Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

High

ELSA-2021-9425 8 CVEs

Important: qemu security update (Oracle Linux 7)

[15:4.2.1-11.el7] - pvrdma: Fix the ring init error flow (CVE-2021-3608) (Marcel Apfelbaum) [Orabug: 33120142] {CVE-2021-3608} - pvrdma: Ensure correct input on ring init (CVE-2021-3607) (Marcel Apfelbaum) [Orabug: 33120146] {CVE-2021-3607} - hw/rdma: Fix pos…

Aug 17, 2021
High

ELSA-2021-3151 1 CVE

Important: sssd security update (Oracle Linux 8)

[2.4.0-9.0.1] - Restore default debug level for sss_cache [Orabug: 32810448] - Restore default debug level for shadow-utils tools [Orabug: 32810448] - Revert Redhat's change of disallowing duplicated incomplete gid when 'id_provider=ldap' is used, which cause…

Aug 17, 2021
High

ELSA-2021-3152 1 CVE

Important: exiv2 security update (Oracle Linux 8)

[0.27.3-3] - Fix heap-based buffer overflow vulnerability in jp2image.cpp that may lead to DoS Resolves: bz#1990355

Aug 17, 2021
High

ELSA-2021-3155 6 CVEs

Important: thunderbird security update (Oracle Linux 8)

[78.13.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [78.13.0-1] - Update to 78.13.0 build1

Aug 17, 2021
High

ELSA-2021-3157 6 CVEs

Important: firefox security update (Oracle Linux 8)

[78.13.0-2.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.13.0-2] - Update to 78.13.0 build2 [78.13.0-1] - Update to 78.13.0 build1

Aug 17, 2021
High

ELSA-2021-3153 1 CVE

Important: compat-exiv2-026 security update (Oracle Linux 8)

[0.26-11] - Fix heap-based buffer overflow vulnerability in jp2image.cpp that may lead to DoS Resolves: bz#1990397

Aug 17, 2021
High

ELSA-2021-9422 2 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.506.10.el7] - Revert 'rds/ib: reap tx completions during connection shutdown' (Manjunath Patil) [Orabug: 33220435] - Revert 'rds/ib: handle posted ACK during connection shutdown' (Manjunath Patil) [Orabug: 33220435] - Revert 'rds/ib: recover rds…

Aug 16, 2021
High

ELSA-2021-9419 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.506.10] - Revert 'rds/ib: reap tx completions during connection shutdown' (Manjunath Patil) [Orabug: 33220435] - Revert 'rds/ib: handle posted ACK during connection shutdown' (Manjunath Patil) [Orabug: 33220435] - Revert 'rds/ib: recover rds con…

Aug 16, 2021
High

ELSA-2021-9420 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2102.204.4.3] - KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (Maxim Levitsky) [Orabug: 33205365] {CVE-2021-3656} {CVE-2021-3656} - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (Maxim Levitsky) [Orabug: 33205443] {CVE-2021-3…

Aug 16, 2021
High

ELSA-2021-9421 2 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2102.204.4.3] - KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (Maxim Levitsky) [Orabug: 33205365] {CVE-2021-3656} - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (Maxim Levitsky) [Orabug: 33205443] {CVE-2021-3653}

Aug 16, 2021
High max 7.5

ELSA-2021-3148 3 CVEs

Important: .NET 5.0 security and bugfix update (Oracle Linux 8)

[5.0.206-1.0.1] - Add support for new Oracle release [5.0.206-1] - Update to .NET SDK 5.0.206 and Runtime 5.0.9 - Resolves: RHBZ#1990965

Aug 13, 2021
High max 7.5

ELSA-2021-3142 3 CVEs

Important: .NET Core 3.1 security and bugfix update (Oracle Linux 8)

[3.1.118-1.0.1] - Update patch to support 8.3 (alexander.burmashev@oracle.com) - support OL release scheme (alexander.burmashev@oracle.com) [3.1.118-1] - Update to .NET SDK 3.1.118 and Runtime 3.1.18 - Resolves: RHBZ#1990189

