Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

High

ELSA-2020-4080 12 CVEs

Important: firefox security and bug fix update (Oracle Linux 7)

[78.3.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.3.0] - Update to 78.3.0 build1 [78.2.0-3] - Update to …

Oct 13, 2020
High

ELSA-2020-4163 4 CVEs

Important: thunderbird security update (Oracle Linux 7)

[78.3.1-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [78.3.1-1] - Update to 78.3.1 build1 [78.3.0-3] - Update to 78.3.0 build1 - Remove librdp.so as long as we cannot ship it in RHEL [78.2.1-1] - Update to 78.…

Oct 13, 2020
High max 6.7

ELSA-2020-5885 13 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2025.401.4] - KVM: x86: always expose VIRT_SSBD to guests (Paolo Bonzini) [Orabug: 31957046] [4.14.35-2025.401.3] - iommu/amd: Restore IRTE.RemapEn bit after programming IRTE (Suravee Suthikulpanit) [Orabug: 31931371] - oracleasm: Access d_bdev befor…

Oct 12, 2020
High max 6.7

ELSA-2020-5884 7 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2011.7.4] - iommu/amd: Restore IRTE.RemapEn bit for amd_iommu_activate_guest_mode (Suravee Suthikulpanit) [Orabug: 31931369] - iommu/amd: Fix potential @entry null deref (Joao Martins) [Orabug: 31931369] - iommu/amd: Restore IRTE.RemapEn bit after pro…

Oct 12, 2020
High max 5.5

ELSA-2020-5879 8 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.50.1] - USB: serial: omninet: fix reference leaks at open (Mark Nicholson) [Orabug: 30484762] {CVE-2017-8925} - GFS2: don't set rgrp gl_object until it's inserted into rgrp tree (Bob Peterson) [Orabug: 30254252] {CVE-2016-10905} - GFS2:…

Oct 9, 2020
Medium

ELSA-2020-4072 1 CVE

Moderate: libcroco security update (Oracle Linux 7)

[0.6.12-6] - Rebuild with 7.9-z target Related: #1835951 [0.6.12-5] - Fix CVE-2020-12825 Resolves: #1835951

Oct 8, 2020
Medium

ELSA-2020-4076 10 CVEs

Moderate: nss and nspr security, bug fix, and enhancement update (Oracle Linux 7)

nspr [4.25.0-2] - Rebuild to fix wrong dist tag [4.25.0-1] - Rebase to NSPR 4.25 nss [3.53.1-3] - Disable dh timing test because it's unreliable on s390 (from Bob Relyea) - Explicitly enable upgradedb/sharedb test cycles [3.53.1-2] - Disable TLS 1.3 by defaul…

Oct 8, 2020
High max 9.9

ELSA-2020-4082 7 CVEs

Important: squid security update (Oracle Linux 7)

[7:3.5.20-17.4] - Resolves: #1872349 - CVE-2020-24606 squid: Improper Input Validation could result in a DoS - Resolves: #1872327 - CVE-2020-15810 squid: HTTP Request Smuggling could result in cache poisoning - Resolves: #1872342 - CVE-2020-15811 squid: HTTP …

Oct 8, 2020
High

ELSA-2020-4187 1 CVE

Important: spice and spice-gtk security update (Oracle Linux 7)

spice [0.14.0-9.0.2.el7_9.1] - Add ARM support [0.14.0-9.1] - Fix multiple buffer overflows in QUIC decoding code Resolves: CVE-2020-14355 spice-gtk [0.35-5.1] - Fix multiple buffer overflows in QUIC decoding code Resolves: CVE-2020-14355

Oct 8, 2020
High max 7.5

ELSA-2020-4079 2 CVEs

Important: qemu-kvm security update (Oracle Linux 7)

[1.5.3-175.el7_9.1] - Fixing release number for z-stream

Oct 8, 2020
High

ELSA-2020-4186 1 CVE

Important: spice and spice-gtk security update (Oracle Linux 8)

spice [0.14.2-1.1] - Fix multiple buffer overflows in QUIC decoding code Resolves: CVE-2020-14355 spice-gtk [0.37-1.2] - Fix multiple buffer overflows in QUIC decoding code Resolves: CVE-2020-14355

Oct 7, 2020
Medium max 6.5

ELSA-2020-4026 5 CVEs

Moderate: mariadb security and bug fix update (Oracle Linux 7)

[1:5.5.68-1] - Rebase to 5.5.68 This is the last upstream release. This major version reached upstream EOL - Related to: rhbz#1834835 [1:5.5.67-2] - Resolves: rhbz#1689827 [1:5.5.67-1] - Rebase to 5.5.67 - Related to: rhbz#1834835 - CVEs fixed: rhbz#1821939 C…

Oct 6, 2020
Medium max 6.1

ELSA-2020-3911 1 CVE

Moderate: python security update (Oracle Linux 7)

