Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

  • High
    ELSA-2019-2511 95 CVEs

    Important: mysql:8.0 security update (Oracle Linux 8)

    mecab [0.996-1.9] - Release bump for rebuilding on new arches Related: #1518842 [0.996-1.8] - skip %verify of /etc/opt/rh/rh-mysql57/mecabrc Resolves: #1382315 [0.996-1.7] - Prefix library major number with SCL name in soname [0.996-1.6] - Require runtime pac…

  • High
    ELSA-2019-2512 1 CVE

    Important: subversion:1.10 security update (Oracle Linux 8)

    libserf [1.3.9-9] - Resolves: #1696354 - Ensure modular RPM upgrade path subversion [1.10.2-2] - rebuild to ensure NVR ordering (#1696354) [1.10.2-1.1] - Resolves: #1733442 - CVE-2019-0203 subversion:1.10/subversion: remote unauthenticated denial-of-service i…

  • High max 7.2
    ELSA-2019-2002 2 CVEs

    Important: redis:5 security update (Oracle Linux 8)

    [5.0.3-2] - fix Heap buffer overflow in HyperLogLog triggered by malicious client CVE-2019-10192 - fix Stack buffer overflow in HyperLogLog triggered by malicious client CVE-2019-10193

  • High max 7.8
    ELSA-2019-2411 2 CVEs 1 exploited

    Important: kernel security update (Oracle Linux 8)

    - [4.18.0-80.7.2_0.OL8] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] [4.18.0-80.7.2_0] - [x86…

  • High
    ELSA-2019-1959 4 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    - [4.18.0-80.7.1_0.OL8] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] [4.18.0-80.7.1_0] - [x86…

  • High max 7.3
    ELSA-2019-2462 1 CVE

    Important: ghostscript security update (Oracle Linux 7)

    [9.25-2.1] - Resolves: #1737338 - CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 (701394)

  • High max 7.8
    ELSA-2019-4746 8 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.14.35-1902.4.8] - x86/boot: Clear RSDP address in boot_params for broken loaders (Juergen Gross) [Orabug: 30111373] [4.14.35-1902.4.7] - rds: ib: Qualify CM REQ duplicate detection with connection being up (Hakon Bugge) [Orabug: 30062149] - rds: Further pr…

  • Medium
    ELSA-2019-2178 1 CVE

    Moderate: udisks2 security, bug fix, and enhancement update (Oracle Linux 7)

    [2.7.3-9] - Build udisks2-lsm subpackage (#1672664) - Fix sigint source removal on daemon exit (#1643350) - CVE-2018-17336: Fix format string vulnerability in udisks_log (#1637427) - Describe command options in the udisksctl man page (#1568269)

  • Medium
    ELSA-2019-2298 5 CVEs

    Moderate: libarchive security update (Oracle Linux 7)

    [3.1.2-12] - fixed use after free in RAR decoder (#1700749) - fixed double free in RAR decoder (#1700748) [3.1.2-11] - fix out-of-bounds read within lha_read_data_none() (CVE-2017-14503) - fix crash on crafted 7zip archives (CVE-2019-1000019) - fix infinite l…

  • Medium
    ELSA-2019-2304 2 CVEs

    Moderate: openssl security and bug fix update (Oracle Linux 7)

    [1.0.2k-19.0.1] - Bump release for rebuild. [1.0.2k-19] - close the RSA decryption 9 lives of Bleichenbacher cat timing side channel (#1649568) [1.0.2k-18] - fix CVE-2018-0734 - DSA signature local timing side channel - fix CVE-2019-1559 - 0-byte record paddi…

  • Low
    ELSA-2019-2281 1 CVE

    Low: ghostscript security, bug fix, and enhancement update (Oracle Linux 7)

    [9.25-2] - obsoleted old ghostscript-devel to allow clean upgrade to libgs-devel [9.25-1] - Rebase to latest upstream version (bug #1636115) - Resolves: #1673399 - CVE-2019-3839 ghostscript: missing attack vector protections for CVE-2019-6116 - Resolves: #167…

  • Medium max 9.1
    ELSA-2019-2030 5 CVEs

    Moderate: python security and bug fix update (Oracle Linux 7)

    [2.7.5-86.0.1] - Add Oracle Linux distribution in platform.py [orabug 20812544] [2.7.5-86] - Security fix for CVE-2019-10160 Resolves: rhbz#1718388 [2.7.5-85] - Security fix for CVE-2019-9948 Resolves: rhbz#1704174 [2.7.5-84] - Disallow control chars in http …

  • Low
    ELSA-2019-2033 2 CVEs

    Low: patch security and bug fix update (Oracle Linux 7)

    [2.7.1-11] - Fixed CVE-2016-10713 - Out-of-bounds access in pch_write_line function - Fixed CVE-2018-6952 - Double free of memory - Resolves: #1626473, honor new file mode 100755 when applying patches - Resolves: #1653294, Added virtual provides for bundled g…

  • Medium max 5.0
    ELSA-2019-2136 2 CVEs

    Moderate: libssh2 security, bug fix, and enhancement update (Oracle Linux 7)

