Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

Critical

ELSA-2019-4111 5 CVEs

Critical: firefox security update (Oracle Linux 8)

[68.3.0-1.0.1] - Rebuild to pickup Oracle default bookmarks [Orabug: 30069264] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Remove upstream references [Orabug: 30530527] [68.3.0-1] - Update to 68.3.0 ESR [68.2.0-4] - Added…

Dec 5, 2019
High max 6.5

ELSA-2019-4867 3 CVEs

Important: microcode_ctl security update (Oracle Linux 7)

[2:2.1-53.3.0.4] - set early_microcode='no' in virtualized guests to avoid early load bugs [Orabug: 30618736] [2:2.1-53.3.0.1] - do not late load prior to 3.10.0 - ensure late loading fixes are present on 4.1.12-* and 4.14.35-* - enable early loading on 06-4f…

Dec 4, 2019
High max 8.1

ELSA-2019-4024 2 CVEs

Important: SDL security update (Oracle Linux 7)

[1.2.15-15] - Fix CVE-2019-13616 (a heap buffer over-read in BlitNtoN) (bug #1747237) - Resolves: rhbz#1756276

Dec 2, 2019
High max 6.5

ELSA-2019-3981 1 CVE

Important: 389-ds-base security and bug fix update (Oracle Linux 7)

[1.3.9.1-12] - Bump version to 1.3.9.1-12 - Resolves: Bug 1767622 - CleanAllRUV task limit not enforced [1.3.9.1-11] - Bump version to 1.3.9.1-11 - Resolves: Bug 1748198 - EMBARGOED CVE-2019-14824 389-ds-base: Read permission check bypass via the deref plugin…

Nov 27, 2019
Low

ELSA-2019-3976 1 CVE

Low: tcpdump security update (Oracle Linux 7)

[14:4.9.2-4.1] - Resolves: #1761349 - CVE-2018-19519 tcpdump: Stack-based buffer over-read in print-hncp.c

Nov 27, 2019
High max 7.5

ELSA-2019-3979 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1062.7.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] [3.10.0-1062.7.1] - [drm] drm/i91…

Nov 26, 2019
High

ELSA-2019-3951 1 CVE

Important: SDL security update (Oracle Linux 8)

[1.2.15-36] - Fix CVE-2019-13616 (a heap buffer over-read in BlitNtoN) (bug #1747237) - Resolves: rhbz#1756279

Nov 25, 2019
Critical max 8.7

ELSA-2019-3736 1 CVE 1 exploited

Critical: php:7.3 security update (Oracle Linux 8)

php [7.3.5-5] - fix underflow in env_path_info in fpm_main.c CVE-2019-11043

Nov 23, 2019
Critical max 8.7

ELSA-2019-3735 1 CVE 1 exploited

Critical: php:7.2 security update (Oracle Linux 8)

php [7.2.11-4] - fix underflow in env_path_info in fpm_main.c CVE-2019-11043

Nov 23, 2019
High max 6.5

ELSA-2019-3832 3 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-147.0.2_1.OL8] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] [4.18.0-147.0.2_1] - [drm…

Nov 22, 2019
High

ELSA-2019-3871 1 CVE

Important: kernel security update (Oracle Linux 8)

[4.18.0-147.0.3_1.OL8] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] [4.18.0-147.0.3_1] - [drm…

Nov 22, 2019
High

ELSA-2019-3694 1 CVE

Important: sudo security update (Oracle Linux 8)

[1.8.25p1-8] - RHEL-8.1.0 - fixed CVE-2019-14287 Resolves: rhbz#1760696

Nov 22, 2019
High max 7.3

ELSA-2019-3890 1 CVE

Important: ghostscript security update (Oracle Linux 8)

[9.25-5.1] - 1769342 - CVE-2019-14869 ghostscript: -dSAFER escape in .charkeys

Nov 22, 2019
Medium

ELSA-2019-3513 1 CVE

Moderate: glibc security, bug fix, and enhancement update (Oracle Linux 8)

[2.28-72.0.1] - add Ampere emag to tunable cpu list (Patrick McGehearty) - add optimized memset for emag - add an ASIMD variant of strlen for falkor - Orabug: 2700101. - Modify glibc-ora28849085.patch so it works with RHCK kernels. - Orabug: 28849085. - Make …

Nov 21, 2019
High max 6.5

ELSA-2019-4854 6 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.40.1] - USB: check usb_get_extra_descriptor for proper size (Mathias Payer) [Orabug: 30045797] {CVE-2018-20169} - scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE (Hannes Reinecke) [Orabug: 30393902] {CVE-2017-14991} - usb: misc…

