Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

  • Low
    ELSA-2019-2157 1 CVE

    Low: freerdp and vinagre security, bug fix, and enhancement update (Oracle Linux 7)

    freerdp [2.0.0-1.rc4] - Update to 2.0.0-rc4 (#1291254) vinagre [3.22.0-12] - Apply the patch - Resolves: #1569552 [3.22.0-11] - Set maximum length of RDP password to 255 characters - Resolves: #1569552 [3.22.0-10] - Make vinagre build with FreeRDP 2 library -…

  • Medium max 9.8
    ELSA-2019-2276 3 CVEs

    Moderate: mercurial security update (Oracle Linux 7)

    [2.6.2-10] - Add missing hunk for CVE-2018-13347 patch - Related: CVE-2018-13347 [2.6.2-9] - Fix various CVEs - Resolves: CVE-2018-1000132 CVE-2018-13346 CVE-2018-13347

  • Low
    ELSA-2019-2290 3 CVEs

    Low: libsolv security and bug fix update (Oracle Linux 7)

    [0.6.34-4] - Polish the changelog [0.6.34-3] - Make sure that targeted updates dont do reinstalls - Resolves: bug#1668256 - Fix NULL pointer dereference (CVE-2018-20532, CVE-2018-20533) - Resolves: bug#1669562 - Resolves: bug#1669576 - Fix illegal address acc…

  • Medium
    ELSA-2019-2046 1 CVE

    Moderate: polkit security and bug fix update (Oracle Linux 7)

    [0.112-22.0.1] - Increase timeout to avoid defunct processes [Orabug: 26930744] [0.112-22] - pkttyagent: polkit-agent-helper-1 timeout leaves tty echo disabled - Resolves: rhbz#1325512 [0.112-21] - Mitigation of regression caused by fix of CVE-2018-19788 - Re…

  • Medium max 4.2
    ELSA-2019-2099 1 CVE

    Moderate: samba security, bug fix, and enhancement update (Oracle Linux 7)

    [4.9.1-6] - related: #1703204 - Fix printing with smbspool as CUPS backend [4.9.1-5] - resolves: #1703204 - Fix smbspool krb5 authentication [4.9.1-4] - resolves: #1690222 - Fix --max-protocol documentation of smbclient - resolves: #1518353 - Fix 'net ads joi…

  • Low
    ELSA-2019-2332 2 CVEs

    Low: advancecomp security update (Oracle Linux 7)

    [1.15-21] - Resolves: #1711051, CVE-2019-8383 denial of service - Resolves: #1710910, CVE-2019-8379 null pointer dereference

  • Low
    ELSA-2019-2051 1 CVE

    Low: compat-libtiff3 security update (Oracle Linux 7)

    [3.9.4-12] - Fix CVE-2018-7456 - Resolves: #1561319

  • Low
    ELSA-2019-2159 1 CVE

    Low: unzip security update (Oracle Linux 7)

    [6.0-20] - Fix CVE-2018-18384 Resolves: CVE-2018-18384

  • Medium max 5.4
    ELSA-2019-2177 2 CVEs

    Moderate: sssd security, bug fix, and enhancement update (Oracle Linux 7)

    [1.16.4-21] - Resolves: rhbz#1714952 - [sssd] RHEL 7.7 Tier 0 Localization - Rebuild japanese gmo file explicitly [1.16.4-20] - Resolves: rhbz#1714952 - [sssd] RHEL 7.7 Tier 0 Localization [1.16.4-19] - Resolves: rhbz#1707959 - sssd does not properly check GS…

  • Medium max 9.8
    ELSA-2019-2205 4 CVEs

    Moderate: tomcat security, bug fix, and enhancement update (Oracle Linux 7)

    [0:7.0.76-9] - Resolves: rhbz#1641873 CVE-2018-11784 tomcat: Open redirect in default servlet - Resolves: rhbz#1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended expo sure of resources - Resolve…

  • Medium
    ELSA-2019-2327 9 CVEs

    Moderate: mariadb security and bug fix update (Oracle Linux 7)