    [1.8.0-3] - sanitize public header file (detected by rpmdiff) [1.8.0-2] - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863) - fix out-of-bounds memory comparison with specially crafted message channel reque…

  • Medium
    ELSA-2019-2118 1 CVE

    Moderate: glibc security and bug fix update (Oracle Linux 7)

    aarch64: [2.17-292.0.2] - CR29749550 [armv5] build failure - Add 3 arm patches to aarch64 tree to avoid future build/merge failures. - Rebase aarch64 patches at 30000 to avoid future conflicts. - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> - EL E…

  • Medium
    ELSA-2019-2052 6 CVEs

    Moderate: libjpeg-turbo security update (Oracle Linux 7)

    [1.2.90-8] - Fix CVE-2018-14498 (#1687475) [1.2.90-7] - Fix CVE-2018-11212 (#1586062) - Fix CVE-2016-3616 (#1318509), CVE-2018-11213 (#1589091) and CVE-2018-11214 (#1589110) - Fix CVE-2018-11813 (#1591203)

  • Low
    ELSA-2019-2196 2 CVEs

    Low: zziplib security update (Oracle Linux 7)

    [0.13.62-11] - Fix CVE-2018-6541 - Part of the original patch has already been applied in the past (CVE-2018-7726), so the bug should not be reproducible in a way described in the github issue, even without this commit. Applying the rest of the original patch…

  • Low
    ELSA-2019-2283 1 CVE

    Low: sox security update (Oracle Linux 7)

    [14.4.1-7] - Fix CVE-2017-18189 Upstream patch: https://sourceforge.net/p/sox/code/ci/09d7388c8ad5701ed9c59d1d600ff6154b066397/ Resolves: #1553590

  • High max 7.0
    ELSA-2019-2029 25 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

    [3.10.0-1062.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [Orabug: 24817676] [3.10.0-1062] - [fs] revert 'xfs: dis…

  • Low max 5.9
    ELSA-2019-2143 1 CVE

    Low: openssh security, bug fix, and enhancement update (Oracle Linux 7)

    [7.4p1-21 + 0.10.3-2] - Avoid double comma in the default cipher list in FIPS mode (#1722446) [7.4p1-20 + 0.10.3-2] - Revert the updating of cached passwd structure (#1712053) [7.4p1-19 + 0.10.3-2] - Update cached passwd structure after PAM authentication (#1…

  • Medium
    ELSA-2019-2053 10 CVEs

    Moderate: libtiff security update (Oracle Linux 7)

    [4.0.3-32] - Fix one more Covscan defect - Related: #1647965 [4.0.3-31] - Fix processing of RAS files without colormap - Related: #1647965 [4.0.3-30] - Fix various Covscan defects - Related: #1647965 [4.0.3-29] - Fix compiler warning introduced by patch for C…

  • Medium max 6.5
    ELSA-2019-2057 1 CVE

    Moderate: bind security, bug fix, and enhancement update (Oracle Linux 7)

    [32:9.11.4-9.P2] - Fix CVE-2019-6471 [32:9.11.4-8.P2] - Fix scriptlet errors when selinux-policy is not installed (#1647659) [32:9.11.4-7.P2] - Fix inefective limit of TCP clients (CVE-2018-5743) [32:9.11.4-6.P2] - Use /sbin/nologin again (#1676661) [32:9.11.…

  • Low
    ELSA-2019-2077 1 CVE

    Low: ntp security, bug fix, and enhancement update (Oracle Linux 7)

    [4.2.6p5-29.0.1] - Bump release to avoid ULN conflict with Oracle modified errata. [4.2.6p5-29] - fix CVE-2016-7429 patch to restore default ttl configuration (#1550637) - fix buffer overflow in parsing of address in ntpq and ntpdc (CVE-2018-12327) - fix cras…

  • Low
    ELSA-2019-2126 1 CVE

    Low: libwpd security update (Oracle Linux 7)

    [0.10.0-2] - Resolves: rhbz#1650535 CVE-2018-19208

  • Low max 4.4
    ELSA-2019-2181 1 CVE

    Low: curl security and bug fix update (Oracle Linux 7)

    [7.29.0-54.0.1] - Security Fixes [OraBug: 28939992] - CVE-2016-8615 cookie injection for other servers (https://curl.haxx.se/docs/CVE-2016-8615.html) - CVE-2016-8616 case insensitive password comparison (https://curl.haxx.se/docs/CVE-2016-8616.html) - CVE-201…

  • Medium
    ELSA-2019-2017 1 CVE

    Moderate: zsh security and bug fix update (Oracle Linux 7)

    [5.0.2-33] - fix regression in oh-my-zsh vcs_info hooks introduced in -30 (#1677696) [5.0.2-32] - fix improper handling of shebang line longer than 64 bytes (CVE-2018-13259)

  • Medium
    ELSA-2019-2075 3 CVEs

    Moderate: binutils security and bug fix update (Oracle Linux 7)

    [2.27-41.base.0.1] - Complete the backport of upstream commit a5def14f1ca70e14d9433cb229c9369fa3051598 Add a test for R_386_GOT32/R_386_GOT32X IFUNC reloc error [Orabug 27930573] - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> [2.27-41.base] - Fix …

