Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

High

ELSA-2020-3713 3 CVEs

Important: dovecot security update (Oracle Linux 8)

[1:2.3.8-2.2] - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866755) - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866760) - fix CVE-2020-12674 crash due to assert in RPA implementation (#1866767)

Sep 11, 2020
High max 7.5

ELSA-2020-3699 1 CVE

Important: .NET Core 3.1 security and bugfix update (Oracle Linux 8)

[3.1.108-2.0.1.el8_2] - Update patch to support 8.2 (alexander.burmashev@oracle.com) - support OL release scheme (alexander.burmashev@oracle.com) [3.1.108-2] - Rebuild to fix tests - Resolves: RHBZ#1874512 [3.1.108-1] - Update to .NET Core Runtime 3.1.8 and S…

Sep 11, 2020
High

ELSA-2020-3714 1 CVE

Important: httpd:2.4 security update (Oracle Linux 8)

mod_http2 [1.11.3-3.1] - Resolves: #1869072 - CVE-2020-9490 httpd:2.4/mod_http2: httpd: Push diary crash on specifically crafted HTTP/2 header

Sep 11, 2020
High max 6.5

ELSA-2020-5841 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.49.1] - sunrpc: use SVC_NET() in svcauth_gss_* functions (Vasily Averin) [Orabug: 31351996] {CVE-2018-16884} - sunrpc: use-after-free in svc_process_common() (Vasily Averin) [Orabug: 31351996] {CVE-2018-16884} - af_packet: set defaule v…

Sep 10, 2020
Medium max 7.5

ELSA-2020-3662 22 CVEs

Moderate: php:7.3 security, bug fix, and enhancement update (Oracle Linux 8)

php [7.3.20-1] - update to 7.3.20 #1856655 php-pear [1:1.10.9-1] - update PEAR to 1.10.9 - update Archive_Tar to 1.4.7 - update Console_Getopt to 1.4.2

Sep 9, 2020
Medium

ELSA-2020-3654 1 CVE

Moderate: libcroco security update (Oracle Linux 8)

[0.6.12-4.1] - Fix CVE-2020-12825 Resolves: #1866484

Sep 9, 2020
Medium max 7.5

ELSA-2020-3669 6 CVEs

Moderate: postgresql:10 security and bug fix update (Oracle Linux 8)

[10.14-1] - Rebase to upstream release 10.14 Fixes RHBZ#1727803 Fixes RHBZ#1741489 Fixes RHBZ#1709196 [10.13-1] - Rebase to upstream release 10.13 Fixes RHBZ#1727803 Fixes RHBZ#1741489 Fixes RHBZ#1709196

Sep 9, 2020
High

ELSA-2020-3658 1 CVE

Important: librepo security update (Oracle Linux 8)

[1.11.0-3] - Validate paths read from repomd.xml (RhBug:1866498)

Sep 9, 2020
High

ELSA-2020-3556 2 CVEs

Important: firefox security update (Oracle Linux 7)

[68.12.0-1.0.3] - Build with rust-toolset 1.43 [68.12.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Improve …

Sep 8, 2020
High

ELSA-2020-3634 2 CVEs

Important: thunderbird security update (Oracle Linux 8)

[68.12.0-1.0.1] * Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.12.0-1] - Update to 68.12.0 build1

Sep 8, 2020
High

ELSA-2020-3623 2 CVEs

Important: squid:4 security update (Oracle Linux 8)

libecap squid [7:4.4-8.2] - Resolves: #1872345 - CVE-2020-15811 squid:4/squid: HTTP Request Splitting could result in cache poisoning - Resolves: #1872330 - CVE-2020-15810 squid:4/squid: HTTP Request Smuggling could result in cache poisoning [7:4.4-8.1] - Res…

Sep 4, 2020
High max 3.3

ELSA-2020-5837 8 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.42.3] - can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices (Tomas Bortoli) [Orabug: 31351221] {CVE-2019-19535} - media: hdpvr: Fix an error handling path in hdpvr_probe() (Arvind Yadav) [Orabug: 31352053] {CVE-2017-16644} - fs/binfmt_misc.c…

Sep 3, 2020
High

ELSA-2020-3617 3 CVEs

Important: dovecot security update (Oracle Linux 7)

[1:2.2.36-6.1] - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1871841) - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1871843) - fix CVE-2020-12674 crash due to assert in RPA implementation (#1871842)

