Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

  • Medium
    ELSA-2020-1011 1 CVE

    Moderate: expat security update (Oracle Linux 7)

    [2.1.0-11] - add security fix for CVE-2015-2716

  • Medium
    ELSA-2020-1047 7 CVEs

    Moderate: wireshark security and bug fix update (Oracle Linux 7)

    [1.10.14-24.0.1] - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect [1.10.14-24] - Related: #1613034 - Typo in the previous patch discovered by covscan [1.10.14-23] - Related: #1613034 - Fixing an infinite loop created by previous upd…

  • Medium max 8.1
    ELSA-2020-1080 2 CVEs

    Moderate: evolution security and bug fix update (Oracle Linux 7)

    atk [2.28.1-2] - Remove patch to fix invalid unref at atk_gobject_accessible_object_gone_cb() - Resolves: #1753123 evolution [3.28.5-8] - Update patch for RH bug #1686408 (CVE-2018-15587: Reposition signature bar) [3.28.5-7] - Add patch for RH bug #1686408 (C…

  • Medium max 6.1
    ELSA-2020-1091 1 CVE

    Moderate: python-twisted-web security update (Oracle Linux 7)

    [12.1.0-6] - Fix CVE-2019-12387 (HTTP Header Injection) Resolves: rhbz#1721518

  • Medium
    ELSA-2020-1068 3 CVEs

    Moderate: squid security and bug fix update (Oracle Linux 7)

    [7:3.5.20-15] - Resolves: #1690551 - Squid cache_peer DNS lookup failed when not all lower case - Resolves: #1680022 - squid cant display download/upload packet size for HTTPS sites - Resolves: #1717430 - Excessive memory usage when running out of descriptors…

  • Medium
    ELSA-2020-1151 7 CVEs

    Moderate: libreoffice security and bug fix update (Oracle Linux 7)

    [1:5.3.6.1-24.0.1] - Replaced RedHat colors with Oracle colors, and the filename redhat.soc with oracle.soc in specfile - Build with --with-vendor='Oracle America, Inc.' [1:5.3.6.1-24] - Resolves: rhbz#1728763 bg of blocks is black [1:5.3.6.1-23] - Resolves: …

  • High max 7.5
    ELSA-2020-5662 1 CVE

    Important: tcpdump security update (Oracle Linux 7)

    [4.9.2-4.0.1.el7_7.1] - Fix [CVE-2018-14468] [Orabug: 30480183]

  • Medium
    ELSA-2020-1074 5 CVEs

    Moderate: poppler and evince security update (Oracle Linux 7)

    evince [3.28.2-9] - Handle failure from TIFFReadRGBAImageOriented - Resolves: #1717352 poppler [0.26.5-42] - Fix potential integer overflow and check length for negative values - Resolves: #1757283 [0.26.5-41] - Ignore dict Length if it is broken - Resolves: …

  • Low
    ELSA-2020-1175 1 CVE

    Low: taglib security update (Oracle Linux 7)

    [1.8-8.20130218git] - Fixed OOB read when loading invalid ogg flac file Resolves: bz#1585260

  • Low
    ELSA-2020-1034 1 CVE

    Low: doxygen security and bug fix update (Oracle Linux 7)

    [1:1.8.5-4] - Resolves: #1483569, incorrect processing of code blocks - Resolves: #1724173 - CVE-2016-10245, cross-site scripting

  • Medium
    ELSA-2020-1113 1 CVE

    Moderate: bash security update (Oracle Linux 7)

    [4.2.46-34] - BASH_CMD should not be writable in restricted shell Resolves: #1693181

  • Medium
    ELSA-2020-1126 1 CVE

    Moderate: mutt security update (Oracle Linux 7)

    [5:1.5.21-29] - Fix IMAP header caching path traversal vulnerability - Resolves: #1608011 - Resolves: CVE-2018-14355

  • Low max 7.8
    ELSA-2020-1020 1 CVE

    Low: curl security and bug fix update (Oracle Linux 7)

    [7.29.0-57.0.1] - Fix TFTP small blocksize heap buffer overflow (https://curl.haxx.se/docs/CVE-2019-5482.html)[CVE-2019-5482][Orabug: 30568724] - Security Fixes [OraBug: 28939992] - CVE-2016-8615 cookie injection for other servers (https://curl.haxx.se/docs/C…

