Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

High max 7.8

ELSA-2026-59179 4 CVEs

Important: gstreamer1-plugins-good security update (Oracle Linux 8)

[1.16.1-7.7] - Fix CVE-2026-18296: heap buffer overflow in qtmoovrecover Resolves: RHEL-246382 [1.16.1-7.6] - Fix CVE-2026-18298: heap buffer overflow in GdkPixbuf image decoder Resolves: RHEL-246561 [1.16.1-7.5] - Fix CVE-2026-18299: Use-After-Free in rtpsbc…

Aug 24, 2026
Medium max 7.5

ELSA-2026-58560 1 CVE

Moderate: cups-filters security update (Oracle Linux 9)

[1.28.7-27.0.1] - header/footer not being printed in banner page. [Orabug: 28265099] (isaac.chen@oracle.com) - Fixes [Orabug: 29163824] source indentation not following convention (isaac.chen@oracle.com) [1.28.7-27] - CVE-2026-64612 cups-filters: handle libpn…

Aug 24, 2026
Medium max 6.7

ELSA-2026-58572 1 CVE

Moderate: NetworkManager security update (Oracle Linux 9)

[1.54.3-5.0.1] - Introduce always-ignore-carrier setting [Orabug: 39663315] - disable MPTCP handling by default [Orabug: 34801142] - add connectivity check via Oracle servers [Orabug: 32051972] - Add a dropin file to make Networkmanager-dispatcher persistent …

Aug 24, 2026
High max 9.8

ELSA-2026-58897 31 CVEs

Important: firefox security update (Oracle Linux 9)

[140.14.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.14.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

Aug 24, 2026
High max 7.8

ELSA-2026-58936 2 CVEs

Important: sqlite security update (Oracle Linux 9)

[3.34.1-11] - Fixes CVE-2026-11822 - Fixes CVE-2026-11824 - Resolves: RHEL-218247 - Resolves: RHEL-218282

Aug 24, 2026
High max 8.1

ELSA-2026-58952 1 CVE

Important: python-urwid security update (Oracle Linux 9)

[2.1.2-4.1] - Fix CVE-2026-9323: use cryptographically secure session identifiers in web display module - Resolves: RHEL-212564

Aug 24, 2026
Medium max 7.4

ELSA-2026-58982 2 CVEs

Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 9)

[10.2.6-23] - Resolves RHEL-183803: CVE-2026-39821 - Resolves RHEL-188280

Aug 24, 2026
High max 7.8

ELSA-2026-59152 4 CVEs

Important: gstreamer1-plugins-good security update (Oracle Linux 9)

[1.22.12-7.8] - Fix CVE-2026-18299: Use-After-Free in rtpsbcdepay Resolves: RHEL-246619 [1.22.12-7.7] - Fix CVE-2026-18296: size validation in qtmoovrecover MRF parsing Resolves: RHEL-246558 [1.22.12-7.6] - Fix CVE-2026-18298 in gdkpixbufdec element Resolves:…

Aug 24, 2026
High max 8.1

ELSA-2026-58561 1 CVE

Important: python-urwid security update (Oracle Linux 10)

[2.5.3-5] - Use secure random session identifiers

Aug 24, 2026
Medium max 6.7

ELSA-2026-58571 1 CVE

Moderate: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 10)

[10.1.0-16.el10_2.5] - kvm-file-posix-populate-pwrite_zeroes_alignment.patch [RHEL-207389] - kvm-block-use-pwrite_zeroes_alignment-when-writing-first.patch [RHEL-207389] - kvm-iotests-add-Linux-loop-device-image-creation-test.patch [RHEL-207389] - Resolves: R…

Aug 24, 2026
High max 7.8

ELSA-2026-58927 2 CVEs

Important: sqlite security update (Oracle Linux 10)

[3.46.1-6] - Fixes CVE-2026-11822 - Fixes CVE-2026-11824 - Resolves: RHEL-218247 - Resolves: RHEL-218282

Aug 24, 2026
High max 7.8

ELSA-2026-58928 1 CVE

Important: python3.14 security update (Oracle Linux 10)

[3.14.7-2] - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 [3.14.7-1] - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 [3.14.6-1] - Update to Python 3.14.6 Related: RHEL-227190

Aug 24, 2026
High max 9.8

ELSA-2026-58899 31 CVEs

Important: firefox security update (Oracle Linux 10)

[140.14.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.14.0-1] - Update to 140.14.0 ESR

Aug 24, 2026
High max 7.8

ELSA-2026-59097 1 CVE

Important: gstreamer1-plugins-base security update (Oracle Linux 10)

