Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

  • High max 7.8
    ELSA-2026-57149 1 CVE

    Important: ansible-core security update (Oracle Linux 9)

    [1:2.14.18-3.1] - Fix CVE-2026-11332 (prevent arbitrary git configuration via role requirements) (RHEL-194134)

  • Medium max 8.2
    ELSA-2026-500220 3 CVEs

    Moderate: qemu-kvm security update (Oracle Linux 9)

    [7.2.0-42.el9] - migration: Enable multifd VFIO device state transfer by default for Exadata (Maciej S. Szmigiero) [Orabug: 39783645] - vfio/migration: Add x-migration-load-config-after-iter VFIO property (Maciej S. Szmigiero) [Orabug: 39783615] - tests/9p: a…

  • High max 8.1
    ELSA-2026-56969 2 CVEs

    Important: php8.4 security, bug fix, and enhancement update (Oracle Linux 10)

    [8.4.24-2] - rebase to 8.4.24

  • High max 7.5
    ELSA-2026-56971 1 CVE

    Important: perl-Date-Manip security update (Oracle Linux 10)

    [6.94-5.1] - Fix CVE-2026-60075: prevent quadratic-cost regex DoS in date/time parsing by rejecting overly long input strings Resolves: RHEL-239790

  • Medium max 7.3
    ELSA-2026-57015 7 CVEs

    Moderate: glib2 security update (Oracle Linux 10)

    [2.80.4-21] - Fix CVE-2026-15588: limit D-Bus auth line read length [2.80.4-20] - Fix CVE-2026-58011: range validation in g_date_time_add_full() [2.80.4-19] - Fix CVE-2026-58012: buffer overflow in gregex.c with G_REGEX_RAW [2.80.4-18] - Fix CVE-2026-58010: o…

  • High max 7.5
    ELSA-2026-57126 1 CVE

    Important: yggdrasil security update (Oracle Linux 10)

    [0.4.9.2-2] - Rebuild yggdrasil against updated golang

  • Medium max 7.5
    ELSA-2026-56965 2 CVEs

    Moderate: libcupsfilters security update (Oracle Linux 10)

    [1:2.0.0-13] - RHEL-214027 CVE-2026-64611 libcupsfilters: Fix infinite loop and empty device_ids in ieee1284 [1:2.0.0-12] - RHEL-212655 CVE-2026-64612 libcupsfilters: Handle libpng errors via longjmp()/setjmp() to prevent process abort on malformed PNG

  • High max 5.4
    ELSA-2026-46386 2 CVEs

    Important: libreoffice security update (Oracle Linux 7)

    [5.3.6.1-26.0.5] - Backport fix for CVE-2026-4430 [Orabug: 39791243] - Backport fix for CVE-2026-8357 [Orabug: 39791243] [5.3.6.1-26.0.3] - Fix CVE-2025-1080, do not process macros in exotic uri schemes [Orabug: 37770225]

  • High max 8.8
    ELSA-2026-55560 4 CVEs

    Important: pcp security update (Oracle Linux 8)

    [5.3.7-22.0.12.el8_10.5] - Implemented units header in csv output using pmrep[Orabug: 39064482] - Adds interval option support in PCP nfsiostat tool [Orabug: 38902336] - Introduces proc.numa_maps metrics in linux_proc PMDA [Orabug: 38509848] - adds numastat p…

  • Medium max 5.4
    ELSA-2026-55804 1 CVE

    Moderate: nghttp2 security update (Oracle Linux 8)

    [1.33.0-6.3] - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

  • High max 7.6
    ELSA-2026-56130 1 CVE

    Important: sg3_utils security, bug fix, and enhancement update (Oracle Linux 8)

    [1.44-6.1] - sg_inq output conformance for SCSI name string and ATA fields (RHEL-188162)

  • Medium max 5.9
    ELSA-2026-56131 1 CVE

    Moderate: pam security update (Oracle Linux 8)

    [1.3.1-40.0.1] - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36272695] [1.3.1-40] - pam_userdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191699

  • Medium max 7.1
    ELSA-2026-56133 1 CVE

    Moderate: attr security update (Oracle Linux 8)

    [2.6.0-1] - rebase to 2.6.0 to fix the following CVEs: - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr (RHEL-186121) - fix couple of rpminspect warnings

  • High max 7.8
    ELSA-2026-56219 1 CVE

    Important: python3 security update (Oracle Linux 8)

    [3.6.8-78.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8.openela.0] - Add openela to supported dists [3.6.8-78] - Security fix for CVE-2026-11940 Resolves: RHEL-227194