  • Low max 9.1
    ELSA-2020-1176 1 CVE

    Low: avahi security update (Oracle Linux 7)

    [0.6.31-20] - multicast DNS no longer responds to unicast queries outside of local network (#1663410)

  • Medium
    ELSA-2020-1189 1 CVE

    Moderate: libqb security update (Oracle Linux 7)

    [1.0.1-9] Also add O_EXCL to log_blackbox.c when creating files Resolves: rhbz#1714853 [1.0.1-8] Improve socket security Resolves: rhbz#1714853

  • Medium max 5.3
    ELSA-2020-1131 2 CVEs

    Moderate: python security update (Oracle Linux 7)

    [2.7.5-88.0.1] - Add Oracle Linux distribution in platform.py [orabug 20812544] [2.7.5-88] - Security fix for CVE-2019-16056 Resolves: rhbz#1750773 [2.7.5-87] - Fix CVE-2018-20852 Resolves: rhbz#1741551

  • Low
    ELSA-2020-1138 1 CVE

    Low: gettext security and bug fix update (Oracle Linux 7)

    [0.19.8.1-3] - fix CVE-2018-18751: double-free in xgettext (rhbz#1648433)

  • Low max 4.7
    ELSA-2020-1135 1 CVE

    Low: polkit security and bug fix update (Oracle Linux 7)

    [0.112-26.0.1] - Increase timeout to avoid defunct processes [Orabug: 26930744] [0.112-26] - Refined upstream fix of CVE-2018-1116 to avoid ABI changes - Related: rhbz#1601411 [0.112-25] - fix of CVE-2018-1116 - Resolves: rhbz#1601411 [0.112-24] - pkttyagent:…

  • Medium max 5.3
    ELSA-2020-1045 1 CVE

    Moderate: lftp security update (Oracle Linux 7)

    [4.4.8-12] - Resolves: #1611641 - CVE-2018-10916 lftp: particular remote file names may lead to current working directory erased

  • Medium
    ELSA-2020-1178 1 CVE

    Moderate: zziplib security update (Oracle Linux 7)

    [0.13.62-12] - Fix a directory traversal bug - unzip-mem should now strip all '../' prefixes from the archived files - Resolves: CVE-2018-17828

  • High
    ELSA-2020-1293 1 CVE

    Important: nodejs:12 security update (Oracle Linux 8)

    nodejs [1:12.16.1-2] - Fix CVE-2020-10531 [1:12.16.1-1] - Resolves: RHBZ#1800393, RHBZ#1800394, RHBZ#1800380 - Rebase to 12.16.1 [1:12.14.1-1] - Rebase to 12.14.1 [1:12.13.1-1] - Resolves: RHBZ# 1773503, update to 12.13.1 - minor clean up and sync with Fedora…

  • Critical
    ELSA-2020-1288 1 CVE

    Critical: haproxy security update (Oracle Linux 8)

    [1.8.15-6.1] - - Fix hapack zero byte input causing overwrite (CVE-2020-11100, #1819518) [1.8.15-6] - Add gating tests (#1682106)

  • High max 7.7
    ELSA-2020-0984 1 CVE

    Important: ipmitool security update (Oracle Linux 7)

    [0:1.8.18-9] - Disable -fstrict-aliasing (RPMDiff issue) [0:1.8.18-8] - Backport fix for CVE-2020-5208

  • High max 8.8
    ELSA-2020-0913 1 CVE

    Important: libvncserver security update (Oracle Linux 7)

    [0.9.9-14] - Fix CVE-2019-15690 (an integer overflow in HandleCursorShape() in a client) (bug #1814339)

  • High max 7.7
    ELSA-2020-0981 1 CVE

    Important: ipmitool security update (Oracle Linux 8)

    [1.8.18-12] - Disable -fstrict-aliasing (RPMDiff issue) [1.8.18-11] - Backport fix for CVE-2020-5208

  • High max 8.8
    ELSA-2020-0920 1 CVE

    Important: libvncserver security update (Oracle Linux 8)

    [0.9.11-9.2] - Enable gating (bug #1681199) [0.9.11-9.1] - Fix CVE-2019-15690 (an integer overflow in HandleCursorShape() in a client) (bug #1814342)

  • High
    ELSA-2020-0919 7 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [68.6.0-1.0.1.el8_1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.6.0-1] - Update to 68.6.0 build2