Aug 13, 2021
Medium max 7.5

ELSA-2021-3073 3 CVEs

Moderate: nodejs:12 security, bug fix, and enhancement update (Oracle Linux 8)

nodejs [1:12.22.3-2] - Resolves: RHBZ#1980031, RHBZ#1978201 - Fix typo, BR systemtap-sdt-level always, remove y18n patch [1:12.22.3-1] - Resolves: RHBZ#1980031, RHBZ#1978201 - Resolves #1952915 - Resolves CVE-2021-22918(libuv), use system cipher list nodejs-n…

Aug 12, 2021
Low max 5.0

ELSA-2021-3145 1 CVE

Low: .NET Core 2.1 security and bugfix update (Oracle Linux 8)

[2.1.525-1] - Update to .NET SDK 2.1.525 and Runtime 2.1.29 - Resolves: RHBZ#1988581 [2.1.524-1] - Update to .NET SDK 2.1.524 and Runtime 2.1.28 - Resolves: RHBZ#1953766

Aug 12, 2021
Medium max 5.5

ELSA-2021-3081 1 CVE

Moderate: cloud-init security update (Oracle Linux 8)

[20.3-10.0.1] - Added missing services in rhel/systemd/cloud-init.service [Orabug: 32183938] - Added missing services in cloud-init.service.tmpl for sshd [Orabug: 32183938] - Forward port applicable cloud-init 18.4-2.0.3 changes to cloud-init-18-5 [Orabug: 30…

Aug 12, 2021
Medium

ELSA-2021-3063 7 CVEs

Moderate: rust-toolset:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

rust [1.52.1-1] - Update to 1.52.1. Includes security fixes for CVE-2020-36323, CVE-2021-28876, CVE-2021-28878, CVE-2021-28879, and CVE-2021-31162. [1.51.0-1] - Update to 1.51.0. Update to 1.51.0. Includes security fixes for CVE-2021-28875 and CVE-2021-28877.…

Aug 12, 2021
Medium max 5.9

ELSA-2021-3076 4 CVEs

Moderate: go-toolset:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

golang [1.15.14-1] - Rebase to go-1.15.14-1-openssl-fips - Resolves: rhbz#1982287 - Addresses CVE-2021-34558 [1.15.13-4] - Related: rhbz#1978567 go-toolset [1.15.14-1] - Rebase to go-1.15.14-1-openssl-fips - Resolves: rhbz#1982287 - Addresses CVE-2021-34558 […

Aug 12, 2021
Low

ELSA-2021-3079 1 CVE

Low: 389-ds:1.4 security and bug fix update (Oracle Linux 8)

[1.4.3.16-19] - Bump version to 1.4.3.16-19 - Resolve: Bug 1984091 - persistent search returns entries even when an error is returned by content-sync-plugin [1.4.3.16-18] - Bump version to 1.4.3.16-18 - Resolve: Bug 1983121 - CRYPT password hash with asterisk…

Aug 12, 2021
Medium max 7.5

ELSA-2021-3074 3 CVEs

Moderate: nodejs:14 security, bug fix, and enhancement update (Oracle Linux 8)

nodejs [1:14.17.3-2] - Resolves: RHBZ#1980032, RHBZ#1978203 - Resolves RHBZ#1842826 - Don't use patch3 [1:14.17.3-1] - Resolves: RHBZ#1980032, RHBZ#1978203 - Resolves RHBZ#1842826 - Resolves CVE-2021-22918(libuv), use system cipher list [1:14.16.0-3] - Resolv…

Aug 12, 2021
High max 4.4

ELSA-2021-9407 5 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.506.8] - A/A Bonding: dev_hold/put() the delayed GARP work handler's netdev in rdmaip (Sharath Srinivasan) [Orabug: 33187189] - rds/ib: quarantine STALE mr before dereg (Manjunath Patil) [Orabug: 33187192] - rds/ib: avoid dereg of mr in frwr_cle…