  • High max 7.8
    ELSA-2026-55601 5 CVEs

    Important: nodejs:22 security update (Oracle Linux 9)

    nodejs [1:22.23.1-3] - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 2.1.4 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 Resolves: RHEL-223914 RHEL-223798 [1:22.23.1-3] - deps: update sqlite to 3.53.4 Fix: CVE-2026-11824, C…

  • High max 7.8
    ELSA-2026-55603 6 CVEs

    Important: nodejs:24 security update (Oracle Linux 9)

    nodejs [1:24.18.0-6] - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149 (memory exhaustion via deeply chained brace groups). as well as CVE-2026-14257 (fixed in 5.0.8). [1:24.18.0-5] - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address […

  • High max 7.8
    ELSA-2026-55856 4 CVEs

    Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [9.0.120-1.0.1] - Add support for Oracle Linux [9.0.120-1] - Update to .NET SDK 9.0.120 and Runtime 9.0.19 - Resolves: RHEL-235476

  • High max 7.8
    ELSA-2026-55857 4 CVEs

    Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [10.0.111-1.0.1] - Add support for Oracle Linux [10.0.111-1] - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235481

  • High max 7.8
    ELSA-2026-55858 4 CVEs

    Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [10.0.111-1.0.1] - Add support for Oracle Linux [10.0.111-1] - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235482

  • High max 8.8
    ELSA-2026-55617 4 CVEs

    Important: pcp security update (Oracle Linux 10)

    [7.0.3-5.0.1] - Fix unterminated backtick in pmlogger_janitor fix not to terminate unauthorized process patch [Orabug: 39270658] - Adds interval option support in PCP nfsiostat tool [Orabug: 39068870] - Introduces proc.numa_maps metrics in linux_proc PMDA [Or…

  • High max 8.4
    ELSA-2026-56007 29 CVEs

    Important: mysql8.4 security, bug fix, and enhancement update (Oracle Linux 10)

    [8.4.11-1] - Rebase to 8.4.11

  • High max 7.5
    ELSA-2026-55530 3 CVEs

    Important: 389-ds:1.4 security update (Oracle Linux 8)

    [1.4.3.39-26] - Bump version to 1.4.3.39-26 - Resolves: RHEL-183073 - EMBARGOED CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [rhel-8.10.z] - Resolves: RHEL-190782 - CVE-2026-11788 389-ds-base: 389-ds-base…

  • High max 7.5
    ELSA-2026-55784 1 CVE

    Important: unbound security update (Oracle Linux 8)

    [1.16.2-5.14] - Add unit test for CVE-2026-44690 from upstream. [1.16.2-5.13] - Fix CVE-2026-44690 (RHEL-212801)

  • High max 7.5
    ELSA-2026-55859 1 CVE

    Important: haproxy security update (Oracle Linux 8)

    [1.8.27-5.2] - Fix NULL pointer dereference in hpack_dht_insert() (CVE-2026-55204, RHEL-211083)

  • High max 9.0
    ELSA-2026-55446 2 CVEs

    Important: libXfont2 security update (Oracle Linux 8)

    [2.0.3-2.3] - CVE fix for: CVE-2026-59679 Resolves: https://redhat.atlassian.net/browse/RHEL-221956 [2.0.3-2.2] - CVE fix for: CVE-2026-44950 Resolves: https://redhat.atlassian.net/browse/RHEL-222015

  • High max 7.5
    ELSA-2026-55423 3 CVEs

    Important: 389-ds-base security update (Oracle Linux 9)

    [2.8.0-9] - Resolves: RHEL-183082 - CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [rhel-9.8.z] - Resolves: RHEL-190775 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control p…

  • Medium max 6.6
    ELSA-2026-55436 2 CVEs

    Moderate: gstreamer1-plugins-good security update (Oracle Linux 9)

    [1.22.12-7.4] - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239042 [1.22.12-7.3] - Fix CVE-2026-73433: add bounds checks to FUJIFILM strd metadata parsing in avidemux to prevent unsigned integer underflow Resolves: RHEL-…

  • High max 9.0
    ELSA-2026-55447 2 CVEs

    Important: libXfont2 security update (Oracle Linux 9)

    [2.0.3-12.3] - CVE fix for: CVE-2026-59679 Resolves: https://redhat.atlassian.net/browse/RHEL-221957 [2.0.3-12.2] - CVE fix for: CVE-2026-44950 Resolves: https://redhat.atlassian.net/browse/RHEL-222029

