Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

High

ELSA-2020-1379 1 CVE

Important: container-tools:ol8 security and bug fix update (Oracle Linux 8)

buildah [1.11.6-6.0.1] - Fixes troubles with oracle registry login [Orabug: 29937283] [1.11.6-6] - fix COPY command takes long time with buildah - Resolves: #1806119 [1.11.6-5] - fix Podman support for FIPS Mode requires a bind mount inside the container - Re…

Apr 15, 2020
High max 7.7

ELSA-2020-1358 2 CVEs

Important: virt:ol security and bug fix update (Oracle Linux 8)

qemu-kvm [2.12.0-88.0.1.el8_1_0.3] - Added bug30251155-remove-upstream-reference [Orabug: 30251155] [2.12.0-88.el8_1_0.3] - kvm-tcp_emu-Fix-oob-access.patch [bz#1791565] - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791565] - kvm-slirp-…

Apr 15, 2020
High

ELSA-2020-5649 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.301.1] - vhost: Check docket sk_family instead of call getname (Eugenio Perez) [Orabug: 31085991] {CVE-2020-10942} - uek-rpm: config-mips64-embedded misc pruning (Eric Saint-Etienne) [Orabug: 31079017] - ubifs: Check for name being NULL while mo…

Apr 13, 2020
Critical max 8.1

ELSA-2020-1338 2 CVEs 2 exploited

Critical: firefox security update (Oracle Linux 7)

[68.6.1-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [68.6.1-1] - Update to 68.6.1 ESR

Apr 11, 2020
High

ELSA-2020-1420 3 CVEs

Important: firefox security update (Oracle Linux 7)

[68.7.0-2.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [68.7.0-2] - Update to 68.7.0 build3

Apr 11, 2020
High

ELSA-2020-1334 1 CVE

Important: telnet security update (Oracle Linux 7)

[1:0.17-65] - Resolves: #1814475 - Arbitrary remote code execution in utility.c via short writes or urgent data

Apr 11, 2020
High

ELSA-2020-1208 1 CVE

Important: qemu-kvm security update (Oracle Linux 7)

[1.5.3-173.el7_8.1] - kvm-util-add-slirp_fmt-helpers.patch [bz#1798970] - kvm-tcp_emu-fix-unsafe-snprintf-usages.patch [bz#1798970] - Resolves: bz#1798970 (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.8.z])

Apr 10, 2020
High

ELSA-2020-5644 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.44.1] - net: qlogic: Fix memory leak in ql_alloc_large_buffers (Navid Emamdoost) [Orabug: 31055328] {CVE-2019-18806} - swiotlb: clean up reporting (Kees Cook) [Orabug: 31085018] {CVE-2018-5953}

Apr 10, 2020
Medium

ELSA-2020-1372 4 CVEs

Moderate: kernel security and bug fix update (Oracle Linux 8)

[4.18.0-147.8.1_1.OL8] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] [4.18.0-147.8.1_1] - rebu…

Apr 9, 2020
High

ELSA-2020-1406 3 CVEs

Important: firefox security update (Oracle Linux 8)

[68.7.0-2.0.1.el8_1] - Rebuild to pickup Oracle default bookmarks [Orabug: 30069264] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Remove upstream references [Orabug: 30530527] [68.7.0-2] - Update to 68.7.0 build3 [68.6.1-1…

Apr 9, 2020
Critical max 8.1

ELSA-2020-1341 2 CVEs 2 exploited

Critical: firefox security update (Oracle Linux 8)

[68.6.1-1.0.1.el8_1] - Rebuild to pickup Oracle default bookmarks [Orabug: 30069264] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Remove upstream references [Orabug: 30530527] [68.6.1-1] - Update to 68.6.1 ESR

Apr 9, 2020
High

ELSA-2020-5642 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.38.1] - rds: transport module should be auto loaded when transport is set (Rao Shoaib) [Orabug: 31031928] - KVM: X86: Fix NULL deref in vcpu_scan_ioapic (Wanpeng Li) [Orabug: 31078882] - vhost: Check docket sk_family instead of call getname (Eugen…

Apr 8, 2020
High

ELSA-2020-1318 1 CVE

Important: telnet security update (Oracle Linux 8)

[1:0.17-73.1] - Resolves: #1814473 - Arbitrary remote code execution in utility.c via short writes or urgent data

Apr 7, 2020
Medium

ELSA-2020-1037 1 CVE

Moderate: advancecomp security update (Oracle Linux 7)

[1.15-22] - Resolves: #1686115, integer overflow in png_compress [1.15-21] - Resolves: #1711051, CVE-2019-8383 denial of service - Resolves: #1710910, CVE-2019-8379 null pointer dereference [1.15-20] - Mass rebuild 2014-01-24 [1.15-19] - Mass rebuild 2013-12-…

Apr 6, 2020
Medium max 6.5

ELSA-2020-1054 2 CVEs

Moderate: mailman security and bug fix update (Oracle Linux 7)