  • High max 9.8
    ELSA-2020-0855 1 CVE 1 exploited

    Important: tomcat security update (Oracle Linux 7)

    [0:7.0.76-11] - Resolves: rhbz#1806801 CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability

  • High
    ELSA-2020-0905 7 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [68.6.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [68.6.0-1] - Update to 68.6.0 build2

  • High
    ELSA-2020-0903 1 CVE

    Important: zsh security update (Oracle Linux 8)

    [5.5.1-6.el8_1.2] - improve printing of error messages introduced by the fix of CVE-2019-20044 [5.5.1-6.el8_1.1] - drop privileges securely when unsetting PRIVILEGED option (CVE-2019-20044)

  • High
    ELSA-2020-0902 1 CVE

    Important: icu security update (Oracle Linux 8)

    [60.3-2] - Apply ICU-13634-Adding-integer-overflow-logic-to-ICU4C-num.patch - Apply ICU-20958-Prevent-SEGV_MAPERR-in-append.patch - Resolves: rhbz#1808238

  • High max 5.5
    ELSA-2020-0834 3 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

    [3.10.0-1062.18.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] [3.10.0-1062.18.1] - [x86] x86/b…

  • High
    ELSA-2020-0897 1 CVE

    Important: icu security update (Oracle Linux 7)

    [50.2-4] - Apply ICU-13634-Adding-integer-overflow-logic-to-ICU4C-num.patch - Apply ICU-20958-Prevent-SEGV_MAPERR-in-append.patch - Resolves: rhbz#1808235

  • Medium max 9.8
    ELSA-2020-0850 4 CVEs

    Moderate: python-pip security update (Oracle Linux 7)

    [9.0.3-7] - Bump Resolves: rhbz#1649153 Resolves: rhbz#1700824 Resolves: rhbz#1702473 Resolves: rhbz#1643829 [9.0.3-6] - Add four new patches for CVEs in bundled urllib3 and requests CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074 Resolves: rhb…

  • Medium max 9.8
    ELSA-2020-0851 3 CVEs

    Moderate: python-virtualenv security update (Oracle Linux 7)

    [15.1.0-4] - Bump Resolves: rhbz#1649153 Resolves: rhbz#1700824 Resolves: rhbz#1643829 [15.1.0-3] - Add three new patches for CVEs in bundled urllib3 and requests CVE-2018-20060, CVE-2019-11236, CVE-2018-18074 Resolves: rhbz#1649153 Resolves: rhbz#1700824 Res…

  • High
    ELSA-2020-0853 1 CVE

    Important: zsh security update (Oracle Linux 7)

    [5.0.2-34.el7_7.2] - improve printing of error messages introduced by the fix of CVE-2019-20044 [5.0.2-33.el7_7.1] - drop privileges securely when unsetting PRIVILEGED option (CVE-2019-20044)

  • High
    ELSA-2020-0815 7 CVEs

    Important: firefox security update (Oracle Linux 7)

    [68.6.0-1.0.1] - Remove upstream references [Orabug: 30143292] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file * Wed Mar 04 2020 Jan Horak <jhorak@redhat.com> - Update t…

  • High max 7.7
    ELSA-2020-5576 3 CVEs

    Important: qemu security update (Oracle Linux 7)

    [15:3.1.0-7.el7] - qemu-img: Add --target-is-zero to convert (David Edmondson) [15:3.1.0-6.el7] - qemu.spec: Remove 'BuildRequires: kernel' (Karl Heubaum) [Orabug: 30858754] - target/i386: add support for MSR_IA32_TSX_CTRL (Paolo Bonzini) [Orabug: 30652327] -…

  • High
    ELSA-2020-0820 7 CVEs

    Important: firefox security update (Oracle Linux 8)

    [68.6.0-1.0.1.el8_1] - Rebuild to pickup Oracle default bookmarks [Orabug: 30069264] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Remove upstream references [Orabug: 30530527] [68.6.0-1.0.1] - Update to 68.6.0 build1 [68.5…

  • High max 8.8
    ELSA-2020-5569 5 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.14.35-1902.11.3] - xfs: do async inactivation only when fs freezed (Junxiao Bi) [Orabug: 31013775] [4.14.35-1902.11.2] - ib/core: Cancel fmr delayed_worker when in shutdown phase of reboot system (Hans Westgaard Ry) [Orabug: 30967501] - Revert 'printk: Def…