Sep 3, 2020
High

ELSA-2020-5828 1 CVE

Important: coredns cri-o cri-tools etcd flannel kata kata-agent kata-image kata-ksm-throttler kata-proxy kata-runtime kata-shim kubernetes kubernetes-cni kubernetes-cni-plugins kubernetes-dashboard olcne yq security update (Oracle Linux 7)

coredns [1.3.1-1.0.6] - Address CVE-2020-16845 [1.3.1-1.0.5] - Fix image location cri-o [1.14.7-1.0.8] - Address CVE-2020-16845 cri-tools [1.14.0-1.0.6] - Address CVE-2020-16845 etcd [3.3.10-1.0.5] - Address CVE-2020-16845 [3.3.10-1.0.4] - Fix image location …

Aug 31, 2020
High

ELSA-2020-5827 1 CVE

Important: olcne conmon coredns cri-o cri-tools etcd flannel grafana helm istio kata kata-agent kata-image kata-ksm-throttler kata-proxy kata-runtime kata-shim kubernetes kubernetes-cni kubernetes-cni-plugins kubernetes-dashboard prometheus yq security update (Oracle Linux 7)

olcne [1.1.5-2] - kubernetes pod subnet flag not honored in flannel configuration [1.1.5-1] - Address CVE-2020-16845 conmon [2.0.10-3] - Address CVE-2020-16845 coredns [1.6.5-1.0.3] - Address CVE-2020-16845 cri-o [1.17.0-1.0.5] - Address CVE-2020-16845 cri-to…

Aug 31, 2020
High

ELSA-2020-3557 10 CVEs

Important: firefox security update (Oracle Linux 8)

[78.2.0-2.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [78.2.0-2] - Update to 78.2.0 build1

Aug 28, 2020
High

ELSA-2020-5825 1 CVE

Important: kubernetes kubeadm-ha-setup kubernetes-cni kubernetes-cni-plugins security update (Oracle Linux 7)

kubernetes [1.12.10-1.0.15] - Address CVE-2020-16845 kubeadm-ha-setup [0.0.2-1.0.73] - Fix update to coredns image tag [0.0.2-1.0.72] - Address CVE-2020-16845 kubernetes-cni [0.7.1-1.0.3] - Pin min version of cni-plugins kubernetes-cni-plugins [0.8.6-1.0.3] -…

Aug 24, 2020
High

ELSA-2020-5823 1 CVE

Important: docker-cli docker-engine security update (Oracle Linux 7)

docker-cli [19.03.11-5] - Bugfix for 'docker images [name]' not working on docker 19.03.11-ol - Address CVE-2020-16845 [19.03.11-4] - added patch for registry list [19.03.11-3] - update to 19.03.11 for CVE-2020-13401 [19.03.1-1.0.0] - update to 19.03.1 [19.03…

Aug 24, 2020
High max 7.5

ELSA-2020-3422 1 CVE

Important: .NET Core 3.1 security and bugfix update (Oracle Linux 8)

[3.1.107-1.0.1] - Update patch to support 8.2 (alexander.burmashev@oracle.com) - support OL release scheme (alexander.burmashev@oracle.com) [3.1.107-1] - Update to .NET Core Runtime 3.1.7 and SDK 3.1.107 - Resolves: RHBZ#1862593 - Resolves: RHBZ#1861113

Aug 16, 2020
High max 5.5

ELSA-2020-5804 11 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.305.4] - ptp: free ptp device pin descriptors properly (Vladis Dronov) [Orabug: 31710994] [4.14.35-1902.305.3] - fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() (Alexander Potapenko) [Orabug: 31350638] {CVE-2020-10732} - …

Aug 10, 2020
High max 5.5

ELSA-2020-5805 6 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2011.5.3uek] - misc: pvpanic: add crash loaded event (zhenwei pi) [Orabug: 31677096] - misc: pvpanic: move bit definition to uapi header file (zhenwei pi) [Orabug: 31677096] - RDMA/netlink: Do not always generate an ACK for some netlink operations (Ha…

Aug 10, 2020
High

ELSA-2020-3385 1 CVE

Important: libvncserver security update (Oracle Linux 8)

[0.9.11-15.1] - Fix NVR Related: #1852356 [0.9.11-15] - Fix CVE-2017-18922 Resolves: #1852356

Aug 10, 2020
High

ELSA-2020-3344 4 CVEs

Important: thunderbird security update (Oracle Linux 7)

[68.11.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.11.0-1] - Update to 68.11.0 build1

Aug 7, 2020
High

ELSA-2020-5802 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.48.1] - crypto: user - fix memory leak in crypto_report (Navid Emamdoost) [Orabug: 31351641] {CVE-2019-19062} - media: rc: prevent memory leak in cx23888_ir_probe (Navid Emamdoost) [Orabug: 31351673] {CVE-2019-19054}

Aug 6, 2020
High

ELSA-2020-5801 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.41.4] - uek-rpm: Add OL6 shim conflict for new signing key (Eric Snowberg) [Orabug: 31688239] - Revert 'certs: Add Oracle's new X509 cert into the kernel keyring' (Eric Snowberg) [Orabug: 31688223] - blk-mq: don't overwrite rq->mq_ctx (Jens Axboe)…