    [1:5.5.64-1] - Rebase to 5.5.64 - Resolves: #1490398 - CVEs fixed: #1610986 CVE-2018-3058 CVE-2018-3063 CVE-2018-3066 CVE-2018-3081 - CVEs fixed: #1664043 CVE-2018-3282 CVE-2019-2503 - CVEs fixed: #1701686 CVE-2019-2529

  • Medium
    ELSA-2019-2343 2 CVEs

    Moderate: httpd security and bug fix update (Oracle Linux 7)

    [2.4.6-90.0.1] - replace index.html with Oracles index page oracle_index.html Resolves: #1566317 - CVE-2018-1312 httpd: Weak Digest auth nonce generation in mod_auth_digest - Resolves: #1696141 - CVE-2019-0217 httpd: mod_auth_digest: access control bypass due…

  • Medium max 7.0
    ELSA-2019-2091 3 CVEs

    Moderate: systemd security, bug fix, and enhancement update (Oracle Linux 7)

    [219-67.0.1] - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896] - OL7 udev rule for virtio net standby interface [Orabug: 28826743] - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com) …

  • Medium
    ELSA-2019-2336 2 CVEs

    Moderate: unixODBC security update (Oracle Linux 7)

    [2.3.1-14.0.1] - backport unchecked malloc memory references fix [Orabug: 29684195] [2.3.1-14] - fixed insecure buffer copy (#1571530) - fixed possible buffer overflow (#1571528) [2.3.1-13] - revert: ltdl bundling [2.3.1-12] - fix the libtool-ltdl compatibili…

  • Medium max 9.8
    ELSA-2019-2028 14 CVEs

    Moderate: ruby security update (Oracle Linux 7)

    [2.0.0.648-36] - Introduce 'Gem::UserInteraction#verbose' method as precondition to fix CVE-2019-8321. * rubygems-2.3.0-refactor-checking-really_verbose.patch - Fix escape sequence injection vulnerability in verbose. - Fix escape sequence injection vulnerabil…

  • Medium
    ELSA-2019-2237 2 CVEs

    Moderate: nss, nss-softokn, nss-util, and nspr security, bug fix, and enhancement update (Oracle Linux 7)

    nspr [4.21.0-1] - Rebase to NSPR 4.21 nss [3.44.0-4] - Fix certutil man page - Fix extracting a public key from a private key for dh, ec, and dsa [3.44.0-3] - Disable TLS 1.3 under FIPS mode - Disable RSASSA-PKCS1-v1_5 in TLS 1.3 - Fix post-handshake auth tra…

  • Medium max 5.3
    ELSA-2019-2110 1 CVE

    Moderate: rsyslog security and bug fix update (Oracle Linux 7)

    [8.24.0-38.0.2] - Newer gcc complains about implicit declaration of prctl. Added header file to quiesce the compiler [8.24.0-38] RHEL 7.7 ERRATUM - added patch increasing max path size preventing buffer overflow with too long paths resolves: rhbz#1656860 [8.2…

  • Medium
    ELSA-2019-2079 13 CVEs

    Moderate: Xorg security and bug fix update (Oracle Linux 7)

    gdm [3.28.2-16] - Dont bring up login screen if background session gets killed Related: #1680120 [3.28.2-15] - sync AllowMultipleSessionsPerUser patch from 7.6 branch Resolves: #1664353 - Create dconf dirs by default Resolves: #1664284 [3.28.2-14] - Fix unloc…

  • Medium
    ELSA-2019-2097 1 CVE

    Moderate: perl-Archive-Tar security update (Oracle Linux 7)

    [1.92-3] - CVE-2018-12015 - Directory traversal in Archive::Tar (bug #1592803)

  • Low
    ELSA-2019-2197 10 CVEs

    Low: elfutils security, bug fix, and enhancement update (Oracle Linux 7)

