Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

High max 8.0

ELSA-2019-3055 4 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1062.4.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] [3.10.0-1062.4.1] - [vhost] vhost…

Oct 16, 2019
High

ELSA-2019-4821 1 CVE

Important: sudo security update (Oracle Linux 7)

[1.8.23-4.0.1] - Treat an ID of -1 as invalid since that means 'no change' [Orabug: 30421281] {CVE-2019-14287} - Add sudo_strtoid() tests for -1 and range errors. [Orabug: 30421281]

Oct 15, 2019
High

ELSA-2019-4822 1 CVE

Important: sudo security update (Oracle Linux 8)

[1.8.25-4.0.1.el8.1] - Treat an ID of -1 as invalid since that means 'no change' [Orabug: 30421281] {CVE-2019-14287} - Add sudo_strtoid() tests for -1 and range errors. [Orabug: 30421281]

Oct 15, 2019
High max 7.5

ELSA-2019-4820 7 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.6.6] - RDMA/restrack: Protect from reentry to resource return path (Leon Romanovsky) [Orabug: 30388717] [4.14.35-1902.6.5] - hv_netvsc: fix vf serial matching with pci slot info (Haiyang Zhang) [Orabug: 30373111] - rds: Use correct conn when dro…

Oct 11, 2019
High max 7.5

ELSA-2019-4813 2 CVEs

Important: docker-engine security update (Oracle Linux 7)

[18.09.8-1.0.4] - Modified version to include ol suffix [ 18.09.8-1.0.3] - ol7 image related changes [ 18.09.8-1.0.2] - Merge upstream for CVE fixes.

Oct 3, 2019
High

ELSA-2019-2964 2 CVEs

Important: patch security update (Oracle Linux 7)

[2.7.1-12] - Fixed CVE-2018-20969, invoke ed directly instead of using the shell

Oct 3, 2019
High

ELSA-2019-4810 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.39.1] - tcp: purge write queue in tcp_connect_init() (Eric Dumazet) [Orabug: 30240134] {CVE-2019-15239} - cx24116: fix a buffer overflow when checking userspace params (Mauro Carvalho Chehab) [Orabug: 30254282] {CVE-2015-9289} - floppy:…

Oct 2, 2019
High max 7.5

ELSA-2019-4808 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.32.1] - NFSv4: Don't try to reclaim unused state owners (Trond Myklebust) [Orabug: 30124013] - x86/microcode: Update late microcode in parallel (Ashok Raj) [Orabug: 30302412] - floppy: fix out-of-bounds read in copy_buffer (Denis Efremov) [Orabug:…

Oct 1, 2019
High max 7.5

ELSA-2019-2925 8 CVEs

Important: nodejs:10 security update (Oracle Linux 8)

nodejs-packaging 17-3] - Change Requires to Recommends on nodejs dependency, so it is usable for building nodejs

Sep 30, 2019
High max 7.5

ELSA-2019-2893 1 CVE

Important: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-12.0.1] - Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-12] - Resolves: #1744997 - CVE-2019-9511 httpd:2.4/mod_http2: HTTP/2: large amount of data request leads …

Sep 24, 2019
High

ELSA-2019-2822 1 CVE

Important: dovecot security update (Oracle Linux 8)

[1:2.2.36-5.1] - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes (#1741788)

Sep 23, 2019
High max 7.2

ELSA-2019-2827 1 CVE

Important: kernel security update (Oracle Linux 8)

- [4.18.0-80.11.2_0.OL8] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] [4.18.0-80.11.2_0] - [v…

Sep 22, 2019
High max 7.2

ELSA-2019-2829 1 CVE

Important: kernel security update (Oracle Linux 7)

[3.10.0-1062.1.2.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] [3.10.0-1062.1.2] - [vhost] vhost…

Sep 20, 2019
High max 7.5

ELSA-2019-4800 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.31.1.1] - KVM: coalesced_mmio: add bounds checking (Matt Delco) [Orabug: 30318042] {CVE-2019-14821} {CVE-2019-14821}

Sep 20, 2019
High max 7.5

ELSA-2019-4799 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.5.2.2] - KVM: coalesced_mmio: add bounds checking (Matt Delco) [Orabug: 30318013] {CVE-2019-14821} {CVE-2019-14821}