Aug 11, 2021
High max 8.7

ELSA-2021-3057 3 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-305.12.1_4.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

Aug 11, 2021
High

ELSA-2021-3066 1 CVE

Important: edk2 security update (Oracle Linux 8)

[20200602gitca407c7246bf-4.el8_4.2] - edk2-NetworkPkg-IScsiDxe-wrap-IScsiCHAP-source-files-to-8.patch [bz#1956676] - edk2-NetworkPkg-IScsiDxe-simplify-ISCSI_CHAP_AUTH_DATA.In.patch [bz#1956676] - edk2-NetworkPkg-IScsiDxe-clean-up-ISCSI_CHAP_AUTH_DATA.Ou.patch…

Aug 11, 2021
Low

ELSA-2021-3075 1 CVE

Low: libuv security update (Oracle Linux 8)

[1:1.41.1-1] - Rebase to 1.41.1 - Change description to reflect upstream - Resolves: RHBZ1980033

Aug 11, 2021
Medium

ELSA-2021-3058 1 CVE

Moderate: glib2 security update (Oracle Linux 8)

[2.56.4-10.1] - Fix CVE-2021-27218 Resolves: #1974888

Aug 11, 2021
High max 4.4

ELSA-2021-9410 5 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.506.8.el7] - A/A Bonding: dev_hold/put() the delayed GARP work handler's netdev in rdmaip (Sharath Srinivasan) [Orabug: 33187189] - rds/ib: quarantine STALE mr before dereg (Manjunath Patil) [Orabug: 33187192] - rds/ib: avoid dereg of mr in frwr…

Aug 10, 2021
High max 7.8

ELSA-2021-9404 10 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2102.204.4.2] - rds/ib: quarantine STALE mr before dereg (Manjunath Patil) [Orabug: 33150447] [5.4.17-2102.204.4.1] - rds/ib: update mr incarnation after forming inv wr (Manjunath Patil) [Orabug: 33177348] - rds/ib: avoid dereg of mr in frwr_clean (Ma…

Aug 10, 2021
High max 7.8

ELSA-2021-9406 10 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2102.204.4.2] - rds/ib: quarantine STALE mr before dereg (Manjunath Patil) [Orabug: 33150447] - rds/ib: update mr incarnation after forming inv wr (Manjunath Patil) [Orabug: 33177348] - rds/ib: avoid dereg of mr in frwr_clean (Manjunath Patil) [Orabug…

Aug 10, 2021
High max 6.9

ELSA-2021-9400 1 CVE 1 exploited

Important: bootstrap security update (Oracle Linux 7)

[3.0.0-7.0.1] - Backport jQuery CVE-2020-11023 fixes from jQuery v3.5.0 to bundled v1.10.2 [Orabug: 33181852]

Aug 9, 2021
High

ELSA-2021-3028 9 CVEs

Important: microcode_ctl security, bug fix and enhancement update (Oracle Linux 7)

[2:2.1-73.11.0.1] - for Intel, do not trigger load if on-disk microcode is not an update [Orabug: 30634727] - set early_microcode='no' in virtualized guests to avoid early load bugs [Orabug: 30618736] - ensure late loading fixes are present on 4.1.12-* and 4.…

Aug 9, 2021
High

ELSA-2021-3027 9 CVEs

Important: microcode_ctl security, bug fix and enhancement update (Oracle Linux 8)

[4:20210216-1.20210608.0.1] - add support for UEK6 kernels - enable early update for 06-4f-01 - remove no longer appropriate caveats for 06-2d-07 and 06-55-04 - enable early and late load on RHCK [4:20210216-1.20210608.1] - Update Intel CPU microcode to micro…

