Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

High max 5.0

ELSA-2021-15790 1 CVE

Important: containerd security update (Oracle Linux 7)

containerd [1.4.8-1] - Address CVE-2021-32760 docker-cli [19.03.11-13] - updated containerd minimum version to 1.4.8 to address CVE-2021-32760. docker-engine [19.03.11-13] - updated containerd minimum version to 1.4.8 to address CVE-2021-32760.

Jul 23, 2021
High max 5.0

ELSA-2021-9373 1 CVE

Important: containerd security update (Oracle Linux 7)

containerd [1.4.8-1] - Address CVE-2021-32760 docker-cli [19.03.11-13] - updated containerd minimum version to 1.4.8 to address CVE-2021-32760. docker-engine [19.03.11-13] - updated containerd minimum version to 1.4.8 to address CVE-2021-32760.

Jul 23, 2021
High

ELSA-2021-9369 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.52.5] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33135634] {CVE-2021-33909}

Jul 22, 2021
High

ELSA-2021-9368 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.505.4.3] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33142065] {CVE-2021-33909}

Jul 22, 2021
High max 7.5

ELSA-2021-2784 3 CVEs

Important: java-11-openjdk security update (Oracle Linux 7)

[1:11.0.12.0.7-0.0.1] - link atomic for ix86 build [1:11.0.12.0.7-0] - Update to jdk-11.0.12.0+7 - Update release notes to 11.0.12.0+7 - Switch to GA mode for final release. - This tarball is embargoed until 2021-07-20 @ 1pm PT. - Resolves: rhbz#1972395 [1:11…

Jul 22, 2021
High

ELSA-2021-9370 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.505.4.3.el7] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33142065] {CVE-2021-33909}

Jul 22, 2021
High max 7.5

ELSA-2021-2845 3 CVEs

Important: java-1.8.0-openjdk security and bug fix update (Oracle Linux 7)

[1:1.8.0.302.b08-0] - Update to aarch64-shenandoah-jdk8u302-b08 (EA) - Update release notes for 8u302-b08. - Switch to GA mode for final release. - This tarball is embargoed until 2021-07-20 @ 1pm PT. - Resolves: rhbz#1972395 [1:1.8.0.302.b07-0.0.ea] - Update…

Jul 22, 2021
High max 7.5

ELSA-2021-2776 3 CVEs

Important: java-1.8.0-openjdk security update (Oracle Linux 8)

[1:1.8.0.302.b08-0] - Update to aarch64-shenandoah-jdk8u302-b08 (EA) - Update release notes for 8u302-b08. - Switch to GA mode for final release. - This tarball is embargoed until 2021-07-20 @ 1pm PT. - Resolves: rhbz#1972395 [1:1.8.0.302.b07-0.0.ea] - Update…

Jul 22, 2021
High

ELSA-2021-9372 1 CVE

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2102.203.6.el7] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33135632] {CVE-2021-33909}

Jul 22, 2021
High max 7.5

ELSA-2021-2781 3 CVEs

Important: java-11-openjdk security update (Oracle Linux 8)

[1:11.0.12.0.7-0] - Update to jdk-11.0.12.0+7 - Update release notes to 11.0.12.0+7 - Switch to GA mode for final release. - This tarball is embargoed until 2021-07-20 @ 1pm PT. - Resolves: rhbz#1972395 [1:11.0.12.0.6-0.0.ea] - Update to jdk-11.0.12.0+6 - Upd…

Jul 22, 2021
High

ELSA-2021-9371 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2102.203.6.el8uek] - seq_file: disallow extremely large seq buffer allocations (Eric Sandeen) [Orabug: 33135632] {CVE-2021-33909}

Jul 22, 2021
High

ELSA-2021-2725 5 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1160.36.2.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and…

Jul 21, 2021
High max 5.5

ELSA-2021-2717 1 CVE

Important: systemd security update (Oracle Linux 8)

[239-45.0.2] - Disable unprivileged BPF by default [Orabug: 32870980] - backport upstream pstore tmpfiles patch [Orabug: 31420486] - udev rules: fix memory hot add and remove [Orabug: 31310273] - fix to enable systemd-pstore.service [Orabug: 30951066] - journ…

Jul 21, 2021
High

ELSA-2021-2714 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 8)

[4.18.0-305.10.2_4.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.gen…

Jul 21, 2021
High

ELSA-2021-2741 3 CVEs

Important: firefox security update (Oracle Linux 7)

[78.12.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.12.0-1] - Update to 78.12.0 build1