[3:2.1.15-30] - Resolves: #1599692 - Sanitize input on listinfo page (CVE-2018-0618) [3:2.1.15-29] - Resolves: #1611689 - Trim long text in 'no such list' messages [3:2.1.15-28] - Resolves: #1718180 - Try to decode member name first [3:2.1.15-27] - Related : …

Apr 6, 2020
Medium max 8.8

ELSA-2020-1062 2 CVEs

Moderate: dovecot security and bug fix update (Oracle Linux 7)

[1:2.2.36-6] - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes (#1741787) [1:2.2.36-5] - fix CVE-2019-3814: improper certificate validation (#1674369)…

Apr 6, 2020
Low

ELSA-2020-1167 1 CVE

Low: nbdkit security and bug fix update (Oracle Linux 7)

[1.8.0-3] - Fix for CVE-2019-14850 denial of service due to premature opening of back-end connection resolves: rhbz#1757261 [1.8.0-2] - Explicitly disable nbdkit-ext2-plugin in configure resolves: rhbz#1724242

Apr 6, 2020
Medium

ELSA-2020-1173 1 CVE

Moderate: okular security update (Oracle Linux 7)

[4.10.5-8] - Fix path traversal issue when extracting an .okular file Resolves: bz#1634726

Apr 6, 2020
Medium max 6.5

ELSA-2020-1084 2 CVEs

Moderate: samba security, bug fix, and enhancement update (Oracle Linux 7)

[4.10.4-10] - resolves: #1786324 - fix security level check for DsRGetForestTrustInformation [4.10.4-9] - resolves: #1764468 - Fix CVE-2019-10218 [4.10.4-8] - resolves: #1656541 - Fix join using netbios name [4.10.4-7] - resolves: #1657428 - Fix spnego downgr…

Apr 6, 2020
Low max 4.5

ELSA-2020-1101 1 CVE

Low: bluez security update (Oracle Linux 7)

[5.44-6] - fixing CVE-2018-10910. Resolves: #1609340

Apr 6, 2020
Medium

ELSA-2020-1121 3 CVEs

Moderate: httpd security, bug fix, and enhancement update (Oracle Linux 7)

[2.4.6-93.0.1] - replace index.html with Oracles index page oracle_index.html [2.4.6-93] - Resolves: #1677496 - CVE-2018-17199 httpd: mod_session_cookie does not respect expiry time [2.4.6-92] - htpasswd: add SHA-2 crypt() support (#1486889) [2.4.6-91] - Reso…

Apr 6, 2020
Medium max 5.3

ELSA-2020-1132 2 CVEs

Moderate: python3 security update (Oracle Linux 7)

[3.6.8-13.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8-13] - Security fix for CVE-2019-16056 Resolves: rhbz#1750774 [3.6.8-12] - Add support for OpenSSL FIPS mode - Fix faulthandler stack size Resolves: rhbz#1732908 [3.6.8-11]…

Apr 6, 2020
Medium

ELSA-2020-1112 4 CVEs

Moderate: php security update (Oracle Linux 7)

[5.4.16-48] - fix underflow in env_path_info in fpm_main.c CVE-2019-11043 [5.4.16-47] - fix stack-buffer-overflow while parsing HTTP response CVE-2018-7584 - fix out-of-bounds read in base64_decode_xmlrpc CVE-2019-9024 - fix reflected XSS in phar 404 page CVE…

Apr 6, 2020
Low

ELSA-2020-1181 1 CVE

Low: unzip security update (Oracle Linux 7)

[6.0-21] - Fix CVE-2019-13232 - Resolves: CVE-2019-13232

Apr 6, 2020
Medium

ELSA-2020-1100 4 CVEs

Moderate: mariadb security and bug fix update (Oracle Linux 7)

[1:5.5.65-1] - Rebase to 5.5.65 Also fixes: CVE-2019-2737 CVE-2019-2739 CVE-2019-2740 CVE-2019-2805 Resolves: #1741357 - Revert upstream changes that make the mysql_install_db relocatable because it broke mysql_install_db when run without --rpm arg Resolves: …

Apr 6, 2020
Medium max 4.8

ELSA-2020-1021 1 CVE

Moderate: GNOME security, bug fix, and enhancement update (Oracle Linux 7)

accountsservice [0.6.50-7] - version bump to prevent future update path introduced by RHBA-2019:45836 Resolves: #1721562 colord [1.3.4-2] - Downgrade a trivial warning to a debug statement - Resolves: #1421231 control-center [3.28.1-6] - Calculate better exte…

Apr 6, 2020
Medium

ELSA-2020-1003 1 CVE

Moderate: mod_auth_mellon security and bug fix update (Oracle Linux 7)

[0.14.0-8] - Resolves: rhbz#1731052 - CVE-2019-13038 mod_auth_mellon: an Open Redirect via the login?ReturnTo= substring which could facilitate information theft [rhel-7] [0.14.0-7] - Resolves: rhbz#1727789 - mod_auth_mellon fix for AJAX header name X-Request…

Apr 6, 2020
Medium max 7.5

ELSA-2020-1061 3 CVEs

Moderate: bind security and bug fix update (Oracle Linux 7)

