Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

Medium max 8.6

ELSA-2021-1598 1 CVE

Moderate: bluez security update (Oracle Linux 8)

[5.52-4] + bluez-5.52-4 - Fixing (#1885378) [5.52-3] + bluez-5.52-3 - Revering the 5.52-2 patch due some mismatch with upsream patch. [5.52-2] + bluez-5.52-2 - Fixing (#1885378) [5.52-1] + bluez-5.52-1 - Fixing (#1830397)

May 25, 2021
Medium max 8.8

ELSA-2021-1586 6 CVEs

Moderate: GNOME security, bug fix, and enhancement update (Oracle Linux 8)

accountsservice [0.6.55-1] - Rebase to 0.6.55 Resolves: #1846376 atkmm [2.24.2-7] - Rebuild for annobin fixes - Resolves: rhbz#1703969 cairomm [1.12.0-8] - Rebuild for the annobin fixes - Resolves: rhbz#1703971 chrome-gnome-shell [10.1-7] - Disable updates su…

May 25, 2021
Medium

ELSA-2021-1600 3 CVEs

Moderate: opensc security, bug fix, and enhancement update (Oracle Linux 8)

[0.20.0-4] - Use file cache by default (#1892810) - Avoid calloc with 0 argument (#1895401) [0.20.0-3] - Support PIN change for HID Alt tokens (#1830901) - Fix CVE-2020-26570, CVE-2020-26571 and CVE-2020-26572 - Fix right padding of token labels of some cards…

May 25, 2021
Medium max 7.8

ELSA-2021-1804 9 CVEs

Moderate: userspace graphics, xorg-x11, and mesa security, bug fix, and enhancement update (Oracle Linux 8)

egl-wayland [1.1.5-3] - Add upstream patch to address rhbz#1842473 [1.1.5-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild [1.1.5-1] - Update to 1.1.5 libdrm [2.4.103-1] - Update to 2.4.103 libglvnd [1.3.2-1] - Update to 1.3.2 release li…

May 25, 2021
Medium

ELSA-2021-1686 1 CVE

Moderate: wpa_supplicant security, bug fix, and enhancement update (Oracle Linux 8)

[1:2.9-5] - P2P: Fix a corner case in peer addition based on PD Request (CVE-2021-27803) - Fix buffer overflow when processing P2P group information (CVE-2021-0326) [1:2.9-4] - enable WPA-EAP-SUITE-B-192 (rh #1916394) [1:2.9-3] - fix p2p_listen unexpectedly s…

May 25, 2021
Medium

ELSA-2021-1609 3 CVEs

Moderate: p11-kit security, bug fix, and enhancement update (Oracle Linux 8)

[0.23.22-1] - Rebase to 0.23.22 to fix memory safety issues (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363) - Preserve DT_NEEDED information from the previous version, flagged by rpmdiff - Add xsltproc to BR [0.23.21-4] - Fix realloc usage on proxy clean…

May 25, 2021
Medium

ELSA-2021-1574 1 CVE

Moderate: NetworkManager and libnma security, bug fix, and enhancement update (Oracle Linux 8)

libnma [1.8.30-2] - Rebuild with new gtk-doc to fix multilib issues (rh #1853152) NetworkManager [1.30.0-7.0.1] - add connectivity check via Oracle servers [Orabug: 32051972] - Disable the build of NetworkManager-config-connectivity-* subpackage for 8.3 [1:1.…

May 25, 2021
Medium max 9.1

ELSA-2021-1608 2 CVEs

Moderate: python-cryptography security, bug fix, and enhancement update (Oracle Linux 8)

[3.2.1-4] - CVE-2020-36242: Fixed a bug where certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. - Resolves: rhbz#1926528 [3.2.1-3] - Conflict with non…

May 25, 2021
Medium max 9.8

ELSA-2021-1633 4 CVEs

Moderate: python3 security update (Oracle Linux 8)

[3.6.8-37.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8-37] - Fix for CVE-2021-23336 Resolves: rhbz#1928904 [3.6.8-36] - Fix for CVE-2021-3177 Resolves: rhbz#1918168 [3.6.8-35] - New options -a and -k for pathfix.py script back…

May 25, 2021
Medium

ELSA-2021-1852 26 CVEs

Moderate: ghostscript security, bug fix, and enhancement update (Oracle Linux 8)

[9.27-1] - Rebase to 9.27 - Resolves: rhbz#1874523

May 25, 2021
Low

ELSA-2021-1752 1 CVE

Low: evolution security, bug fix, and enhancement update (Oracle Linux 8)

evolution [3.28.5-16] - Resolves: #1902630 (Crash on file drag into mail composer with WebKitGTK 2.30) [3.28.5-15] - Resolves: #1883619 (ECalendarItem: Settings loaded only when being shown) evolution-data-server [3.28.5-15] - Resolves: #1862403 (CVE-2020-161…

May 25, 2021
Medium max 7.5

ELSA-2021-1585 5 CVEs

Moderate: glibc security, bug fix, and enhancement update (Oracle Linux 8)

