Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

High max 8.8

ELSA-2020-1932 1 CVE

Important: container-tools:ol8 security update (Oracle Linux 8)

buildah [1.11.6-8.0.1] - Fixes troubles with oracle registry login [Orabug: 29937283] [1.11.6-8] - fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build process' - Resolves: #1817742 [1.11.6-7] - fix 'COPY c…

May 12, 2020
High max 8.8

ELSA-2020-1931 1 CVE

Important: container-tools:2.0 security update (Oracle Linux 8)

buildah [1.11.6-7.0.1] - Fixes troubles with oracle registry login [Orabug: 29937283] [1.11.6-7] - fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build process' - Resolves: #1819393 conmon [2:2.0.6-1.0.1] -…

May 12, 2020
Critical

ELSA-2020-2046 5 CVEs

Critical: thunderbird security update (Oracle Linux 8)

[68.8.0-1.0.1.el8_2] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.8.0-1] - Update to 68.8.0 build2

May 12, 2020
High max 7.5

ELSA-2020-2070 1 CVE

Important: libreswan security update (Oracle Linux 8)

[3.29-7.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [3.29-7] - Resolves: rhbz#1814935 CVE-2020-1763 doS attack via malicious IKEv1 informational exchange message [rhel-8.2.0.z]

May 12, 2020
High

ELSA-2020-2041 3 CVEs

Important: squid:4 security update (Oracle Linux 8)

squid [7:4.4-8.1] - Resolves: #1828368 - CVE-2019-12519 squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow - Resolves: #1828367 - CVE-2020-11945 squid: improper access restriction upon Digest Authentication nonce …

May 12, 2020
High max 7.8

ELSA-2020-5676 16 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.302.2] - KVM: x86: Protect pmu_intel.c from Spectre-v1/L1TF attacks (Marios Pomonis) [Orabug: 31191092] - KVM: x86: Protect MSR-based index computations in fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks (Marios Pomonis) [Orabug: 31191092] …

May 11, 2020
Critical

ELSA-2020-2031 4 CVEs

Critical: firefox security update (Oracle Linux 8)

[68.8.0-1.0.1.el8_2] - Rebuild to pickup Oracle default bookmarks [Orabug: 30069264] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Remove upstream references [Orabug: 30530527] * Wed Apr 29 2020 Jan Horak <jhorak@redhat.com…

May 9, 2020
High

ELSA-2020-5674 1 CVE

Important: libvirt security update (Oracle Linux 7)

[5.7.0-13.el7] - domain groups: Fix multiple Domain Group vCPU administration flaws (Wim ten Have) [Orabug: 31145304] - qemu: fix missing #if defined(ENABLE_EXADATA) (Menno Lageman) - build: Fix qemu-submodule-init syntax-check issue (Wim ten Have) - libvirt:…

May 7, 2020
High

ELSA-2020-2040 3 CVEs

Important: squid security update (Oracle Linux 7)

[7:3.5.20-15.1] - Resolves: #1828359 - CVE-2020-11945 squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution - Resolves: #1828360 - CVE-2019-12519 squid: improper check for new member in ESIExpression::E…

May 7, 2020
Critical

ELSA-2020-2037 4 CVEs

Critical: firefox security update (Oracle Linux 7)

[68.8.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file * Wed Apr 29 2020 Jan Horak <jhorak@redhat.com> - Update t…

May 7, 2020
High max 7.9

ELSA-2020-5671 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.45.1] - HID: hiddev: do cleanup in failure of opening a device (Hillf Danton) [Orabug: 31206361] {CVE-2019-19527} - HID: hiddev: avoid opening a disconnected device (Hillf Danton) [Orabug: 31206361] {CVE-2019-19527} - HID: Fix assumptio…

May 7, 2020
High max 7.8

ELSA-2020-1933 1 CVE

Important: targetcli security update (Oracle Linux 8)

[2.1.51-4] - Increase the release version [2.1.51-3] - targetclid.sock allows unprivileged user to execute commands [2.1.51-2] - Create the target/pr directory when installing the package

May 7, 2020
High max 4.0

ELSA-2020-1980 1 CVE

Important: git security update (Oracle Linux 8)

[2.18.4-2] - Update to release 2.18.4 - Resolves: CVE-2020-11008

May 7, 2020
Medium

ELSA-2020-1998 1 CVE

Moderate: gnutls security update (Oracle Linux 8)

[3.6.8-10] - Fix CVE-2020-11501 (#1826176)

May 7, 2020
High max 7.9

ELSA-2020-5670 18 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.39.1] - qla2xxx: Update driver version to 9.00.00.00.42.0-k1-v2 (Arun Easi) [Orabug: 30372266] - qla2xxx: Fix device discovery when FCP2 device is lost. (Arun Easi) [Orabug: 30372266] - brcmfmac: add subtype check for event handling in data path (…

May 6, 2020
Medium

ELSA-2020-1576 1 CVE

Moderate: memcached security update (Oracle Linux 8)

[0:1.5.9-3] - fix null-pointer dereference in 'lru mode' and 'lru temp_ttl' (#1709408) - CVE-2019-11596