Aug 6, 2020
Medium max 7.5

ELSA-2020-3053 1 CVE

Moderate: container-tools:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

buildah [1.14.9-1.0.1] - Fixes troubles with oracle registry login [Orabug: 29937283] [1.14.9-1] - update to https://github.com/containers/buildah/releases/tag/v1.14.9 - Related: RHELPLAN-39206 [1.14.8-2] - make container-selinux a soft dependency - Related: …

Aug 6, 2020
High

ELSA-2020-3341 4 CVEs

Important: thunderbird security update (Oracle Linux 8)

[68.11.0-1.0.1.el8_2] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.11.0-1] - Update to 68.11.0 build1

Aug 6, 2020
High

ELSA-2020-3281 1 CVE

Important: libvncserver security update (Oracle Linux 7)

[0.9.9-14.1] - Fix CVE-2017-18922 Resolves: #1852509

Aug 4, 2020
High max 7.7

ELSA-2020-3285 1 CVE

Important: postgresql-jdbc security update (Oracle Linux 7)

[9.2.1002-8] - require explicitly jdk-1.7 due to ABI bytecode compatibility [9.2.1002-7] - fixed XXE vulnerability (CVE-2020-13692)

Aug 4, 2020
Medium

ELSA-2020-3280 4 CVEs

Moderate: nss and nspr security, bug fix, and enhancement update (Oracle Linux 8)

nspr [4.25.0-2] - Rebuild [4.25.0-1] - Update to NSPR 4.25 nss [3.53.1-11] - Fix issue with upgradedb where upgradedb expects standard to generate dbm databases, not sql databases (default in RHEL8) [3.53.1-10] - Disable dh timing test because it's unreliable…

Aug 4, 2020
High

ELSA-2020-3253 4 CVEs

Important: firefox security update (Oracle Linux 7)

[68.11.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file * Thu Jul 23 2020 Jan Horak <jhorak@redhat.com> - Update …

Jul 31, 2020
High

ELSA-2020-3220 4 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1127.18.2.OL7] - Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and shim-x…

Jul 30, 2020
High

ELSA-2020-3241 4 CVEs

Important: firefox security update (Oracle Linux 8)

[68.11.0-1.0.1] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [68.11.0-1] - Update to 68.11.0 build1

Jul 30, 2020
Medium

ELSA-2020-3218 2 CVEs

Moderate: kernel security and bug fix update (Oracle Linux 8)

[4.18.0-193.14.3_2.OL8] - Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Or…

Jul 30, 2020
High max 6.4

ELSA-2020-5790 8 CVEs

Important: grub2 security update (Oracle Linux 7)

[2.02-81.0.4] - Fix CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707 [Orabug: 31225072] - Update signing certificate for efi binaries [2.02-0.81.0.2] - Enable common subpackage buil…

Jul 29, 2020
High max 6.4

ELSA-2020-5782 8 CVEs

Important: grub2 security update (Oracle Linux 7)

[2.02-81.0.3] - Fix CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707 [Orabug: 31225072] - Update signing certificate for efi binaries

Jul 29, 2020
High

ELSA-2020-5791 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.304.6.3] - Revert 'uek-rpm: Move grub boot menu update to posttrans stage.' (Somasundaram Krishnasamy) [Orabug: 31358100] [4.14.35-1902.304.6.2] - certs: Remove Oracle cert compiled into the kernel (Eric Snowberg) [Orabug: 31668611] - efi: Restr…

Jul 29, 2020
High

ELSA-2020-5792 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2011.4.6.el8uek] - Revert 'uek-rpm: Move grub boot menu update to posttrans stage.' (Somasundaram Krishnasamy) [Orabug: 31358097] [5.4.17-2011.4.5.el8uek] - IB/sa: Resolv use-after-free in ib_nl_make_request() (Divya Indi) [Orabug: 31631527] - certs: …

Jul 29, 2020
Medium max 5.8

ELSA-2020-3032 2 CVEs

Moderate: mod_auth_openidc:2.3 security and bug fix update (Oracle Linux 8)

cjose [0.6.1-2] - fix concatkdf big endian architecture problem. Upstream issue #77. [0.6.1-1] - upgrade to latest upstream 0.6.1 [0.5.1-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild [0.5.1-2] - Rebuilt for https://fedoraproject.org/w…

Jul 29, 2020
High max 6.4

ELSA-2020-5786 8 CVEs

Important: grub2 security update (Oracle Linux 8)

[2.02-82.0.2.el8_2.1] - Fix CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707 [Orabug: 31225072] - Update signing certificate for efi binaries

Jul 29, 2020