[2.28-151.0.1.el8_4] - merge RH patches for ol8-u4 release Review-exception: Patch merge - Provide glibc.pthread.mutex_spin_count tunable for pthread adaptive - spin mutex Orabug: 27982358. Reviewed-by: Qing Zhao <qing.zhao@oracle.com> - add Ampere emag to tu…

May 25, 2021
Medium max 7.5

ELSA-2021-1610 4 CVEs

Moderate: curl security and bug fix update (Oracle Linux 8)

[7.61.1-18] - http: send payload when (proxy) authentication is done (#1918692) - curl: Inferior OCSP verification (CVE-2020-8286) - libcurl: FTP wildcard stack overflow (CVE-2020-8285) - curl: trusting FTP PASV responses (CVE-2020-8284) [7.61.1-17] - validat…

May 25, 2021
Low

ELSA-2021-1758 1 CVE

Low: exiv2 security, bug fix, and enhancement update (Oracle Linux 8)

[0.27.3-2] - Avoid duplicating Changelog file Resolves: bz#1880984 [0.27.3-1] - Update to 0.27.3 Resolves: bz#1880984

May 25, 2021
Low

ELSA-2021-1924 1 CVE

Low: spice security update (Oracle Linux 8)

[0.14.3-4] - Disable client-side renegotiation to prevent potential DoS Resolves: rhbz#1904459 [0.14.3-3] - Fix some static analyzer issues - Removed Obsoletes line for spice-client Related: rhbz#1840240 [0.14.3-2] - Fix multiple buffer overflows in QUIC deco…

May 25, 2021
Medium

ELSA-2021-1809 3 CVEs

Moderate: httpd:2.4 security, bug fix, and enhancement update (Oracle Linux 8)

httpd [2.4.37-39.0.1] - Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262] - Replace index.html with Oracles index page oracle_index.html [2.4.37-39] - prevent htcacheclean from while break when first file processed [2.4.37-38] - Resolves: #1918741 - T…

May 25, 2021
Medium max 3.5

ELSA-2021-1849 8 CVEs

Moderate: freerdp security, bug fix, and enhancement update (Oracle Linux 8)

[2:2.2.0-1] - Update to 2.2.0 (rhbz#1881971)

May 25, 2021
Medium

ELSA-2021-1746 2 CVEs

Moderate: go-toolset:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

delve [1.5.0-2.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.5.0-2] - Add golang-1.15.4 related patch - Resolves: rhbz#1901189 [1.5.0-1] - Rebase to 1.5.0 - Related: rhbz#1870531 golang [1.15.7-1] - Rebase to 1.15.7 - Resolves: rhbz#18…

May 25, 2021
Medium

ELSA-2021-1853 11 CVEs

Moderate: unbound security, bug fix, and enhancement update (Oracle Linux 8)

[1.7.3-15] - Fix SPEC file to not check md5 mtime and size of /var/lib/unbound/root.key - Resolves: rhbz#1714175 - Use system-wide crypto policy setting (PROFILE=SYSTEM) instead of custom setting - Resolves: rhbz#1842837 - Enable additional logging in unbound…

May 25, 2021
Medium

ELSA-2021-1581 2 CVEs

Moderate: sqlite security update (Oracle Linux 8)

[3.26.0-13] - enabled fts3conf.test on s390x and ppc64 architectures [3.26.0-12] - Fixed CVE-2020-13434 (#1845843) - Fixed CVE-2020-15358 (#1855208)

May 25, 2021
Medium max 7.5

ELSA-2021-1775 1 CVE

Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update (Oracle Linux 8)

apache-commons-collections jss [4.8.1-2] - Bug 1932803 - HSM + FIPS: CMCRequest with a shared secret resulting in error [4.8.1-1] - Rebase to upstream JSS v4.8.1 - Red Hat Bugilla #1908541 - jss broke SCEP - missing PasswordChallenge class - Red Hat Bugilla #…

May 25, 2021
Medium

ELSA-2021-1762 10 CVEs

Moderate: virt:ol and virt-devel:rhel security, bug fix, and enhancement update (Oracle Linux 8)

libvirt [6.0.0-35.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] - Add runtime deps for pkg librbd1 >= 1:10.2.5 (Keshav Sharma) - Disable parallel builds (Karl Heubaum) libvirt-dbus [1.3.0] - Resolves: bz#1810193 (Upgrade components in virt:rh…

May 25, 2021
High

ELSA-2021-2033 1 CVE

Important: xorg-x11-server security update (Oracle Linux 7)

[1.20.4-16] - CVE fix for: CVE-2021-3472 (#1944956)

May 19, 2021
High

ELSA-2021-2032 1 CVE

Important: slapi-nis security and bug fix update (Oracle Linux 7)

[0.56.5-4] - CVE 2021-3480: slapi-nis: NULL dereference (DoS) with specially crafted Binding DN - Resolves: rhbz#1942937

May 19, 2021
High

ELSA-2021-9222 8 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.503.1] - bpf, x86: Validate computation of branch displacements for x86-64 (Piotr Krysiuk) [Orabug: 32759961] {CVE-2021-29154} - uek-rpm: Add Amazon Elastic Network Adapter module to nano rpm. (Somasundaram Krishnasamy) [Orabug: 32781585] - ext4…