Sep 20, 2019
High

ELSA-2019-2836 1 CVE

Important: dovecot security update (Oracle Linux 7)

[1:2.2.36-3.1] - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes (#1751383)

Sep 20, 2019
High

ELSA-2019-2798 2 CVEs

Important: patch security update (Oracle Linux 8)

[2.7.6-9] - CVE-2018-20969, invoke ed directly instead of using the shell

Sep 19, 2019
High max 7.5

ELSA-2019-2799 3 CVEs

Important: nginx:1.14 security update (Oracle Linux 8)

[1:1.14.1-9.0.1] - Remove Red Hat references [Orabug: 29498217] [1:1.14.1-9] - Resolves: #1744811 - CVE-2019-9511 nginx:1.14/nginx: HTTP/2: large amount of data request leads to denial of service - Resolves: #1744325 - CVE-2019-9513 nginx:1.14/nginx: HTTP/2: …

Sep 19, 2019
High max 7.2

ELSA-2019-4789 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1902.5.2.1] - vhost: make sure log_num < in_num (yongduan) [Orabug: 30312787] {CVE-2019-14835} - vhost: block speculation of translated descriptors (Michael S. Tsirkin) [Orabug: 30312787] {CVE-2019-14835} - vhost: Fix Spectre V1 vulnerability (Jason …

Sep 17, 2019
High

ELSA-2019-2774 7 CVEs

Important: thunderbird security update (Oracle Linux 8)

[60.9.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [60.9.0-2] - Update to 60.9.0

Sep 17, 2019
High max 5.9

ELSA-2019-2720 1 CVE

Important: pki-deps:10.6 security update (Oracle Linux 8)

jackson-databind

Sep 17, 2019
High

ELSA-2019-2773 7 CVEs

Important: thunderbird security update (Oracle Linux 7)

[60.9.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [60.9.0-1] - Update to 60.9.0

Sep 16, 2019
High max 5.6

ELSA-2019-4785 11 CVEs

Important: edk2 security update (Oracle Linux 7)

[1:1.2-5.el7] - Update spec file to remove 'modprobe kvm-intel' and remove --enable-kvm arg to ovmf_vars_generator so qemu will not require kvm kernel module. (Aaron Young) - Update spec file to modprobe kvm_intel module prior to running qemu to enroll defaul…

Sep 13, 2019
Low

ELSA-2019-2722 1 CVE

Low: libwmf security update (Oracle Linux 8)

[0.2.9-8] - Related: rhbz1717799 fix clang warning [0.2.9-7] - Related: rhbz1717799 bump n-v-r [0.2.9-6] - Related: rhbz1679006 bump n-v-r [0.2.9-5] - Resolves: rhbz1679006 libgd CVE-2019-6978

Sep 12, 2019
Medium max 7.5

ELSA-2019-2731 1 CVE

Moderate: .NET Core on Red Hat Enterprise Linux security and bug fix update (Oracle Linux 8)

[2.1.509-1] - Update to .NET Core Runtime 2.1.13 and SDK 2.1.509 - Resolves: RHBZ#1747874

Sep 12, 2019
High max 8.0

ELSA-2019-2703 7 CVEs

Important: kernel security and bug fix update (Oracle Linux 8)

- [4.18.0-80.11.1_0.OL8] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] [4.18.0-80.11.1_0] - [w…

Sep 12, 2019
Medium

ELSA-2019-2713 12 CVEs

Moderate: poppler security update (Oracle Linux 8)

[0.66.0-11.el8_0.12] - Ignore dict Length if it is broken - Resolves: #1741146 [0.66.0-11.el8_0.11] - Check whether input is RGB in PSOutputDev::checkPageSlice() - (also when using '-optimizecolorspace' flag) - Resolves: #1741145 [0.66.0-11.el8_0.10] - Fail g…

Sep 12, 2019
Critical

ELSA-2019-2729 8 CVEs

Critical: firefox security update (Oracle Linux 7)

[60.9.0-1.0.1] - Update distribution for Oracle Linux [Orabug: 30143292] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [60.9.0-1] - Update to 60.9.0 ESR

Sep 11, 2019
High max 7.5

ELSA-2019-2692 2 CVEs

Important: nghttp2 security update (Oracle Linux 8)

