362693] [4.14.35-2047.507.7.3] - arm64: Reserve elfcorehdr before scanning reserved memory from device tree (Dave Kleikamp) [Orabug: 33354710] [4.1…

  Sep 21, 2021
• High max 8.7
  ELSA-2021-9453 11 CVEs

  Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

  [4.14.35-2047.507.7.4.el7] - KVM: x86: Check kvm_rebooting in kvm_spurious_fault() (Sean Christopherson) [Orabug: 33362693] [4.14.35-2047.507.7.3] - arm64: Reserve elfcorehdr before scanning reserved memory from device tree (Dave Kleikamp) [Orabug: 33354710] …

  Sep 21, 2021
• Medium
  ELSA-2021-3572 1 CVE

  Moderate: nss and nspr security, bug fix, and enhancement update (Oracle Linux 8)

  nspr [4.32.0-1] - Update to NSPR 4.32 [4.31.0-1] - Update to NSPR 4.31 [4.30.0-1] - Update to NSPR 4.30 nss [3.67.0-6] - Fix ssl alert issue [3.67.0-5] - Fix issue with reading databases that were updated using unpatched versions of nss [3.67.0-4] - Better fi…

  Sep 21, 2021
• Medium max 6.5
  ELSA-2021-3582 3 CVEs

  Moderate: curl security update (Oracle Linux 8)

  [7.61.1-18.el8_4.1] - fix bad connection reuse due to flawed path name checks (CVE-2021-22924) - disable metalink support to fix the following vulnerabilities CVE-2021-22923 - metalink download sends credentials CVE-2021-22922 - wrong content via metalink not…

  Sep 21, 2021
• High max 8.7
  ELSA-2021-9451 6 CVEs

  Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

  [5.4.17-2102.205.7.2.el7] - btrfs: fix race between marking inode needs to be logged and log syncing (Filipe Manana) [Orabug: 33349276] [5.4.17-2102.205.7.1] - RDMA/cma: Revert INIT-INIT patch (Mike Marciniszyn) [Orabug: 33306518] [5.4.17-2102.205.7] - rds: i…

  Sep 16, 2021
• Medium
  ELSA-2021-3548 1 CVE

  Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 8)

  [4.18.0-305.19.1_4.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

  Sep 16, 2021
• High max 8.7
  ELSA-2021-9450 6 CVEs

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

  [5.4.17-2102.205.7.2] - btrfs: fix race between marking inode needs to be logged and log syncing (Filipe Manana) [Orabug: 33349276] [5.4.17-2102.205.7.1] - RDMA/cma: Revert INIT-INIT patch (Mike Marciniszyn) [Orabug: 33306518] [5.4.17-2102.205.7] - rds: ib: S…

  Sep 16, 2021
• High max 5.3
  ELSA-2021-9449 1 CVE

  Important: libtirpc security update (Oracle Linux 8)

  [1.1.4-4.0.1] - Backport fix for CVE-2018-14621 in libtirpc [Orabug: 33017925]

  Sep 14, 2021
• High
  ELSA-2021-3494 1 CVE

  Important: thunderbird security update (Oracle Linux 7)

  [78.14.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [78.14.0-1] - Update to 78.14.0 build1 [78.13.0-2] - Use the right name for the appstream file

  Sep 13, 2021
• High
  ELSA-2021-3498 1 CVE

  Important: firefox security update (Oracle Linux 7)

  [78.14.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.14.0-1] - Update to 78.14.0 build1

  Sep 13, 2021
• High
  ELSA-2021-3499 1 CVE

  Important: thunderbird security update (Oracle Linux 8)

  [78.14.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [78.14.0-1] - Update to 78.14.0 build1 [78.13.0-2] - Use the right name for the appstream file

  Sep 13, 2021
• High
  ELSA-2021-3497 1 CVE

  Important: firefox security update (Oracle Linux 8)

  [78.14.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.14.0-1] - Update to 78.14.0 build1

  Sep 13, 2021
• High
  ELSA-2021-3492 1 CVE

  Important: cyrus-imapd security update (Oracle Linux 8)

  [3.0.7-20.1] - Fix for CVE-2021-33582

  Sep 13, 2021
• High max 7.8
  ELSA-2021-9444 1 CVE

  Important: oswatcher security update (Oracle Linux 7)

  [9.0.0-5] - Use static path configuration for oswatcher scripts {CVE-2021-2464} [Orabug: 33220951]

