Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

  • High max 8.1
    ELSA-2020-3185 2 CVEs

    Important: python-pillow security update (Oracle Linux 8)

    [5.1.1-12] - Fix for CVE-2020-5313 Resolves: rhbz#1789532 [5.1.1-11] - Fix for CVE-2020-11538 Resolves: rhbz#1852814

  • High max 7.7
    ELSA-2020-3176 1 CVE

    Important: postgresql-jdbc security update (Oracle Linux 8)

    [42.2.3-3] - fixed XXE vulnerability unit test [42.2.3-2] - fixed XXE vulnerability (CVE-2020-13692)

  • High max 5.3
    ELSA-2020-5773 1 CVE

    Important: fuse security update (Oracle Linux 7)

    [2.9.4-1.0.7.el7] - \n- bump release number to 2.9.4-1.0.7 (Lans Hung) \n- fix missing Patch1, Patch2, Patch3 declaration in spec file after using %setup -q /usr/bin/cat /usr/src/redhat/SOURCES/fuse-0001-fix-int64_t-conflict-on-aarch64.patch | /usr/bin/patch …

  • High max 6.2
    ELSA-2020-3010 9 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-193.13.2_2.OL8] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] [4.18.0-193.13.2_2] - Re…

  • Medium max 4.3
    ELSA-2020-3011 1 CVE

    Moderate: NetworkManager security and bug fix update (Oracle Linux 8)

    [1:1.22.8-5] - dhcp: fix handling IO error in nettools DHCPv4 client (rh #1843357) - ifcfg-rh: handle '802-1x.{,phase2-}ca-path' (rh #1843360, CVE-2020-10754)

  • High
    ELSA-2020-3014 1 CVE

    Important: dbus security update (Oracle Linux 8)

    [1.12.8-10.0.1.el8_2] - fix netlink poll: error 4 (Zhenzhong Duan) [1:1.12.8-10] - Fix CVE-2020-12049 (#1851996)

  • High max 6.4
    ELSA-2020-5767 2 CVEs

    Important: kubernetes security update (Oracle Linux 7)

    [1.12.10-1.0.13] - CVE-2020-8559: Privilege escalation from compromised node to cluster - CVE-2020-8557: Node disk DOS by writing to container /etc/hosts

  • High max 8.8
    ELSA-2020-5766 5 CVEs

    Important: Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes olcne security update (Oracle Linux 7)

    kernel-uek-container [4.14.35-1902.303.5.3.el7] - rds: Deregister all FRWR mr with free_mr (Hans Westgaard Ry) [Orabug: 31476202] - Revert 'rds: Do not cancel RDMAs that have been posted to the HCA' (Gerd Rausch) [Orabug: 31475329] - Revert 'rds: Introduce rd…

  • High max 8.8
    ELSA-2020-5765 9 CVEs

    Important: Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes kubernetes istio olcne security update (Oracle Linux 7)

    kernel-uek-container [4.14.35-1902.303.5.3.el7] - rds: Deregister all FRWR mr with free_mr (Hans Westgaard Ry) [Orabug: 31476202] - Revert 'rds: Do not cancel RDMAs that have been posted to the HCA' (Gerd Rausch) [Orabug: 31475329] - Revert 'rds: Introduce rd…

  • High
    ELSA-2020-3038 5 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [68.10.0-1.0.1.el8_2] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.10.0-1] - Update to 68.10.0 build1

  • High max 8.3
    ELSA-2020-2968 7 CVEs

    Important: java-1.8.0-openjdk security update (Oracle Linux 7)

    [1:1.8.0.262.b10-0] - Update to aarch64-shenandoah-jdk8u262-b10. - Switch to GA mode for final release. - Update release notes for 8u262 release. - Fix typo in jfr_arches which leads to ppc64 being wrongly excluded. - Split JDK-8042159 patch into per-repo pat…

  • High max 8.3
    ELSA-2020-2969 7 CVEs

    Important: java-11-openjdk security update (Oracle Linux 7)

    [1:11.0.8.10-0.0.1] - link atomic for ix86 build [1:11.0.8.10-0] - Update to shenandoah-jdk-11.0.8+10 (GA) - Switch to GA mode for final release. - Update release notes with last minute fix (JDK-8248505). - This tarball is embargoed until 2020-07-14 @ 1pm PT.…

  • Critical max 7.8
    ELSA-2020-2954 1 CVE 1 exploited

    Critical: .NET Core 3.1 security and bugfix update (Oracle Linux 8)