May 5, 2020
Medium

ELSA-2020-1598 6 CVEs

Moderate: libreoffice security and bug fix update (Oracle Linux 8)

[6.0.6.1-20.0.1.el8] - Replaced RedHat colors with Oracle colors, and the filename redhat.soc with oracle.soc in specfile - Build with --with-vendor='Oracle America, Inc.' [1:6.0.6.1-20] - Resolves: rhbz#1743958 CVE-2019-9849, etc. - Resolves: rhbz#1648281 Ju…

May 5, 2020
Medium

ELSA-2020-1852 1 CVE

Moderate: patch security and bug fix update (Oracle Linux 8)

[2.7.6-11] - Related: #1733565, apply the patch correctly [2.7.6-10] - CVE-2019-13636 , Dont follow symlinks unless --follow-symlinks is given - Resolves: #1665928, patch has a huge error output and segfaults when the file to be patched does not exist

May 5, 2020
Medium

ELSA-2020-1600 1 CVE

Moderate: evolution security and bug fix update (Oracle Linux 8)

evolution [3.28.5-12] - Add patch for RH bug #1778799 (New Mail account wizard ignores email address change) [3.28.5-11] - Update patch for RH bug #1764563 (CVE-2018-15587: Reposition signature bar) [3.28.5-10] - Add patch for RH bug #1764563 (CVE-2018-15587:…

May 5, 2020
Medium

ELSA-2020-1659 1 CVE

Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 8)

[6.3.6-1] - add weak depenency on grafana-pcp - add patch to mute shellcheck SC1090 for grafana-cli - update to 6.3.6 upstream community sources, see CHANGELOG [6.3.5-1] - drop uaparser patch now its upstream - add xerrors patch, see https://github.com/golang…

May 5, 2020
Medium max 7.5

ELSA-2020-1735 1 CVE

Moderate: dpdk security, bug fix, and enhancement update (Oracle Linux 8)

[19.11-4] - Remove MLX{4,5} glue libraries since RHEL 8 ships the correct libibverbs library. (#1805140) [19.11-3] - Remove /usr/share/dpdk/mk/exec-env/{bsd,linux}app symlinks (#1773889) [19.11-2] - Add pretrans to handle /usr/share/dpdk/mk/exec-env/{bsd,linu…

May 5, 2020
Low

ELSA-2020-1787 1 CVE

Low: unzip security update (Oracle Linux 8)

[6.0-43] - Update the man page with the new exit code introduced in 6.0-42 - Related: CVE-2019-13232 [6.0-42] - Fix CVE-2019-13232 - Resolves: CVE-2019-13232

May 5, 2020
Medium

ELSA-2020-1810 7 CVEs

Moderate: sqlite security and bug fix update (Oracle Linux 8)

[3.26.0-6] - Fixed issues found by covscan [3.26.0-5] - Fixed CVE-2019-13752 (#1786529) - Fixed CVE-2019-13753 (#1786535) - Fixed CVE-2019-13734 (#1786509) - Fixed CVE-2019-19924 (#1789776) - Fixed CVE-2019-19923 (#1789812) - Fixed CVE-2019-19925 (#1789808) -…

May 5, 2020
Low

ELSA-2020-1765 2 CVEs

Low: cups security and bug fix update (Oracle Linux 8)

[1:2.2.6-33] - fix more memory leaks found by coverity in 1775668 [1:2.2.6-32] - fix covscan issues raised by 1775668 [1:2.2.6-31] - 1775668 - cupsd eats a lot of memory when lots of queue with extensive PPDs are created [1:2.2.6-30] - 1774462 - CVE-2019-8675…

May 5, 2020
Medium max 6.3

ELSA-2020-1766 5 CVEs

Moderate: GNOME security, bug fix, and enhancement update (Oracle Linux 8)

accountsservice [0.6.50-8] - Dont set HasNoUsers=true if realmd has providers Related: #1750516 appstream-data [8-20191129] - Regenerate the RHEL metadata to include the latest evince changes - Resolves: #1768461 clutter [1.26.2-8] - rebuild to get the new in…

May 5, 2020
Medium max 9.8

ELSA-2020-1792 3 CVEs

Moderate: curl security update (Oracle Linux 8)

[7.61.1-12] - double free due to subsequent call of realloc() (CVE-2019-5481) - fix heap buffer overflow in function tftp_receive_packet() (CVE-2019-5482) - fix TFTP receive buffer overflow (CVE-2019-5436)

May 5, 2020
Low

ELSA-2020-1686 1 CVE

Low: libmspack security and bug fix update (Oracle Linux 8)

[0.7-0.2.alpha.4] - Fix for CVE-2019-1010305 - Remove 'fix' for CVE-2018-14680 as this fix is included in base tar ball. resolves: rhbz#1736745, rhbz#1736743 [0.7-0.2.alpha.3] - Add gating tests resolves: rhbz#1682770