Nov 20, 2019
High max 7.2

ELSA-2019-4850 16 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.33.4] - ocfs2: protect extent tree in ocfs2_prepare_inode_for_write() (Shuning Zhang) [Orabug: 30036349] - ocfs2: direct-IO: protect get_blocks (Junxiao Bi) [Orabug: 30036349] - SUNRPC: Remove xprt_connect_status() (Trond Myklebust) [Orabug: 30165…

Nov 20, 2019
High max 7.3

ELSA-2019-3888 1 CVE

Important: ghostscript security update (Oracle Linux 7)

[9.25-2.3] - 1769340 - CVE-2019-14869 ghostscript: -dSAFER escape in .charkeys

Nov 15, 2019
High max 6.5

ELSA-2019-3834 3 CVEs

Important: kernel security update (Oracle Linux 7)

[3.10.0-1062.4.2.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] [3.10.0-1062.4.2] - [drm] drm/i91…

Nov 14, 2019
High

ELSA-2019-3872 1 CVE

Important: kernel security update (Oracle Linux 7)

[3.10.0-1062.4.3.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] [3.10.0-1062.4.3] - [drm] drm/i91…

Nov 14, 2019
Medium max 9.8

ELSA-2019-3704 1 CVE

Moderate: numpy security update (Oracle Linux 8)

[1:1.14.3-9] - Fix CVE-2019-6446 resolves: #1668466 [1:1.14.3-8] - Rebuild with fixed gating.yaml related: #1687873 [1:1.14.3-7] - Fix broken float128 on all arches except x86_64 resolves: #1687873

Nov 14, 2019
Medium

ELSA-2019-3698 5 CVEs

Moderate: libarchive security and bug fix update (Oracle Linux 8)

[3.3.2-7] - fix use-after-free in delayed newc link processing (#1602575) - fix a few obvious resource leaks and strcpy() misuses (#1602575) [3.3.2-6] - fixed use after free in RAR decoder (#1700752) - fixed double free in RAR decoder (#1700753) [3.3.2-5] - r…

Nov 14, 2019
Medium

ELSA-2019-3419 1 CVE

Moderate: libtiff security update (Oracle Linux 8)

[4.0.9-15] - Fix DIVIDE_BY_ZERO in patch for CVE-2018-12900 (#1595579) [4.0.9-14] - Fix CVE-2018-12900 (#1595579)

Nov 14, 2019
Medium

ELSA-2019-3624 1 CVE

Moderate: libseccomp security, bug fix, and enhancement update (Oracle Linux 8)

[2.4.1-1] - rebase to 2.4.1 [2.3.3-4] - spec: make the check phase conditional

Nov 14, 2019
Medium

ELSA-2019-3497 1 CVE

Moderate: http-parser security and bug fix update (Oracle Linux 8)

[2.8.0-5] - Resolves: rhbz#1686488: 'make test' fails with stringop-overflow error [2.8.0-4] - Resolves: rhbz#1666382: CVE-2018-12121 http-parser: nodejs: Denial of Service with large HTTP headers [rhel-8] [2.8.0-3] - spec: make the check phase conditional

Nov 14, 2019
Medium max 9.1

ELSA-2019-3520 4 CVEs

Moderate: python3 security and bug fix update (Oracle Linux 8)

[3.6.8-15.1.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8-15.1] - Patch 329 (FIPS) modified: Added workaround for mod_ssl: Skip error checking in _Py_hashlib_fips_error Resolves: rhbz#1760106 [3.6.8-15] - Patch 329 that adds su…

Nov 14, 2019
Medium

ELSA-2019-3705 1 CVE

Moderate: libjpeg-turbo security update (Oracle Linux 8)

[1.5.3-10] - Fix CVE-2018-14498 (#1687477) [1.5.3-9] - Fix LDFLAGS (#1688397) [1.5.3-8] - Support running with Intel CET (#1688397)

Nov 14, 2019
High max 7.6

ELSA-2019-3517 22 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-147.OL8] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] [4.18.0-147] - [x86] perf/x86/i…

Nov 14, 2019
Medium max 6.5

ELSA-2019-3525 1 CVE

Moderate: dhcp security and bug fix update (Oracle Linux 8)

[12:4.3.6-34] - Resolves: #1704672 - Fix crash caused by bind rebase [12:4.3.6-33] - Resolves: #1673946 - Change default prefix length to 128 - Add address-prefix-lenght option to change default value - Fix backporting issues [12:4.3.6-31] - Resolves: #168556…

Nov 14, 2019
Medium max 7.1

ELSA-2019-3707 1 CVE

Moderate: dbus security update (Oracle Linux 8)

[1.12.8-9.0.1] - fix netlink poll: error 4 (Zhenzhong Duan) [1:1.12.8-9] - Ensure that patches are applied (#1725570) [1:1.12.8-8] - Fix CVE-2019-12749 (#1725570)