    [3.1.106-1.0.1] - Update patch to support 8.2 (alexander.burmashev@oracle.com) - support OL release scheme (alexander.burmashev@oracle.com) [3.1.106-1] - Update to .NET Core Runtime 3.1.6 and SDK 3.1.106 - Resolves: RHBZ#1854137

  • Critical max 7.8
    ELSA-2020-2938 1 CVE 1 exploited

    Critical: .NET Core security and bugfix update (Oracle Linux 8)

    [2.1.516-1] - Update to .NET Core SDK 2.1.516 and Runtime 2.1.20 - Resolves: RHBZ#1851983

  • High max 8.3
    ELSA-2020-2970 7 CVEs

    Important: java-11-openjdk security and enhancement update (Oracle Linux 8)

    [1:11.0.8.10-0] - Update to shenandoah-jdk-11.0.8+10 (GA) - Switch to GA mode for final release. - Update release notes with last minute fix (JDK-8248505). - This tarball is embargoed until 2020-07-14 @ 1pm PT. - Resolves: rhbz#1838811 [1:11.0.8.9-0.0.ea] - U…

  • High max 8.3
    ELSA-2020-2972 7 CVEs

    Important: java-1.8.0-openjdk security update (Oracle Linux 8)

    [1:1.8.0.262.b10-0.1] - Update to aarch64-shenandoah-jdk8u262-b10. - Switch to GA mode for final release. - Update release notes for 8u262 release. - Fix typo in jfr_arches which leads to ppc64 being wrongly excluded. - Split JDK-8042159 patch into per-repo p…

  • High
    ELSA-2020-2906 5 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [68.10.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.10.0-1] - Update to 68.10.0 build1

  • High
    ELSA-2020-2894 1 CVE

    Important: dbus security update (Oracle Linux 7)

    [1:1.10.24-14.0.1] - fix netlink poll: error 4 (Zhenzhong Duan) [1:1.10.24-14] - Fix CVE-2020-12049 (#1851991)

  • High
    ELSA-2020-2902 2 CVEs

    Important: sane-backends security update (Oracle Linux 8)

    [1.0.27-19.1] - 1852468, 1852467, 1852466, 1852465 - prevent buffer overflow in esci2_img - 1852668, 1852667, 1852666, 1852665 - disable autodiscovery for epsonds backend

  • High max 5.6
    ELSA-2020-2848 3 CVEs

    Important: nodejs:10 security update (Oracle Linux 8)

    nodejs [1:10.21.0-3] - Resolves: RHBZ#1845306 - Remove brotli-devel requires from nodejs-devel [1:10.21.0-2] - Resolves: RHBZ#1845306 - Turn off debug builds [1:10.21.0-1] - Security update to 10.21.0 - Resolves: RHBZ#1845306 - Fixes CVE-2020-11080, CVE-2020-…

  • High
    ELSA-2020-2897 1 CVE

    Important: jbig2dec security update (Oracle Linux 8)

    [0.14-4] - Add explicit package version requirement on jbig2dec-libs to jbig2dec related: #1851057 [0.14-3] - Fix CVE-2020-12268 resolves: #1851057

  • High max 7.5
    ELSA-2020-2901 1 CVE

    Important: dovecot security update (Oracle Linux 8)

    [1:2.3.8-2.1] - fix CVE-2020-10957: malformed NOOP commands leads to DoS (#1840353)

  • High max 5.6
    ELSA-2020-2852 4 CVEs

    Important: nodejs:12 security update (Oracle Linux 8)

    nodejs [12.18.2-1] - Rebase to 12.18.2 [1:12.18.1-1] - Rebase - Spec clean up - Provide i18n package, bundle icu - Resolves: RHBZ#1845310, RHBZ#1845691 [1:12.18.0-1] - Security update to 12.18.0 - Resolves: RHBZ#1845310, RHBZ#1845691 [1:12.16.1-2] - Fix CVE-2…

  • High max 5.9
    ELSA-2020-5756 6 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2011.4.4uek] - KVM: VMX: Explicitly clear RFLAGS.CF and RFLAGS.ZF in VM-Exit RSB path (Sean Christopherson) [Orabug: 31536904] [5.4.17-2011.4.3uek] - NFS: replace cross device check in copy_file_range (Olga Kornievskaia) [Orabug: 31507615] - rds: Fix …

  • High
    ELSA-2020-5753 3 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.47.1] - media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() (Tomas Bortoli) [Orabug: 31351121] {CVE-2019-19533} - can: peak_usb: fix slab info leak (Johan Hovold) [Orabug: 31351143] {CVE-2019-19534} - ALSA: core: Fix card races …