[32:9.11.4-16.P2] - Finish dig query when name is too long (#1743572) [32:9.11.4-15.P2] - Stop listening on IPv6 by default (#1753259) [32:9.11.4-14.P2] - Limit number of queries per TCP connection (CVE-2019-6477) [32:9.11.4-13.P2] - Revert not searching name…

Apr 6, 2020
High

ELSA-2020-1116 1 CVE

Important: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 7)

[1.5.3-173.el7] - kvm-tcp_emu-Fix-oob-access.patch [bz#1791560] - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791560] - kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791560] - Resolves: bz#1791560 (CVE-2020-7039 qemu-kv…

Apr 6, 2020
Medium

ELSA-2020-1185 1 CVE

Moderate: libsndfile security update (Oracle Linux 7)

[1.0.25-11] - fix CVE-2018-13139 - stack-based buffer overflow in sndfile-deinterleave utility (#1598577)

Apr 6, 2020
Medium

ELSA-2020-1000 2 CVEs

Moderate: rsyslog security, bug fix, and enhancement update (Oracle Linux 7)

[8.24.0-52] RHEL 7.8 ERRATUM - edited patch file ID for imfile to not log useless errors also improved file-id behavior to adress newly found problems resolves: rhbz#1763746 [8.24.0-49] RHEL 7.8 ERRATUM - fixed fsync patch to actually revognize the new option…

Apr 6, 2020
Medium

ELSA-2020-1050 3 CVEs

Moderate: cups security and bug fix update (Oracle Linux 7)

[1:1.6.3-43] - 1687571 - cupsd doesnt clean tmp files if client conn is terminated abnormally [1:1.6.3-42] - 1651575 - CVE-2018-4700 cups [1:1.6.3-41] - 1608764 - CVE-2018-4180 cups - 1607291 - CVE-2018-4181 cups

Apr 6, 2020
Medium max 7.9

ELSA-2020-1016 19 CVEs

Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 7)

[3.10.0-1127.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] [3.10.0-1127] - [fs] flexfiles: Dont …

Apr 6, 2020
Medium max 8.8

ELSA-2020-1190 6 CVEs

Moderate: libxml2 security update (Oracle Linux 7)

[2.9.1-6.0.1.4] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [2.9.1-6.4] - Fix CVE-2015-8035 (#1595697) - Fix CVE-2018-14404 (#1602817) - Fix CVE-2017-15412 (#1729857) - Fix CVE-2016-5131 (#1714050) - Fi…

Apr 6, 2020
Low

ELSA-2020-1022 1 CVE

Low: file security update (Oracle Linux 7)

[5.11-36] - fix out-of-bounds read via a crafted ELF file (CVE-2018-10360)

Apr 6, 2020
Medium max 7.5

ELSA-2020-1081 1 CVE

Moderate: net-snmp security and bug fix update (Oracle Linux 7)

[1:5.7.2-47] - revert calculation of free space (#1779609) [1:5.7.2-46] - fix sha224 and sha384 declaration check (#1774693) [1:5.7.2-45] - fix memory leak introduced by fix of snmp v3 traps forwarding (#1751195) [1:5.7.2-44] - add support for glusterfs (#131…

Apr 6, 2020
Medium

ELSA-2020-1172 6 CVEs

Moderate: qt security update (Oracle Linux 7)

[1:4.8.7-8] - Fix QImage allocation failure in qgifhandler Resolves: bz#1667863 - Fix QTgaFile CPU exhaustion Resolves: bz#1667879 - Fix QBmpHandler segmentation fault on malformed BMP file Resolves: bz#1667862 [1:4.8.7-7] - Fix crash when parsing malformed u…

Apr 6, 2020
Medium

ELSA-2020-1036 1 CVE

Moderate: texlive security update (Oracle Linux 7)

[2:2012-45.20130427_r30134] - Related: #1650521, buffer overflow in t1_check_unusual_charstring function [2:2012-44.20130427_r30134] - Resolves: #1650521, buffer overflow in t1_check_unusual_charstring function

Apr 6, 2020
Medium max 6.5

ELSA-2020-1180 73 CVEs

Moderate: ImageMagick security, bug fix, and enhancement update (Oracle Linux 7)

autotrace [0.31.1-38] - Resolves: #1765205 rebuild against new IM emacs [1:24.3-23] - Resolves: #1765208 rebuild against new IM ImageMagick [6.9.10.68-3] - Fixing freeze when svg file contains class='' [6.9.10.68-2] - Fixed ghostscript fonts, fixed multilib c…

Apr 6, 2020
Low

ELSA-2020-1051 1 CVE

Low: libosinfo security and bug fix update (Oracle Linux 7)

[1.1.0-5] - Resolves: rhbz#1740212 - New defect found in libosinfo-1.1.0-4.el7 [1.1.0-4] - Resolves: rhbz#1727842 - CVE-2019-13313 libosinfo: osinfo-install-script option leaks password via command line argument

Apr 6, 2020