Nov 14, 2019
Medium max 7.7

ELSA-2019-3467 1 CVE

Moderate: dovecot security and bug fix update (Oracle Linux 8)

[1:2.2.36-10] - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes (#1741788) [1:2.2.36-9] - reset errno before iterating through users (#1630410) [1:2.2…

Nov 14, 2019
Medium max 7.1

ELSA-2019-3701 4 CVEs

Moderate: curl security and bug fix update (Oracle Linux 8)

[7.61.1-11] - rebuild with updated annobin to prevent Execshield RPMDiff check from failing [7.61.1-10] - fix SMTP end-of-response out-of-bounds read (CVE-2019-3823) - fix NTLMv2 type-3 header stack buffer overflow (CVE-2019-3822) - fix NTLM type-2 out-of-bou…

Nov 14, 2019
Medium max 5.8

ELSA-2019-3421 1 CVE

Moderate: mod_auth_mellon security, bug fix, and enhancement update (Oracle Linux 8)

[0.14.0-9] - Just bump the release number - Related: rhbz#1718238 - mod_auth_mellon-diagnostics RPM not in product listings [0.14.0-8] - Resolves: rhbz#1691894 - [RFE] Config option to change mod_auth_mellon prefix [0.14.0-7] - Apply the patch from the previo…

Nov 14, 2019
Low

ELSA-2019-3553 2 CVEs

Low: GNOME security, bug fix, and enhancement update (Oracle Linux 8)

accountsservice [0.6.50-7] - Dont send change updates for login history changes Resolves: #1713080 appstream-data [8-20190805] - Regenerate the RHEL metadata to include the latest cockpit changes - Resolves: #1673011 [8-20190719] - Regenerate the RHEL metadat…

Nov 14, 2019
Low

ELSA-2019-3575 5 CVEs

Low: elfutils security, bug fix, and enhancement update (Oracle Linux 8)

[0.176-5] - Add elfutils-0.176-strip-symbols-illformed.patch [0.176-4] - Add elfutils-0.176-elf-update.patch (#1717349) [0.176-3] - Rebuilt for annobin change. [0.176-2] - Add elfutils-0.176-xlate-note.patch (#1705138) [0.176-1] - New upstream release. - back…

Nov 14, 2019
Low max 4.3

ELSA-2019-3673 1 CVE

Low: lldpad security and bug fix update (Oracle Linux 8)

[1.0.1-13.git036e314] - After gating yml updates [1.0.1-12.git036e314] - Add support for DSCP selectors in APP TLVs (#1704660) [1.0.1-11.git036e314] - Fix memleak on TLV reception (#1727326) [1.0.1-10.git036e314] - Fix the OID display (#1614933)

Nov 14, 2019
Low max 5.3

ELSA-2019-3552 2 CVEs

Low: bind security and bug fix update (Oracle Linux 8)

[32:9.11.4-26.P2] - Permit explicit disabling of RSAMD5 in FIPS mode (#1737407) [32:9.11.4-25.P2] - Fix CVE-2018-5745 - Fix CVE-2019-6465 [32:9.11.4-24.P2] - Do not override random numbers provider in DHCP (#1668682) [32:9.11.4-23.P2] - Report errors on inval…

Nov 14, 2019
Low

ELSA-2019-3703 2 CVEs

Low: libvorbis security update (Oracle Linux 8)

[1.3.6-2] - Sync with git for CVE-2017-14160, CVE-2018-10392, CVE-2018-10393

Nov 14, 2019
Medium max 5.9

ELSA-2019-3600 2 CVEs

Moderate: gnutls security, bug fix, and enhancement update (Oracle Linux 8)

[3.6.8-8] - Use fallback random function for RSA blinding in FIPS selftests [3.6.8-7] - Fix deterministic signature creation in selftests [3.6.8-6] - Treat login error more gracefully when enumerating PKCS#11 tokens (#1705478) - Use deterministic ECDSA/DSA in…

Nov 14, 2019
Medium max 8.1

ELSA-2019-3699 1 CVE

Moderate: evolution security and bug fix update (Oracle Linux 8)

evolution [3.28.5-9] - Add patch for RH bug #1724984 ([ECompEditor] Ensure attendee changes stored before save) [3.28.5-8] - Add patch for RH bug #1724659 (Make sure intltool-merge cache is created only once) [3.28.5-7] - Add patch for RH bug #1724232 (Help C…

Nov 14, 2019
Medium

ELSA-2019-3706 1 CVE

Moderate: lua security and bug fix update (Oracle Linux 8)

[5.3.4-11] - Fix use after free in lua_upvaluejoin (#1670167)

Nov 14, 2019