  • Medium max 7.3
    ELSA-2019-2189 1 CVE

    Moderate: procps-ng security and bug fix update (Oracle Linux 7)

    [3.3.10-26] - free: unreclaimable slabs counted into free memory, used mem incorrect - Resolves: rhbz#1699264 [3.3.10-25] - ps: recognize SCHED_DEADLINE in CLS field, upstream backport - Resolves: rhbz#1692843 [3.3.10-24] - top: Do not default to the cwd in c…

  • Low max 6.5
    ELSA-2019-2101 22 CVEs

    Low: exiv2 security, bug fix, and enhancement update (Oracle Linux 7)

    [0.27.0-2] - Minor improvements Resolves: bz#1652637 [0.27.0-1] - Exiv2 0.27.0 Resolves: bz#1652637

  • Medium
    ELSA-2019-2135 5 CVEs

    Moderate: qt5 security, bug fix, and enhancement update (Oracle Linux 7)

    qt5-qt3d [5.9.7-1] - Update to 5.9.7 Resolves: bz#1564024 qt5-qtbase [5.9.7-1] - Enable -doc subpkg on PPC Resolves: bz#1564000 [5.9.7-1] - Update to 5.9.7 Resolves: bz#1564000 qt5-qtcanvas3d [5.9.7-1] - Update to 5.9.7 Resolves: bz#1564001 qt5-qtconnectivity…

  • Low max 7.5
    ELSA-2019-2035 1 CVE

    Low: python-requests security update (Oracle Linux 7)

    [2.6.0-5] - Fix CVE-2018-18074 Resolves: rhbz#1647368

  • Medium
    ELSA-2019-2047 1 CVE

    Moderate: libcgroup security update (Oracle Linux 7)

    [0.41-21] - fix CVE-2018-14348 resolves: #1612122

  • Low
    ELSA-2019-2141 1 CVE

    Low: kde-workspace security and bug fix update (Oracle Linux 7)

    kdelibs [6:4.14.8-10] - Do not fork konsole process when opening terminal from apps using dolphin-part Resolves: bz#1710362 [6:4.14.8-9] - Do not fork konsole process when opening terminal from apps using dolphin-part Resolves: bz#1710362 [6:4.14.8-8] - Disab…

  • Low
    ELSA-2019-2048 5 CVEs

    Low: exempi security update (Oracle Linux 7)

    [2.2.0-9] - Fix CVE-2017-18233 resolves: #1574865 - Fix CVE-2017-18234 resolves: #1656011 - Fix CVE-2017-18236 resolves: #1574905 - Fix CVE-2017-18238 resolves: #1572270 - Fix CVE-2018-7730 resolves: #1572631

  • Medium
    ELSA-2019-2049 2 CVEs

    Moderate: libmspack security update (Oracle Linux 7)

    [0.5-0.7.alpha] - Fixes for CVE-2018-18584 CVE-2018-18585. resolves: rhbz#1648384 rhbz#1648385

  • Medium
    ELSA-2019-2280 2 CVEs

    Moderate: uriparser security update (Oracle Linux 7)

    [0.7.5-10] - Fix CVE-2018-19198, CVE-2018-19199 Fix unescaped % in a comment Resolves: #1652002, #1652001

  • Medium max 7.6
    ELSA-2019-2229 1 CVE

    Moderate: spice-gtk security and bug fix update (Oracle Linux 7)

    libgovirt [0.3.4-2] - Parse XML nodes automatically Related: rhbz#1427467 - Set detailed error message for async call Related: rhbz#1427467 spice-gtk [0.35-4] - Fix bad channel-reset on usbredir Resolves: rhbz#1625550 [0.35-3] - Fix insufficient encoding chec…

  • Low max 7.8
    ELSA-2019-2137 2 CVEs

    Low: keycloak-httpd-client-install security, bug fix, and enhancement update (Oracle Linux 7)

    [0.8-1] - Resolves: rhbz#1673716 - Rebase k-h-c-i to version 0.8 - The rebase also includes fixes for: - rhbz#1533190 - CVE-2017-15111 keycloak-httpd-client-install: unsafe /tmp log file in --log-file option in keycloak_cli.py - rhbz#1533202 - CVE-2017-15112 …

  • Medium max 7.0
    ELSA-2019-2145 1 CVE

    Moderate: gvfs security and bug fix update (Oracle Linux 7)

    [1.36.2-3] - Force NT1 protocol version for workgroup support (#1619719) [1.36.2-2] - Prevent spawning new daemons if outgoing operation exists (#1632960) - CVE-2019-3827: Prevent access if any authentication agent isnt available (#1673887)

  • Medium
    ELSA-2019-2154 11 CVEs

    Moderate: opensc security, bug fix, and enhancement update (Oracle Linux 7)

    [0.19.0-3] - Make OpenSC multilib also on s390 and ppc arches [0.19.0-2] - Make OpenSC multilib again by moving the conflicting files on ix86 arch [0.19.0-1] - Rebase to new upstream release (#1656791) - Add Support for HID Crescendo 144K (#1612372) - Add Sup…