Jul 16, 2021
High max 6.7

ELSA-2021-9362 10 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2102.203.5] - rds/ib: move rds_ib_clear_irq_miss() to .h file (Manjunath Patil) [Orabug: 33044344] [5.4.17-2102.203.4] - rds/ib: recover rds connection from interrupt loss scenario (Manjunath Patil) [Orabug: 32974199] - Revert Allow mce to reset inste…

Jul 16, 2021
High max 6.7

ELSA-2021-9363 10 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2102.203.5] - rds/ib: move rds_ib_clear_irq_miss() to .h file (Manjunath Patil) [Orabug: 33044344] [5.4.17-2102.203.4] - rds/ib: recover rds connection from interrupt loss scenario (Manjunath Patil) [Orabug: 32974199] - Revert 'Allow mce to reset inst…

Jul 16, 2021
High

ELSA-2021-2743 3 CVEs

Important: firefox security update (Oracle Linux 8)

[78.12.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.12.0-1] - Update to 78.12.0 build1

Jul 16, 2021
High max 7.5

ELSA-2021-2683 1 CVE

Important: xstream security update (Oracle Linux 7)

[1.3.1-14] - Fix remote code execution vulnerability - Resolves: CVE-2021-29505

Jul 13, 2021
High max 6.7

ELSA-2021-9349 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.505.4] - rds/ib: move rds_ib_clear_irq_miss() to .h file (Manjunath Patil) [Orabug: 33044345] - rds/ib: recover rds connection from interrupt loss scenario (Manjunath Patil) [Orabug: 32804265] - rds/ib: handle posted ACK during connection shutdo…

Jul 12, 2021
High max 6.7

ELSA-2021-9351 4 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.505.4.el7] - rds/ib: move rds_ib_clear_irq_miss() to .h file (Manjunath Patil) [Orabug: 33044345] - rds/ib: recover rds connection from interrupt loss scenario (Manjunath Patil) [Orabug: 32804265] - rds/ib: handle posted ACK during connection sh…

Jul 12, 2021
High

ELSA-2021-2658 1 CVE

Important: linuxptp security update (Oracle Linux 7)

[2.0-2.el7_9.1] - validate length of forwarded messages (CVE-2021-3570)

Jul 7, 2021
Medium max 7.5

ELSA-2021-2588 9 CVEs

Moderate: ruby:2.6 security, bug fix, and enhancement update (Oracle Linux 8)

ruby [2.6.7-107] - Upgrade to Ruby 2.6.7. Resolves: rhbz#1952627 - Resolv::DNS: timeouts if multiple IPv6 name servers are given an address containing leading zero Resolves: rhbz#1954968 - Fix: Rubygem-bundler: Don't use insecure tmp directory as home allows …

Jul 7, 2021
Medium max 7.5

ELSA-2021-2584 2 CVEs

Moderate: ruby:2.7 security, bug fix, and enhancement update (Oracle Linux 8)

ruby [2.7.3-136] - Upgrade to Ruby 2.7.3. Resolves: rhbz#1951999 - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address contains leading zero Resolves: rhbz#1952000 [2.7.2-135] - Upgrade to Ruby 2.7.2. - Avoid possible timeout errors in T…

Jul 7, 2021
High

ELSA-2021-2660 1 CVE

Important: linuxptp security update (Oracle Linux 8)

[2.0-5.el8_4.1] - validate length of forwarded messages (CVE-2021-3570)

Jul 7, 2021
Medium max 8.8

ELSA-2021-2569 5 CVEs

Moderate: libxml2 security update (Oracle Linux 8)

[2.9.7-9.0.1] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [2.9.7-9.2] - Fix CVE-2021-3541 (#1958783) [2.9.7-9.1] - Fix CVE-2021-3516 (#1956975) - Fix CVE-2021-3517 (#1957000) - Fix CVE-2021-3518 (#19570…

Jul 3, 2021
High

ELSA-2021-9346 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.52.4] - IB/core: Only update PKEY and GID caches on respective events (Hakon Bugge) [Orabug: 32816368] - Revert 'Allow mce to reset instead of panic on UE' (William Roche) [Orabug: 32820278] - Bluetooth: verify AMP hci_chan before amp_destroy (Arc…

Jul 2, 2021
Medium max 9.8

ELSA-2021-2583 1 CVE

Moderate: python38:3.8 and python38-devel:3.8 security update (Oracle Linux 8)

PyYAML [5.4.1-1] - Rebase to version 5.4.1 to fix CVE-2020-14343 - Resolves: rhbz#1860466