[2.7.5-89.0.1] - Add Oracle Linux distribution in platform.py [orabug 20812544] [2.7.5-89] - Security fix for CVE-2019-16935 Resolves: rhbz#1797998 [2.7.5-88] - Security fix for CVE-2019-16056 Resolves: rhbz#1750773 [2.7.5-87] - Fix CVE-2018-20852 Resolves: r…

Oct 6, 2020
Low max 9.8

ELSA-2020-3901 1 CVE

Low: libpng security update (Oracle Linux 7)

[2:1.5.13-8] - Fix CVE-2017-12652 - Resolves: #1744870

Oct 6, 2020
Medium

ELSA-2020-4040 6 CVEs

Moderate: libexif security, bug fix, and enhancement update (Oracle Linux 7)

[0.6.22-1] - Upgrade to 0.6.22 - Resolves: #1841316

Oct 6, 2020
Low

ELSA-2020-3848 1 CVE

Low: libmspack security update (Oracle Linux 7)

[0.5-0.8.alpha] - Fix for CVE-2019-1010305 resolves: rhbz#1736744

Oct 6, 2020
Low

ELSA-2020-3943 1 CVE

Low: libwmf security and bug fix update (Oracle Linux 7)

[0.2.8.4-44] - Resolves: rhbz#1840569 adapt to new urw-fonts [0.2.8.4-43] - Resolves: rhbz#1679005 CVE-2019-6978 [0.2.8.4-42] - Related: rhbz#1239162 fix patch context

Oct 6, 2020
Medium

ELSA-2020-3873 2 CVEs

Moderate: libsrtp security and bug fix update (Oracle Linux 7)

[1.4.4-11.20101004cvs] - Fix global buffer overflow Resolves: bz#1301202 - Fix improper handling of CSRC count and extension header length in RTP header Resolves: bz#1323705 - Fix buffer overflow in application of crypto profiles Resolves: bz#1141897

Oct 6, 2020
Medium max 6.5

ELSA-2020-3888 2 CVEs

Moderate: python3 security update (Oracle Linux 7)

[3.6.8-17.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8-17] - Overhaul pythons FIPS mode support Resolves: rhbz#1788459 [3.6.8-16] - Security fix for CVE-2020-8492 Resolves: rhbz#1810616 [3.6.8-15] - Security fix for CVE-2019-1…

Oct 6, 2020
Medium max 4.6

ELSA-2020-3898 3 CVEs

Moderate: cloud-init security, bug fix, and enhancement update (Oracle Linux 7)

[19.4-7.0.3] - Add conditional restart of NetworkManager for cloud-final. [Orabug: 31965645] - Correct postinstall upgrade cloud-init.service mismerge order. [19.4-7.0.1] - Add Oracle Linux variant to known distros - Add cloud-init hotplug event handling supp…

Oct 6, 2020
Medium

ELSA-2020-3877 2 CVEs

Moderate: audiofile security update (Oracle Linux 7)

[1:0.3.6-9] - Apply security patches. CVE-2018-17095, CVE-2018-13440 - Resolves: rhbz#1600369, rhbz#1601014, rhbz#1637128 [1:0.3.6-8] - Escape macros in %changelog [1:0.3.6-7] - Merge upstream pull requests #42,#43,#44 from Agostino Sarubbo to fix security is…

Oct 6, 2020
Medium

ELSA-2020-3902 2 CVEs

Moderate: libtiff security update (Oracle Linux 7)

[4.0.3-35] - Fix two resource leaks Related: #1771371 [4.0.3-34] - Fix CVE-2019-17546 Resolves: #1771371 [4.0.3-33] - Fix CVE-2019-14973 Resolves: #1755704

Oct 6, 2020
High max 8.0

ELSA-2020-5866 38 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.43.4] - kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) (Jann Horn) [Orabug: 29434845] {CVE-2019-6974} - KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) (Peter Shier) [Orabug: 29434898] {CVE-…

Oct 6, 2020
High max 7.5

ELSA-2020-4060 46 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

[3.10.0-1160.OL7] - Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and shim-x64 <=…

Oct 6, 2020
Medium

ELSA-2020-3978 2 CVEs

Moderate: glib2 and ibus security and bug fix update (Oracle Linux 7)

glib2 [2.56.1-7] - Backport patch to limit access to files when copying (CVE-2019-12450) Resolves: #1722099 [2.56.1-6] - Backport patches for GDBus auth Resolves: #1777221 ibus [1.5.17-11] - Resolves: #1750835 - Fix CVE-2019-14822 missing authorization allows

Oct 6, 2020
Low

ELSA-2020-3861 1 CVE

Low: glibc security, bug fix, and enhancement update (Oracle Linux 7)

[2.17-317.0.1] - Merge RH el7 u8 patches with Oracle patches Review-exception: Simple merge - Adding Mike Fabians C.utf-8 patch (C.utf-8 is a unicode-aware version of the C locale) Orabug 29784239. Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> - Re…

Oct 6, 2020
Low max 3.7

ELSA-2020-3878 1 CVE

Low: dnsmasq security and bug fix update (Oracle Linux 7)