Aug 9, 2021
High

ELSA-2021-9397 6 CVEs

Important: olcne security update (Oracle Linux 7)

olcne [1.2.4-5] - Updated registry-image-helper.sh to work with olcne-utils [1.2.4-4] - Fix istio template for 1.9.6 for k8s update failure [1.2.4-3] - Fixed yaml file to stop olcne-nginx and keepalived services at uninstall [Orabug: 32296282] [1.2.4-2] - Fix…

Aug 6, 2021
High

ELSA-2021-9399 6 CVEs

Important: olcne security update (Oracle Linux 7)

olcne [1.3.1-5] - Updated registry-image-helper.sh to work with olcne-utils [1.3.1-4] - Fix istio template for 1.9.6 and 1.10.2 for k8s update failure [1.3.1-3] - Added END_VERSION_BLOCK for OLM image [1.3.1-2] - Fix iptables issue when running on OL7 host us…

Aug 6, 2021
High

ELSA-2021-9396 6 CVEs

Important: olcne security update (Oracle Linux 8)

olcne [1.2.4-5] - Updated registry-image-helper.sh to work with olcne-utils [1.2.4-4] - Fix istio template for 1.9.6 for k8s update failure [1.2.4-3] - Fixed yaml file to stop olcne-nginx and keepalived services at uninstall [Orabug: 32296282] [1.2.4-2] - Fix…

Aug 6, 2021
High max 8.8

ELSA-2021-3020 4 CVEs

Important: ruby:2.7 security update (Oracle Linux 8)

ruby [2.7.4-137] - Upgrade to Ruby 2.7.4. - Fix command injection vulnerability in RDoc. Resolves: rhbz#1986768 - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host. Resolves: rhbz#1986812 - Fix StartTLS stripping vulnerability in N…

Aug 6, 2021
High

ELSA-2021-9398 6 CVEs

Important: olcne security update (Oracle Linux 8)

olcne [1.3.1-5] - Updated registry-image-helper.sh to work with olcne-utils [1.3.1-4] - Fix istio template for 1.9.6 and 1.10.2 for k8s update failure [1.3.1-3] - Added END_VERSION_BLOCK for OLM image [1.3.1-2] - Fix iptables issue when running on OL7 host us…

Aug 6, 2021
High max 8.3

ELSA-2021-9395 4 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.53.5] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33143006] {CVE-2021-33909} [4.1.12-124.53.3] - net/mlx4: Fix EEPROM dump support (Vladyslav Tarasiuk) [Orabug: 31895301] {CVE-2020-14304} - net/mlx4_en: etht…

Aug 4, 2021
High

ELSA-2021-2988 1 CVE

Important: varnish:6 security update (Oracle Linux 8)

varnish [6.0.6-2.1] - Resolves: #1982861 - CVE-2021-36740 varnish:6/varnish: HTTP/2 request smuggling attack via a large Content-Length header for a POST request varnish-modules [0.15.0-5] - Related: #1795673 - RFE: rebase varnish:6 to latest 6.0.x LTS

Aug 3, 2021
High

ELSA-2021-2989 1 CVE

Important: lasso security update (Oracle Linux 7)

[2.5.1-8] - Fix Coverity warning introduced by the previous patch - Related: #1963855 - CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses [2.5.1-7] - Fix Coverity warning introduced by the previous patch - Related: #196385…

Aug 2, 2021
High

ELSA-2021-2881 4 CVEs

Important: thunderbird security update (Oracle Linux 7)

[78.12.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [78.12.0-2] - Update to 78.12.0 build2 [78.12.0-1] - Update to 78.12.0 build1

Jul 27, 2021
High

ELSA-2021-2883 4 CVEs

Important: thunderbird security update (Oracle Linux 8)

[78.12.0-3.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [78.12.0-3] - Rebuild to pickup older nss [78.12.0-2] - Update to 78.12.0 build2 [78.12.0-1] - Update to 78.12.0 build1

Jul 27, 2021