  • High max 7.5
    ELSA-2026-55772 2 CVEs

    Important: haproxy security update (Oracle Linux 9)

    [2.8.14-3.2] - Fix NULL pointer dereference in hpack_dht_insert() (CVE-2026-55204) Resolves: RHEL-211082 [2.8.14-3.1] - Fix uint16_t overflow in FCGI demux record length (CVE-2026-55203) Resolves: RHEL-211062

  • High max 7.5
    ELSA-2026-55841 2 CVEs

    Important: unbound security update (Oracle Linux 9)

    [1.24.2-3.4] - Fix CVE-2026-55973 (RHEL-212809)

  • High max 7.6
    ELSA-2026-55865 2 CVEs

    Important: gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update (Oracle Linux 9)

    gstreamer1-plugins-bad-free [1.22.12-7.4] - Fix ADPCM decoder negotiation and input size check (CVE-2026-19387) Resolves: RHEL-235496 gstreamer1-plugins-ugly-free [1.22.12-6.2] - Fix integer overflows during bounds checks in asfdemux - Resolves: RHEL-235519

  • High max 8.1
    ELSA-2026-55439 4 CVEs

    Important: curl security update (Oracle Linux 9)

    [7.76.1-40.el9_8.5] - fix missing %patch macros for Patch46 and Patch47 [7.76.1-40.el9_8.4] - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - tests: disable flaky test 120…

  • Medium max 7.3
    ELSA-2026-55440 7 CVEs

    Moderate: glib2 security update (Oracle Linux 9)

    [2.68.4-19.9] - Fix CVE-2026-15588: limit D-Bus auth line read length [2.68.4-19.8] - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Resolves: RHEL-212157 [2.68.4-19.7] - Fix CVE-2026-58012: buffer overflow in gregex.c with G_REGEX_RAW - R…

  • High max 8.6
    ELSA-2026-55442 6 CVEs

    Important: bind9.18 security update (Oracle Linux 9)

    [32:9.18.29-14.8] - Fix NSEC3 signer validation (CVE-2026-10723, RHEL-215704) [32:9.18.29-14.7] - Reject out-of-zone NSEC next owner names (CVE-2026-13321, RHEL-213314) [32:9.18.29-14.6] - Fix cache exhaustion via dns_slabheaders (CVE-2026-11622, RHEL-213389)…

  • High max 7.5
    ELSA-2026-55424 3 CVEs

    Important: 389-ds-base security update (Oracle Linux 10)

    [3.2.0-9] - Bump version to 3.2.0-9 - Resolves: RHEL-183075 - CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [rhel-10.2.z] - Resolves: RHEL-190776 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer der…

  • High max 9.1
    ELSA-2026-55432 1 CVE

    Important: curl security update (Oracle Linux 10)

    [8.12.1-4.4] - fix proxy environment variable change detection (CVE-2026-8927) [8.12.1-4.el10_2.3] - fix HTTP Negotiate connection reuse auth bypass (CVE-2026-1965) - fix OAuth2 bearer token leak via redirect and netrc (CVE-2026-3783) - fix proxy connection r…

  • High max 7.6
    ELSA-2026-55433 1 CVE

    Important: gstreamer1-plugins-bad-free security update (Oracle Linux 10)

    [1.26.7-2.7] - Fix ADPCM decoder input validation (CVE-2026-19387) Resolves: RHEL-235500 [1.26.7-2.5] - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats (CVE-2026-59691) Resolves: RHEL-193550 [1.26.7-2.4] - Fix bytes/bits confusion in AV…

  • Medium max 6.6
    ELSA-2026-55434 2 CVEs

    Moderate: gstreamer1-plugins-good security update (Oracle Linux 10)

    [1.26.7-2.5] - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239045 [1.26.7-2.4] - Fix out-of-bounds reads when parsing FUJIFILM strd metadata in AVI files (CVE-2026-73433) Resolves: RHEL-239062

  • High max 7.1
    ELSA-2026-55435 1 CVE

    Important: gstreamer1-plugins-ugly-free security update (Oracle Linux 10)

    [1.26.7-2.2] - Fix CVE-2026-19389: integer overflow vulnerabilities in asfdemux Resolves: RHEL-235515

  • High max 8.6
    ELSA-2026-55437 6 CVEs

    Important: bind security update (Oracle Linux 10)

    [9.18.33-15.0.1.el10_2.10] - Hard require needed openssl-libs [Orabug: 38742109] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.18.33-15.10] - Validate NSEC3 signer matches owning zone (CVE-2026-10723) [32:9.18.33-15.9] - Reject …