    [0.176-2] - Add elfutils-0.176-xlate-note.patch (#1704754) [0.176-1] - New upstream release (#1676504) CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7150, CVE-2019-7664, CVE-2019-7665, CVE-2018-16062, CVE-2018-16402, CVE-2018-16403, CVE-2018-18310, CV…

  • Medium max 5.8
    ELSA-2019-2294 1 CVE

    Moderate: libvirt security, bug fix, and enhancement update (Oracle Linux 7)

    [4.5.0-23] - api: disallow virDomainSaveImageGetXMLDesc on read-only connections (CVE-2019-10161) - api: disallow virDomainManagedSaveDefineXML on read-only connections (CVE-2019-10166) - api: disallow virConnectGetDomainCapabilities on read-only connections …

  • Medium
    ELSA-2019-2112 2 CVEs

    Moderate: mod_auth_openidc security update (Oracle Linux 7)

    [1.8.8-5] - Resolves: rhbz#1626297 - CVE-2017-6413 mod_auth_openidc: OIDC_CLAIM and OIDCAuthNHeader not skipped in an 'AuthType oauth20' configuration [rhel-7] [1.8.8-4] - Resolves: rhbz#1626299 - CVE-2017-6059 mod_auth_openidc: Shows user-supplied content on…

  • Medium max 8.7
    ELSA-2019-2125 10 CVEs

    Moderate: ovmf security and enhancement update (Oracle Linux 7)

    [20180508-6.gitee3198e672e2.el7] - ovmf-MdeModulePkg-HiiDatabase-Fix-potential-integer-overf.patch [bz#1691479] - ovmf-MdeModulePkg-HiiImage-Fix-stack-overflow-when-corrup.patch [bz#1691479] - ovmf-MdeModulePkg-PartitionDxe-Add-check-for-underlying-d.patch [b…

  • Medium max 6.5
    ELSA-2019-2060 1 CVE

    Moderate: dhcp security and bug fix update (Oracle Linux 7)

    [12:4.2.5-77.0.1] - Direct users to Oracle Linux support site. [12:4.2.5-77] - Resolves: #1712414 - Reset signal handlers set by isclib [12:4.2.5-76] - Resolves: #1704675 - Fix crash of dhcpd(6) triggered by bind rebase [12:4.2.5-75] - Resolves: #1672308 - Do…

  • Low
    ELSA-2019-2162 1 CVE

    Low: blktrace security update (Oracle Linux 7)

    [1.0.5-9] - Fix buffer overflow in the dev_map_read function (#1580579) Fixes CVE-2018-10689

  • Low
    ELSA-2019-2078 1 CVE

    Low: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 7)

    [1.5.3-167.el7] - Reverting kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503] - Resolves: bz#1618503 (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7]) [1.5.3-166.el7] - kvm-seccomp-set-the-seccomp-filter-to-all-thr…

  • Medium
    ELSA-2019-2258 2 CVEs

    Moderate: http-parser security update (Oracle Linux 7)

    [2.7.1-8] - Backport needed test fixes - Related: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser allowed for spaces inside Content-Length header values [rhel-7] [2.7.1-7] - Resolves: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser…

  • Medium max 9.8
    ELSA-2019-2272 2 CVEs

    Moderate: python-urllib3 security update (Oracle Linux 7)

    [1.10.2-7] - Provide python2-urllib3 - Add patch for CVE-2019-11236 Resolves: rhbz#1703360 [1.10.2-6] - Source URL switched to HTTPS protocol - Add patch for CVE-2018-20060 Resolves: rhbz#1658471

  • Low max 7.8
    ELSA-2019-2130 1 CVE

    Low: libreoffice security and bug fix update (Oracle Linux 7)

    [1:5.3.6.1-21.0.1] - Replaced RedHat colors with Oracle colors, and the filename redhat.soc with oracle.soc in specfile - Build with --with-vendor='Oracle America, Inc.' [1:5.3.6.1-21] - Resolves: rhbz#1066844 drop libreofficekit requires [1:5.3.6.1-20] - Res…