[1.33.0-1.el8_0_0.1] - backport security fixes from nghttp2-1.39.2 (CVE-2019-9511 and CVE-2019-9513)

Sep 10, 2019
High max 7.3

ELSA-2019-2591 4 CVEs

Important: ghostscript security update (Oracle Linux 8)

[9.25-2.3] - Resolves: #1744010 - CVE-2019-14811 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator (701445) - Resolves: #1744014 - CVE-2019-14812 ghostscript: Safer Mode Bypass by .forceput Exposure in setuserparams (701444) - Reso…

Sep 6, 2019
Critical

ELSA-2019-2663 13 CVEs

Critical: firefox security update (Oracle Linux 8)

[68.1.0-1.0.1] - Rebuild to pickup Oracle default bookmarks [Orabug: 30069264] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [68.1.0-1] - Update to 68.1.0 ESR [68.0.1-4] - Enable system nss

Sep 6, 2019
High max 5.6

ELSA-2019-4775 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.38.1] - x86/speculation: Exclude ATOMs from speculation through SWAPGS (Thomas Gleixner) [Orabug: 30165288] {CVE-2019-1125} - x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [Orabug: 30165288] {CVE-2019-1125} - x8…

Sep 5, 2019
Low

ELSA-2019-2607 1 CVE

Low: qemu-kvm security update (Oracle Linux 7)

[1.5.3-167.el7_7.1] - kvm-qxl-check-release-info-object.patch [bz#1732337] - kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1734748] - Resolves: bz#1732337 (CVE-2019-12155 qemu-kvm: QEMU: qxl: null pointer dereference while releasing spice re…

Sep 4, 2019
High

ELSA-2019-2606 1 CVE

Important: kdelibs and kde-settings security and bug fix update (Oracle Linux 7)

kdelibs [6:4.14.8-11] - KConfig: malicious .desktop files would execute code Resolves: bz#1740736 kde-settings [19-23.10.0.1] - Change GreetString [bug 11710280] [19-23.10] - Use correct tcsh syntax for config scripts Resolves: bz#1738491

Sep 4, 2019
High max 7.9

ELSA-2019-2600 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1062.1.1] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] [3.10.0-1062.1.1] - [fs] nfsv4.1: Avo…

Sep 4, 2019
High

ELSA-2019-2593 1 CVE

Important: squid:4 security update (Oracle Linux 8)

libecap [1.0.1-2] - Resolves: #1696354 - Ensure modular RPM upgrade path squid [7:4.4-5] - Resolves: #1744672 - CVE-2019-12527 squid:4/squid: heap-based buffer overflow in HttpHeader::getAuth

Sep 3, 2019
High max 7.3

ELSA-2019-2586 4 CVEs

Important: ghostscript security update (Oracle Linux 7)

[9.25-2.2] - Resolves: #1744008 - CVE-2019-14811 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator (701445) - Resolves: #1744012 - CVE-2019-14812 ghostscript: Safer Mode Bypass by .forceput Exposure in setuserparams (701444) - Reso…

Sep 2, 2019
High

ELSA-2019-2582 1 CVE

Important: pango security update (Oracle Linux 8)

[1.42.4-5] - Fixes crash in pango_fc_font_key_get_variations when key is null [1.42.4-4] - Fixes bidi crash - Security fix for CVE-2019-1010238 - Resolves: #1738461 [1.42.4-3] - rebuild [1.42.4-2] - rebuild

Aug 29, 2019
High

ELSA-2019-2571 1 CVE

Important: pango security update (Oracle Linux 7)

[1.42.4-4] - Fixes bidi crash - Security fix for CVE-2019-1010238 - Resolves: #1738459

Aug 27, 2019
High

ELSA-2019-4756 0 CVEs

Important: docker-engine security update (Oracle Linux 7)

[ 18.03.1.ol-0.0.15] - cherry-picked fix for CVE-2018-15664 from upstream [18.03.1.ol-0.0.14] - rebuild [18.03.1.ol-0.0.13] - update for CVE-2018-20699 [18.03.1.ol-0.0.12] - correct the version string of containerd [18.03.1.ol-0.0.11] - update runc for CVE-20…

Aug 19, 2019