  • High max 8.0
    ELSA-2020-5755 19 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.14.35-1902.304.6] - bpf: fix sanitation rewrite in case of non-pointers (Daniel Borkmann) [Orabug: 31552243] [4.14.35-1902.304.5] - acpi: disallow loading configfs acpi tables when locked down (Jason A. Donenfeld) [Orabug: 31493187] - selftests/bpf: do not…

  • High
    ELSA-2020-5750 6 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.40.6] - ipv4: ipv4_default_advmss() should use route mtu (Eric Dumazet) [Orabug: 31563095] - net: ipv4: Refine the ipv4_default_advmss (Gao Feng) [Orabug: 31563095] [4.1.12-124.40.5] - Revert 'bnxt_en: Remove busy poll logic in the driver.' (Brian…

  • High
    ELSA-2020-2828 5 CVEs

    Important: firefox security update (Oracle Linux 8)

    [68.10.0-1.0.1.el8_2] - Rebuild to pickup Oracle default bookmarks [Orabug: 30069264] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Remove upstream references [Orabug: 30530527] [68.10.0-1] - Update to 68.10.0 build1

  • High
    ELSA-2020-2827 5 CVEs

    Important: firefox security update (Oracle Linux 7)

    [68.10.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file * Fri Jun 26 2020 Jan Horak <jhorak@redhat.com> - Update …

  • High max 3.7
    ELSA-2020-2755 1 CVE

    Important: nghttp2 security update (Oracle Linux 8)

    [1.33.0-3.el8_2.1] - prevent DoS caused by overly large SETTINGS frames (CVE-2020-11080) [1.33.0-3] - rebuild to trigger gating (#1681044) [1.33.0-2] - backport security fixes from nghttp2-1.39.2 (CVE-2019-9511 and CVE-2019-9513)

  • High
    ELSA-2020-2774 2 CVEs

    Important: virt:ol security update (Oracle Linux 8)

    qemu-kvm [2.12.0-99.0.1.el8_2.2] - Added bug30251155-remove-upstream-reference [Orabug: 30251155] [2.12.0-99.el8_2.2] - kvm-vnc-add-magic-cookie-to-VncState.patch [bz#1816763] - kvm-vnc-fix-memory-leak-when-vnc-disconnect.patch [bz#1816763] - Resolves: bz#181…

  • High max 6.0
    ELSA-2020-5739 1 CVE

    Important: docker-cli docker-engine security update (Oracle Linux 7)

    docker-cli [19.03.11-4] - added patch for registry list [19.03.11-3] - update to 19.03.11 for CVE-2020-13401 [19.03.1-1.0.0] - update to 19.03.1 [19.03-0.0.1] - update to 19.03 [18.09.1-1.0.6] - disable kmem accounting for UEKR4 [18.09.1-1.0.5] - apply e4931e…

  • Medium max 5.9
    ELSA-2020-2663 2 CVEs

    Moderate: ntp security update (Oracle Linux 7)

    [4.2.6p5-29.0.1] - Bump release to avoid ULN conflict with Oracle modified errata. [4.2.6p5-29.el7_8.2] - don't update transmission time on invalid response (CVE-2020-11868) - randomize transmit timestamp in client requests (CVE-?, #1813787)

  • High
    ELSA-2020-2664 1 CVE

    Important: kernel security and bug fix update (Oracle Linux 7)

    [3.10.0-1127.13.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] [3.10.0-1127.13.1] - [x86] x86/s…

  • High
    ELSA-2020-2614 4 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [68.9.0-1.0.1.el8_2] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.9.0-1] - Update to 68.9.0 build1

  • High
    ELSA-2020-2642 1 CVE

    Important: unbound security update (Oracle Linux 7)

    [1.6.6-5] - Fix incomplete amplifying-an-incoming-query patch - Resolves: rhbz#1846424

  • High
    ELSA-2020-2615 4 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [68.9.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.9.0-1] - Update to 68.9.0 build1

  • High max 5.8
    ELSA-2020-2641 1 CVE

    Important: grafana security update (Oracle Linux 8)

    [6.3.6-2] - fix CVE-2020-13379

  • High
    ELSA-2020-2637 1 CVE

    Important: gnutls security update (Oracle Linux 8)

    [3.6.8-11] - Fix CVE-2020-13777 (#1844147)

  • Medium
    ELSA-2020-2432 3 CVEs

    Moderate: microcode_ctl security, bug fix and enhancement update (Oracle Linux 7)

    [2:2.1-61.6.0.1] - update 06-2d-07 to 0x71a - update 06-55-04 to 0x2006906 - update 06-55-07 to 0x5002f01 - for Intel, do not trigger load if on-disk microcode is not an update [Orabug: 30634727] - set early_microcode='no' in virtualized guests to avoid early…