May 5, 2020
Medium

ELSA-2020-1665 3 CVEs

Moderate: qt5 security, bug fix, and enhancement update (Oracle Linux 8)

python-qt5 [5.13.1-1] - 5.13.1 Resolves: bz#1775603 qgnomeplatform [0.4-3] - Rebuild (qt5) Resolves: bz#1774418 qt5 [5.12.5-3] - Re-add srpm macros, just leave them empty Resolves: bz#1733133 [5.12.5-2] - Drop srpm macros as we dont ship qtwebengine Resolves:…

May 5, 2020
Medium

ELSA-2020-1880 1 CVE

Moderate: ibus and glib2 security and bug fix update (Oracle Linux 8)

[2.56.4-8] - Backport patches for GDBus auth Resolves: #1777213

May 5, 2020
Medium max 9.8

ELSA-2020-1916 4 CVEs

Moderate: python-pip security update (Oracle Linux 8)

[9.0.3-16] - Add four new patches for CVEs in bundled urllib3 and requests CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074 Resolves: rhbz#1649153 Resolves: rhbz#1700824 Resolves: rhbz#1702473 Resolves: rhbz#1643829

May 5, 2020
Medium max 7.5

ELSA-2020-1913 1 CVE

Moderate: e2fsprogs security, bug fix, and enhancement update (Oracle Linux 8)

[1.45.4-3] - Fix clang warning introduced in previous release (#1783777) [1.45.4-2] - Fix ABI breakage introduced in previous release (#1783777) [1.45.4-1] - Rebase to the release 1.45.4 (#1783777) - provide rhel6/7 compatible fs_type in mke2fs.conf (#1780279…

May 5, 2020
Medium

ELSA-2020-1660 1 CVE

Moderate: mod_auth_mellon security and bug fix update (Oracle Linux 8)

[0.14.0-11] - Resolves: rhbz#1731053 - CVE-2019-13038 mod_auth_mellon: an Open Redirect via the login?ReturnTo= substring which could facilitate information theft [rhel-8] [0.14.0-10] - Resolves: rhbz#1761774 - mod_auth_mellon fix for AJAX header name X-Reque…

May 5, 2020
Medium

ELSA-2020-1921 1 CVE

Moderate: fontforge security update (Oracle Linux 8)

[20170731-14] - Resolves:rh#1790974 - CVE-2020-5395:out-of-bounds write in sfd.c

May 5, 2020
Medium

ELSA-2020-1636 2 CVEs

Moderate: libsndfile security update (Oracle Linux 8)

[1.0.28-10] - fix CVE-2018-19661 and CVE-2018-19662 - buffer over-read in the function i2alaw_array in alaw (#1673085) [1.0.28-9] - fix CVE-2018-13139 - stack-based buffer overflow in sndfile-deinterleave utility (#1598482)

May 5, 2020
Medium

ELSA-2020-1688 1 CVE

Moderate: libtiff security update (Oracle Linux 8)

[4.0.9-17] - Add upstream test suite and enable it in gating [4.0.9-16] - Fix CVE-2019-14973 (#1755705)

May 5, 2020
Medium max 5.3

ELSA-2020-1764 2 CVEs

Moderate: python3 security and bug fix update (Oracle Linux 8)

[3.6.8-23.0.1.el8] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8-23] - Modify the test suite to better handle disabled SSL/TLS versions and FIPS mode - Use OpenSSLs DRBG and disable os.getrandom() function in FIPS mode Resolves: rhb…

May 5, 2020
Medium max 6.5

ELSA-2020-1827 2 CVEs

Moderate: libxml2 security update (Oracle Linux 8)

[2.9.7-7.0.1] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [2.9.7-7] - Fix CVE-2018-14404 (#1595989) [2.9.7-6] - Fix CVE-2018-9251 (#1565322)

May 5, 2020
Medium max 6.5

ELSA-2020-1878 3 CVEs

Moderate: samba security, bug fix, and enhancement update (Oracle Linux 8)

openchange [2.3-24.0.1] - Add patch to build against samba 4.11 [2.3-24] - Rebuild for newer samba and libldb samba [4.11.2-13] - resolves: #1802182 - Fix join using netbios name [4.11.2-12] - related: #1781232 - Improve debug output of smbclient - resolves: …

May 5, 2020
Medium

ELSA-2020-1712 1 CVE

Moderate: edk2 security, bug fix, and enhancement update (Oracle Linux 8)

[20190829git37eef91017ad-9.el8] - edk2-OvmfPkg-QemuVideoDxe-unbreak-secondary-vga-and-bochs.patch [bz#1806359] - Resolves: bz#1806359 (bochs-display cannot show graphic wihout driver attach) [20190829git37eef91017ad-8.el8] - edk2-MdeModulePkg-Enable-Disable-S…

May 5, 2020
Low max 3.7

ELSA-2020-1715 1 CVE

Low: dnsmasq security, bug fix, and enhancement update (Oracle Linux 8)

[2.79-11] - Support multiple static leases for single mac on IPv6 (#1779187) [2.79-10] - Fix memory leak in helper.c (#1795370) [2.79-9] - Fix replies to non-recursive queries (#1700916) [2.79-8] - Fix dhcp_lease_time (#1746411) [2.79-7] - Fix TCP queries aft…

May 5, 2020