Jul 2, 2021
Medium max 7.5

ELSA-2021-2587 8 CVEs

Moderate: ruby:2.5 security, bug fix, and enhancement update (Oracle Linux 8)

ruby [2.5.9-107] - Update to Ruby 2.5.9. * Remove Patch20: ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch; subsumed Resolves: rhbz#1952626 - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address contains leading zero Resolves: rhbz#1955010

Jul 2, 2021
Medium

ELSA-2021-2595 1 CVE

Moderate: 389-ds:1.4 security and bug fix update (Oracle Linux 8)

[1.4.3.16-16] - Bump version to 1.4.3.16-16 - Resolves: Bug 1972738 - Changelog cache can upload updates from a wrong starting point (CSN) - Resolves: Bug 1972721 - Large updates can reset the CLcache to the beginning of the changelog [1.4.3.16-15] - Bump ver…

Jul 2, 2021
High

ELSA-2021-2308 4 CVEs

Important: microcode_ctl security, bug fix and enhancement update (Oracle Linux 8)

[4:20210216-1.20210525.0.1] - add support for UEK6 kernels - remove no longer appropriate caveats for 06-2d-07 and 06-55-04 [4:20210216-1.20210525.1] - Update Intel CPU microcode to microcode-20210525 release, addresses CVE-2020-24489, CVE-2020-24511, CVE-202…

Jul 1, 2021
High max 6.5

ELSA-2021-2570 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 8)

[4.18.0-305.7.1_4.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genk…

Jul 1, 2021
Medium

ELSA-2021-2591 1 CVE

Moderate: edk2 security update (Oracle Linux 8)

[20200602gitca407c7246bf-4.el8_4.1] - edk2-MdeModulePkg-LzmaCustomDecompressLib-catch-4GB-uncom.patch [bz#1952953] - Resolves: bz#1952953 (edk2: possible heap corruption with LzmaUefiDecompressGetInfo [rhel-8] [rhel-8.4.0.z])

Jun 30, 2021
Medium

ELSA-2021-2575 1 CVE

Moderate: lz4 security update (Oracle Linux 8)

[1.8.3-3] - Fix memory corruption due to an integer overflow _ Resolves: CVE-2021-3520

Jun 30, 2021
Medium

ELSA-2021-2574 1 CVE

Moderate: rpm security update (Oracle Linux 8)

[4.14.3-14] - Be more careful about copying data from signature header (#1958477) - Fixes CVE-2021-20271

Jun 30, 2021
High max 7.6

ELSA-2021-15112 1 CVE

Important: docker-engine docker-cli security update (Oracle Linux 7)

docker-engine [19.03.11-11] - Addresses CVE-2021-30465 - updated runc minimum version to runc >= 3:1.0.0-1.rc95. [19.03.11-10] - Addresses runc CVE-2021-30465 - updated runc versions in cli/vendor.conf and docker-engine/vendor.conf to 1.0.0-rc95.

Jun 29, 2021
High max 7.6

ELSA-2021-9329 1 CVE

Important: docker-engine docker-cli security update (Oracle Linux 7)

docker-engine [19.03.11-11] - Addresses CVE-2021-30465 - updated runc minimum version to runc >= 3:1.0.0-1.rc95. [19.03.11-10] - Addresses runc CVE-2021-30465 - updated runc versions in cli/vendor.conf and docker-engine/vendor.conf to 1.0.0-rc95.

Jun 29, 2021
High

ELSA-2021-9335 2 CVEs

Important: qemu security update (Oracle Linux 7)

[15:4.2.1-10.el7] - e1000: fail early for evil descriptor (Jason Wang) [Orabug: 32560552] {CVE-2021-20257} - Document CVE-2020-27661 as fixed (Mark Kanda) [Orabug: 32960200] {CVE-2020-27661} - block: Avoid stale pointer dereference in blk_get_aio_context() (G…

Jun 28, 2021
High

ELSA-2021-2417 1 CVE

Important: gupnp security update (Oracle Linux 7)

[1.0.2-6] + gupnp-1.0.3-3 - Fix DNS rebind issue - Resolves: #1964706

Jun 15, 2021
High max 5.1

ELSA-2021-9308 2 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.504.2.el7] - md/raid1: properly indicate failure when ending a failed write request (Paul Clements) [Orabug: 32887159] - video: hyperv_fb: Add ratelimit on error message (Michael Kelley) [Orabug: 32856879] - Drivers: hv: vmbus: Initialize unload…

Jun 15, 2021