  • Low
    ELSA-2019-2308 1 CVE

    Low: libguestfs-winsupport security update (Oracle Linux 7)

    [7.2-3] - Fix for CVE-2019-9755 (heap-based buffer overflow leads to local root privilege escalation) resolves: rhbz#1698502

  • Medium
    ELSA-2019-2022 12 CVEs

    Moderate: poppler security, bug fix, and enhancement update (Oracle Linux 7)

    evince [3.28.2-8] - Do not free EvDocumentInfo in ev_window_save_print_settings(), - it is freed in EvDocuments destructor - Resolves: #1541358 [3.28.2-7] - Do not store page-scaling for documents with enforced - page-scaling - Resolves: #1541358 [3.28.2-6] -…

  • Medium
    ELSA-2019-2285 1 CVE

    Moderate: keepalived security and bug fix update (Oracle Linux 7)

    [1.3.5-16] - Rework previous misc_script/vrrp_script patch (#1667292) [1.3.5-15] - Rework previous checker comparison patch (#1715308) [1.3.5-14] - Make checker variables non global (#1715308) [1.3.5-13] - Fix comparison of checkers on reload (#1715308) [1.3.…

  • High max 7.3
    ELSA-2019-2465 1 CVE

    Important: ghostscript security update (Oracle Linux 8)

    [9.25-2.2] - Resolves: #1737336 - CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 (701394)

  • High
    ELSA-2019-4741 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.37.1] - Input: gtco - bounds check collection indent level (Grant Hernandez) [Orabug: 30074414] {CVE-2019-13631}

  • High
    ELSA-2019-4739 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.30.1] - xen: let alloc_xenballooned_pages() fail if not enough memory free (Juergen Gross) [Orabug: 30073695] - mm/page_alloc.c: calculate 'available' memory in a separate function (Igor Redko) [Orabug: 30073695] - Input: gtco - bounds check colle…

  • High max 5.6
    ELSA-2019-4733 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.14.35-1902.3.2] - x86/speculation: Exclude ATOMs from speculation through SWAPGS (Thomas Gleixner) [Orabug: 29967570] {CVE-2019-1125} - x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [Orabug: 29967570] {CVE-2019-1125} - x86/speculat…

  • High max 5.6
    ELSA-2019-4735 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.29.3.1] - x86/speculation: Exclude ATOMs from speculation through SWAPGS (Thomas Gleixner) [Orabug: 29967571] {CVE-2019-1125} - x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [Orabug: 29967571] {CVE-2019-1125} - x86/specula…

  • High max 8.8
    ELSA-2019-1972 1 CVE

    Important: ruby:2.5 security update (Oracle Linux 8)

    ruby [2.5.3-104] - Prohibit arbitrary code execution when installing a malicious gem. Resolves: CVE-2019-8324 rubygem-mongo [2.5.1-2] - Disable tests to fix FTBFS by dropped MongoDB module. Resolves: rhbz#1710863 rubygem-pg [1.0.0-2] - Assign a random testing…

  • Medium
    ELSA-2019-1951 4 CVEs

    Moderate: nss and nspr security, bug fix, and enhancement update (Oracle Linux 8)

    nspr [4.21.0-2] - Rebuild [4.21.0-1] - Update to NSPR 4.21 nss [3.44.0-7] - Backport fixes from 3.44.1 [3.44.0-6] - Add continuous RNG test required by FIPS - fipstest: use CKM_TLS12_MASTER_KEY_DERIVE instead of vendor specific mechanism [3.44.0-5] - Rebuild …

  • High max 8.2
    ELSA-2019-2004 3 CVEs

    Important: icedtea-web security update (Oracle Linux 8)

    [1.7.1-16] - Added Patch5, testTuning.patch to make tests pass inclean envirnment - Resolves: rhbz#1724958 [1.7.1-16] - added patch1, patch4 and patch11 to fix CVE-2019-10182 - added patch2 to fix CVE-2019-10181 - added patch3 and patch33 to fix CVE-2019-1018…