[1.26.7-2.1] - Add patch for CVE-2026-18297 Resolves: RHEL-246574

Aug 24, 2026
High max 7.8

ELSA-2026-59133 2 CVEs

Important: gstreamer1-plugins-good security update (Oracle Linux 10)

[1.26.7-2.7] - Fix CVE-2026-18298 in gdkpixbufdec element Resolves: RHEL-246557 [1.26.7-2.6] - Fix insufficient size validation in MRF file parsing in qtmoovrecover (CVE-2026-18296) Resolves: RHEL-246546

Aug 24, 2026
High max 7.5

ELSA-2026-59243 1 CVE

Important: python-pyasn1 security update (Oracle Linux 10)

[0.6.2-1.1] - Fix CVE-2026-59886: prevent overflow in Real.__float__() when converting ASN.1 Real values with large exponents Resolves: RHEL-217904

Aug 24, 2026
High max 8.1

ELSA-2026-57574 2 CVEs

Important: php:8.2 security, bug fix, and enhancement update (Oracle Linux 8)

libzip [1.7.3-1] - update to 1.7.3 php [8.2.33-1] - rebase to 8.2.33 php-pear [1:1.10.14-1] - update PEAR to 1.10.14 for PHP 8.2 RHEL-14705 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14705 php-pecl-rrd [2.0.3-1] - update to 2.0.3 php-pecl-xd…

Aug 21, 2026
High max 9.8

ELSA-2026-57253 9 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.157.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Aug 21, 2026
High max 7.5

ELSA-2026-56970 1 CVE

Important: perl-Date-Manip security update (Oracle Linux 9)

[6.85-3.1] - Fix CVE-2026-60075: prevent ReDoS via long whitespace runs in date/time parsing Related: RHEL-239797

Aug 21, 2026
High max 8.1

ELSA-2026-57539 2 CVEs

Important: php:8.3 security, bug fix, and enhancement update (Oracle Linux 9)

php [8.3.33-1] - rebase to 8.3.33 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 [5.1.21-1] - update to 5.1.21 for PHP 8.1 #2070040 php-pecl-redis6 [6.1.0-3] - use valkey for tests [6.1.0-2] - ignore 1 ONLINE test [6.1.0-1] - RHEL build [6…

Aug 21, 2026
High max 8.4

ELSA-2026-56936 29 CVEs

Important: mysql:8.4 security, bug fix, and enhancement update (Oracle Linux 8)

mecab [0.996-2.12] - Bump version for 'mysql' module rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'AppStream' repo - Resolves: #2180411 [0.996-2] - Rebuild to fix the issue described in #2000986 - Resolves: #2000986 [0.996-1.9]…

Aug 20, 2026
High max 7.5

ELSA-2026-57562 1 CVE

Important: perl-Date-Manip security update (Oracle Linux 8)

[6.60-3.1] - Fix CVE-2026-60075: prevent ReDoS via crafted strings with long interior whitespace runs in date/time parsing - Resolves: RHEL-239807

Aug 20, 2026
High max 8.8

ELSA-2026-55764 10 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.155.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Aug 20, 2026
Medium max 7.5

ELSA-2026-57451 1 CVE

Moderate: cups-filters security update (Oracle Linux 8)

[1.20.0-36.0.1.el8_10.1] - header/footer not being printed in banner page. [Orabug: 28265099] (isaac.chen@oracle.com) - Fixes [Orabug: 29163824] source indentation not following convention (isaac.chen@oracle.com) [1.20.0-36.1] - CVE-2026-64612 cups-filters: H…

Aug 20, 2026
High max 8.1

ELSA-2026-57462 1 CVE

Important: curl security, bug fix, and enhancement update (Oracle Linux 8)

[7.61.1-34.el8_10.13] - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) [7.61.1-34.el8_10.12] - NTLM: use HTTP/1.0 instead of HTTP/1.1 for compatibility (RHEL-171912)

Aug 20, 2026
High max 8.4

ELSA-2026-56973 29 CVEs

Important: mysql:8.4 security, bug fix, and enhancement update (Oracle Linux 9)

mecab [0.996-3.4] - Bump version for package rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'CRB' repo - Resolves: #2182069 [0.996-3.3] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 [0.996-3.2] - Rebuilt…

Aug 20, 2026
Medium max 6.8

ELSA-2026-55775 3 CVEs

Moderate: java-1.8.0-openjdk security update (Oracle Linux 8)