  Sep 10, 2021
• High
  ELSA-2021-9442 8 CVEs

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

  [4.1.12-124.54.6] - xen-netback: do not kfree_skb() when irq is disabled (Dongli Zhang) [Orabug: 33282046] [4.1.12-124.54.5] - l2tp: fix race between l2tp_session_delete() and l2tp_tunnel_closeall() (Guillaume Nault) [Orabug: 33113975] {CVE-2020-0429} - l2tp:…

  Sep 8, 2021
• High
  ELSA-2021-3447 2 CVEs

  Important: kernel security and bug fix update (Oracle Linux 8)

  [4.18.0-305.17.1_4.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

  Sep 8, 2021
• Medium
  ELSA-2021-3438 1 CVE

  Moderate: kernel security and bug fix update (Oracle Linux 7)

  [3.10.0-1160.42.2.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and…

  Sep 7, 2021
• High
  ELSA-2021-3336 1 CVE

  Important: sssd security and bug fix update (Oracle Linux 7)

  [1.16.5-10.0.1] - Revert Redhat's change of disallowing duplicated incomplete gid when 'id_provider=ldap' is used, which caused regression in AD environment. [Orabug: 29286774] [Doc ID 2605732.1] [1.16.5-10.10] - Resolves: rhbz#1973796 - SSSD is NOT able to c…

  Sep 1, 2021
• Low
  ELSA-2021-3338 1 CVE

  Low: hivex security update (Oracle Linux 7)

  [1.3.10-6.12] - Limit recursion in ri-records (CVE-2021-3622) resolves: rhbz#1976193

  Sep 1, 2021
• Medium max 6.5
  ELSA-2021-3325 1 CVE

  Moderate: bind security update (Oracle Linux 7)

  [32:9.11.4-26.P2.7] - Apply again patch 172, got removed by mistake [32:9.11.4-26.P2.6] - Insufficient IXFR checks could lead to assertion failure (CVE-2021-25214)

  Sep 1, 2021
• High max 8.3
  ELSA-2021-3327 5 CVEs 1 exploited

  Important: kernel security and bug fix update (Oracle Linux 7)

  [3.10.0-1160.41.1.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and…

  Aug 31, 2021
• High
  ELSA-2021-3295 1 CVE

  Important: libsndfile security update (Oracle Linux 7)

  [1.0.25-12.1] - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985024)

  Aug 30, 2021
• High
  ELSA-2021-3296 1 CVE

  Important: libX11 security update (Oracle Linux 7)

  [1.6.7-4] - Fix CVE-2021-31535 (#1962438)

  Aug 30, 2021
• High
  ELSA-2021-3253 1 CVE

  Important: libsndfile security update (Oracle Linux 8)

  [1.0.28-10.1] - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985027)

  Aug 24, 2021
• High
  ELSA-2021-9428 2 CVEs

  Important: rh-postgresql10-postgresql security update (Oracle Linux 7)

  [10.17-1] - Update to 10.17 Resolves: CVE-2021-32027 Also fixes: CVE-2021-32028

  Aug 23, 2021
• High
  ELSA-2021-3233 1 CVE

  Important: compat-exiv2-026 security update (Oracle Linux 7)

  [0.26-3] - Fix heap-based buffer overflow vulnerability in jp2image.cpp Resolves: bz#1990394

  Aug 20, 2021
• High
  ELSA-2021-3234 1 CVE

  Important: compat-exiv2-023 security update (Oracle Linux 7)

  [0.23-3] - Fix heap-based buffer overflow vulnerability in jp2image.cpp Resolves: bz#1990393

  Aug 19, 2021
• High
  ELSA-2021-3160 6 CVEs

  Important: thunderbird security update (Oracle Linux 7)

  [78.13.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [78.13.0-1] - Update to 78.13.0 build1 [78.12.0-3] - Rebuild to pickup older nss

  Aug 17, 2021
• High
  ELSA-2021-3154 6 CVEs

  Important: firefox security update (Oracle Linux 7)

  [78.13.0-2.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.13.0-2] - Update to 78.13.0 build2 [78.13.0-1] - Upda…

  Aug 17, 2021
• High
  ELSA-2021-3158 1 CVE

  Important: exiv2 security update (Oracle Linux 7)

  [0.27.0-4] - Fix heap-based buffer overflow vulnerability in jp2image.cpp that may lead to DoS Resolves: bz#1990352

  Aug 17, 2021