May 10, 2021
High

ELSA-2021-9223 8 CVEs

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2047.503.1.el7] - bpf, x86: Validate computation of branch displacements for x86-64 (Piotr Krysiuk) [Orabug: 32759961] {CVE-2021-29154} - uek-rpm: Add Amazon Elastic Network Adapter module to nano rpm. (Somasundaram Krishnasamy) [Orabug: 32781585] - …

May 10, 2021
High

ELSA-2021-9220 8 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2102.201.3uek] - locking/qrwlock: Fix ordering in queued_write_lock_slowpath() (Ali Saidi) [Orabug: 32805544] [5.4.17-2102.201.2uek] - md/bitmap: wait for external bitmap writes to complete during tear down (Sudhakar Panneerselvam) [Orabug: 32764237] …

May 10, 2021
High

ELSA-2021-9215 9 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.50.2] - btrfs: fix race when cloning extent buffer during rewind of an old root (Filipe Manana) [Orabug: 32669454] {CVE-2021-28964} - xen-blkback: don't leak persistent grants from xen_blkbk_map() (Jan Beulich) [Orabug: 32697855] {CVE-2021-28688} …

May 6, 2021
High max 7.5

ELSA-2021-1512 3 CVEs

Important: postgresql security update (Oracle Linux 7)

[9.2.24-6] - Patch fixing BZ#1741488 CVE-2019-10208 [9.2.24-5] - Patch fixing CVE-2020-25694 BZ#1907894 - Patch fixing CVE-2020-25695 BZ#1907895

May 6, 2021
High max 7.5

ELSA-2021-1469 1 CVE

Important: bind security update (Oracle Linux 7)

[32:9.11.4-26.P2.5] - Possible assertion failure on DNAME processing (CVE-2021-25215)

Apr 30, 2021
Medium

ELSA-2021-1384 1 CVE

Moderate: nss security and bug fix update (Oracle Linux 7)

[3.53.1-7] - Fix HSM load failure because of CKO_Profile - Allow builds with strict-proto [3.53.1-6] - Update to CVE 2020-256423 TLS flood DOS attack patch. [3.53.1-5] - Fix CVE 2020-256423 TLS flood DOS Attack. [3.53.1-4] - Fix deadlock issue - Fix 3 FTBS is…

Apr 28, 2021
High

ELSA-2021-9203 1 CVE

Important: runc bug fix update (Oracle Linux 7)

[1.0.0-92.rc92] - Add epoch value of 2 to allow upgrade to 1.0.0-92.rc92 from 1.0.0-93.rc93. [1.0.0-92.rc92] - Build for https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92

Apr 28, 2021
Medium

ELSA-2021-1389 1 CVE

Moderate: openldap security update (Oracle Linux 7)

[2.4.44-23] - Fix CVE-2020-25692 openldap: NULL pointer dereference for unauthenticated packet in slapd (#1895328)

Apr 28, 2021
High max 6.1

ELSA-2021-1354 5 CVEs

Important: xstream security update (Oracle Linux 7)

[1.3.1-13] - Fix remote code execution vulnerability - Resolves: CVE-2021-21344 - Resolves: CVE-2021-21345 - Resolves: CVE-2021-21346 - Resolves: CVE-2021-21347 - Resolves: CVE-2021-21350

Apr 27, 2021
High

ELSA-2021-1363 8 CVEs

Important: firefox security update (Oracle Linux 7)

[78.10.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.10.0-1] - Update to 78.10.0

Apr 27, 2021
High

ELSA-2021-1350 9 CVEs

Important: thunderbird security update (Oracle Linux 7)

[78.10.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [78.10.0-1] - Update to 78.10.0

Apr 27, 2021
High

ELSA-2021-1360 8 CVEs

Important: firefox security update (Oracle Linux 8)

[78.10.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.10.0-1] - Update to 78.10.0

Apr 27, 2021
High

ELSA-2021-1353 9 CVEs

Important: thunderbird security update (Oracle Linux 8)

[78.10.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [78.10.0-1] - Update to 78.10.0

Apr 27, 2021
High

ELSA-2021-1242 1 CVE

Important: mariadb:10.3 and mariadb-devel:10.3 security update (Oracle Linux 8)

galera [25.3.32-1] - Rebase to 25.3.32 mariadb [3:10.3.28-1] - Rebase to 10.3.28

Apr 27, 2021
Medium max 5.3

ELSA-2021-1297 1 CVE

Moderate: java-11-openjdk security and bug fix update (Oracle Linux 7)

[1:11.0.11.0.9-1.0.1] - link atomic for ix86 build [1:11.0.11.0.9-1] - Add backport of JDK-8187450 from 11.0.12 to fix RH1937736 - Resolves: rhbz#1937736 [1:11.0.11.0.9-0] - Update to jdk-11.0.11.0+9 - Update release notes to 11.0.11.0+9 - Switch to GA mode f…

Apr 21, 2021