[1.8.0.504.b01-1.1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:1.8.0.504.b01-1.1] - Update to 8u504-b01 (GA). - Update release notes for 8u504-b01. - Bump FreeType version to 2.14.3 following JDK-8385390 - Sync the copy of the portable specfile wit…

Aug 20, 2026
Medium max 6.8

ELSA-2026-55781 3 CVEs

Moderate: java-17-openjdk security update (Oracle Linux 8)

[17.0.20.1.1-1.1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:17.0.20.1.1-1.1] - Update to jdk-17.0.20.1+1 (GA) - Add to .gitignore openjdk-17.0.20.1+1.tar.xz - Set patchver to 1 - Set buildver to 1 - Update sources to openjdk-17.0.20.1+1.tar.xz - *…

Aug 20, 2026
High max 9.8

ELSA-2026-57252 26 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.41.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Aug 20, 2026
Medium max 7.8

ELSA-2026-57610 1 CVE

Moderate: kbd security update (Oracle Linux 9)

[2.4.0-12] - Fix CVE-2026-72693: openvt -u process matching made more conservative Resolves: RHEL-235988

Aug 20, 2026
High max 7.1

ELSA-2026-57600 1 CVE

Important: mrtg security update (Oracle Linux 9)

[2.17.7-12.0.1.el9_8.1] - Create mrtg lock file before running restorecon on it [Orabug: 39096845] [2.17.7-12.1] - Fix CVE-2026-72694: symlink-following chown of pid file in daemon mode Resolves: RHEL-236047

Aug 20, 2026
High max 7.8

ELSA-2026-57148 1 CVE

Important: ansible-core security update (Oracle Linux 10)

[2.16.16-2.0.1.el10_2.1] - exclude telemetry from Oracle Linux [1:2.16.16-2.1] - Fix CVE-2026-11332 (ansible-galaxy role installs could allow arbitrary git configuration injection via malformed role requirements) (RHEL-194128)

Aug 20, 2026
Medium max 7.5

ELSA-2026-55798 4 CVEs

Moderate: java-25-openjdk security update (Oracle Linux 9)

[1:25.0.4.1.1-1.1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:25.0.4.1.1-1.1] - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - *…

Aug 20, 2026
High max 9.8

ELSA-2026-57251 24 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.49.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Aug 20, 2026
Medium max 7.8

ELSA-2026-57597 1 CVE

Moderate: kbd security update (Oracle Linux 10)

[2.6.4-8] - Fix openvt -u process matching to be more conservative (CVE-2026-72693) Resolves: RHEL-235987

Aug 20, 2026
Medium max 6.8

ELSA-2026-55787 3 CVEs

Moderate: java-21-openjdk security update (Oracle Linux 8)

[1:21.0.12.1.1-1.2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:21.0.12.1.1-1.2] - Bump release for PQC build - Related: RHEL-235625 [1:21.0.12.1.1-1.1] - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the po…

Aug 20, 2026
High max 7.1

ELSA-2026-57596 1 CVE

Important: mrtg security update (Oracle Linux 10)

[2.17.10-12.1] - Fix symlink-following chown of pid file in daemon mode (CVE-2026-72694) Resolves: RHEL-236045

Aug 20, 2026
High max 7.6

ELSA-2026-56521 1 CVE

Important: gstreamer1-plugins-bad-free security update (Oracle Linux 8)

[1.16.1-9.0.1.el8_10.2] - Update origin URL [Orabug: 36209826] [1.16.1-9.2] - Fix IMA ADPCM input size check in adpcmdec (CVE-2026-19387) Resolves: RHEL-235503 [1.16.1-9.1] - Fix buffer overflow in DTLS certificate subject DN handling (CVE-2026-59692) Resolve…

Aug 19, 2026
Medium max 7.5

ELSA-2026-56966 3 CVEs

Moderate: gstreamer1-plugins-good security update (Oracle Linux 8)

[1.16.1-7.3] - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239048 [1.16.1-7.2] - Fix CVE-2026-18649 in H.264/H.265 RTP depayloaders Resolves: RHEL-224145 [1.16.1-7.1] - Fix multiple security issues in AVI demuxer (CVE-20…

Aug 19, 2026
High max 8.8

ELSA-2026-55740 4 CVEs

Important: pcp security update (Oracle Linux 9)

[6.3.7-8.0.1.el9_8.4] - Adds interval option support in PCP nfsiostat tool [Orabug: 39068870] - Introduces proc.numa_maps metrics in linux_proc PMDA [Orabug: 39096683] - adds numastat process option in the tool - Added support for size based cleanup for pcp a…

Aug 19, 2026