[2.76-16] - Fix strict-mode retries on REFUSED (#1755610) [2.76-15] - Forward non-recursive queries to upstream, but serve local names (#1755610) [2.76-14] - Stop treating SERVFAIL as successful response (#1815080) [2.76-13] - Do not ignore DHCPv6 relay messa…

Oct 6, 2020
Low

ELSA-2020-3906 2 CVEs

Low: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 7)

[1.5.3-175.el7] - kvm-vnc-fix-memory-leak-when-vnc-disconnect.patch [bz#1810408] - Resolves: bz#1810408 (CVE-2019-20382 qemu-kvm: QEMU: vnc: memory leakage upon disconnect [rhel-7]) [1.5.3-174.el7] - kvm-util-add-slirp_fmt-helpers2.patch [bz#1800515] - kvm-tc…

Oct 6, 2020
Medium max 7.5

ELSA-2020-3944 1 CVE

Moderate: unoconv security update (Oracle Linux 7)

[0.6-8] - Resolves: rhbz#1803831 CVE-2019-17400

Oct 6, 2020
Medium max 4.3

ELSA-2020-4003 1 CVE

Moderate: NetworkManager security and bug fix update (Oracle Linux 7)

[1:1.18.8-1] - Update to 1.18.8 relase - ifcfg-rh: handle '802-1x.{,phase2-}ca-path' (rh #1841397, CVE-2020-10754) - ifcfg-rh: handle 802-1x.pin properties. [1:1.18.6-4] - ip-tunnel: set cloned-mac-address only for layer2 tunnel devices (rh #1832170) [1:1.18.…

Oct 6, 2020
Medium max 7.1

ELSA-2020-4032 1 CVE

Moderate: dbus security update (Oracle Linux 7)

[1:1.10.24-15.0.1] - fix netlink poll: error 4 (Zhenzhong Duan) [1:1.10.24-15] - Fix CVE-2020-12049 (#1851992)

Oct 6, 2020
High max 7.5

ELSA-2020-4004 2 CVEs

Important: tomcat security and bug fix update (Oracle Linux 7)

[0:7.0.76-15] - Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS [0:7.0.76-14] - Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127 - Resolves: CVE-2020-948…

Oct 6, 2020
Medium

ELSA-2020-4024 1 CVE

Moderate: okular security update (Oracle Linux 7)

[4.10.5-9] - Document::processAction: If the url points to a binary, dont run it Resolves: bz#1821451

Oct 6, 2020
Low

ELSA-2020-3977 1 CVE

Low: evince and poppler security and bug fix update (Oracle Linux 7)

evince [3.28.2-10] - Do not try to use icon_view widget when in tree view mode - Resolves: #1610436 poppler [0.26.5-43] - Fix crash on broken file in tilingPatternFill() - Resolves: #1801340

Oct 6, 2020
Medium max 7.5

ELSA-2020-3996 3 CVEs

Moderate: libxml2 security and bug fix update (Oracle Linux 7)

[2.9.1-6.0.1.5] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [2.9.1-6.5] - Fix CVE-2019-19956 (#1793000) - Fix CVE-2019-20388 (#1810057) - Fix CVE-2020-7595 (#1810073) - Fix xsd:any schema validation (#1…

Oct 6, 2020
Medium max 6.5

ELSA-2020-4000 2 CVEs

Moderate: libvirt security and bug fix update (Oracle Linux 7)

[4.5.0-36] - virDevMapperGetTargetsImpl: Be tolerant to kernels without DM support (rhbz#1823976) - virDevMapperGetTargetsImpl: quit early if device is not a devmapper target (rhbz#1823976) [4.5.0-35] - qemu: dont take agent and monitor job for shutdown (CVE-…

Oct 6, 2020
Medium max 6.4

ELSA-2020-3984 3 CVEs

Moderate: freeradius security and bug fix update (Oracle Linux 7)

[3.0.13-15] - Fixes EAP-PWD: DoS issues due to multithreaded BN_CTX access Resolves: bz#1818808 [3.0.13-14 - Fixes receiving of multiple RADIUS packets under load Resolves: bz#1630684 [3.0.13-13] - Fixes logging of cleartext pap password Resolves: bz#1677435 …

Oct 6, 2020
Medium max 8.0

ELSA-2020-4031 25 CVEs

Moderate: freerdp security, bug fix, and enhancement update (Oracle Linux 7)

[2.1.1-2] - Update to 2.1.1 (#1834286)

Oct 6, 2020
Medium

ELSA-2020-4041 1 CVE

Moderate: openldap security update (Oracle Linux 7)

[2.4.44-22] - Fix CVE-2020-12243 openldap: denial of service via nested boolean expressions in LDAP search filters (#1838405)

Oct 6, 2020
Medium

ELSA-2020-3949 1 CVE

Moderate: librabbitmq security update (Oracle Linux 7)

[0.8.0-3] - Resolves: #1809991, CVE-2019-18609 - integer overflow

Oct 6, 2020