Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,323 results · Feed

High max 5.3

ELSA-2019-1309 12 CVEs

Important: thunderbird security update (Oracle Linux 7)

[60.7.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [60.7.0-1] - Update to 60.7.0

Jun 3, 2019
High max 5.9

ELSA-2019-4669 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.27.2] - x86/speculation/mds: Check for the right microcode before setting mitigation (Kanth Ghatraju) [Orabug: 29797118] - vxlan: test dev->flags & IFF_UP before accessing vxlan->dev->dev_addr (Venkat Venkatsubra) [Orabug: 29710939] - vxlan: test …

May 31, 2019
High max 7.5

ELSA-2019-1294 1 CVE

Important: bind security update (Oracle Linux 7)

[32:9.9.4-74.1] - Remove again broken test (CVE-2018-5743) [32:9.9.4-74] - Fix CVE-2018-5743

May 30, 2019
Critical max 5.3

ELSA-2019-1265 13 CVEs

Critical: firefox security update (Oracle Linux 7)

[60.7.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [60.7.0-1] - Updated to 60.7.0 ESR [60.6.3-1] - Updated to 60.6.3 ESR [60.6.2-1] - Updated to 60.6.2 ESR [60.6.1-2] - Added fix for mozbz#526293 - show remote locat…

May 24, 2019
High max 8.8

ELSA-2019-1264 1 CVE

Important: libvirt security and bug fix update (Oracle Linux 7)

[4.5.0-10.0.1] - added librbd1 as dependency (Keshav Sharma) [4.5.0-10.el7_6.10] - virnwfilterbindingobj: Introduce and use virNWFilterBindingObjStealDef (rhbz#1702173) - admin: reject clients unless their UID matches the current UID (CVE-2019-10132) - lockin…

May 23, 2019
High max 6.5

ELSA-2019-4652 11 CVEs

Important: curl security update (Oracle Linux 7)

[7.29.0-51.0.1] - Security Fixes [OraBug: 28939992] - CVE-2016-8615 cookie injection for other servers (https://curl.haxx.se/docs/CVE-2016-8615.html) - CVE-2016-8616 case insensitive password comparison (https://curl.haxx.se/docs/CVE-2016-8616.html) - CVE-201…

May 21, 2019
High max 8.8

ELSA-2019-1235 4 CVEs

Important: ruby security update (Oracle Linux 7)

[2.0.0.648-35] - Introduce method as precondition to fix CVE-2019-8321. * rubygems-2.3.0-refactor-checking-really_verbose.patch - Fix escape sequence injection vulnerability in verbose. - Fix escape sequence injection vulnerability in gem owner. - Fix escape …

May 16, 2019
High

ELSA-2019-4644 6 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.34.1] - Input: wacom - move the USB (now hid) Wacom driver in drivers/hid (Benjamin Tissoires) [Orabug: 25512494] {CVE-2016-3139} - net: qmi_wwan: fix divide by 0 on bad descriptors (Bjorn Mork) [Orabug: 27215229] {CVE-2017-16650} - USB…

May 16, 2019
High max 5.9

ELSA-2019-4643 6 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1844.5.3] - x86/mds: Add empty commit for CVE-2019-11091 (Konrad Rzeszutek Wilk) [Orabug: 29721848] {CVE-2019-11091} - x86/speculation/mds: Make mds_mitigation mutable after init (Konrad Rzeszutek Wilk) [Orabug: 29721835] {CVE-2018-12126} {CVE-2018-1…

May 16, 2019
High max 5.9

ELSA-2019-1178 4 CVEs

Important: qemu-kvm security update (Oracle Linux 7)

[1.5.3-160.el7_6.2] - kvm-target-i386-define-md-clear-bit-rhel.patch - Resolves: bz#1693216 (qemu-kvm: hardware: Microarchitectural Store Buffer Data Sampling)

May 15, 2019
High

ELSA-2019-1228 1 CVE

Important: wget security update (Oracle Linux 7)

[1.14-18.1] - Fix CVE-2019-5953 (#1696733)

May 15, 2019
High max 5.9

ELSA-2019-1168 4 CVEs

Important: kernel security update (Oracle Linux 7)

[3.10.0-957.12.2.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-957.12.2] - [x86] x86/specula…

May 15, 2019
High max 5.9

ELSA-2019-1177 4 CVEs

Important: libvirt security update (Oracle Linux 7)

[4.5.0-10.0.1] - bump the version [4.5.0-10.el7_6.9] - qemu: Don't cache microcode version (CVE-2018-12127, CVE-2018-12126, CVE-2018-12130) [4.5.0-10.el7_6.8] - cpu_x86: Do not cache microcode version (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130) - cputest…

May 15, 2019
High

ELSA-2019-4642 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.27.1] - scsi: libfc: sanitize E_D_TOV and R_A_TOV setting (Hannes Reinecke) [Orabug: 25933179] - scsi: libfc: use configured rport E_D_TOV (Hannes Reinecke) [Orabug: 25933179] - scsi: libfc: additional debugging messages (Hannes Reinecke) [Orabug:…

May 15, 2019
High max 5.9

ELSA-2019-4630 4 CVEs

Important: qemu security update (Oracle Linux 7)

[15:3.1.0-3.el7] - x86: Document CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 as fixed (Mark Kanda) [Orabug: 29744956] {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091} [15:3.1.0-2.el7] - x86: Add mds feature (Karl Heubaum) - …

May 14, 2019
High max 5.9

ELSA-2019-4629 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.26.12] - x86/mds: Add empty commit for CVE-2019-11091 (Konrad Rzeszutek Wilk) [Orabug: 29721935] {CVE-2019-11091} - x86/microcode: Add loader version file in debugfs (Boris Ostrovsky) [Orabug: 29754165] - x86/microcode: Fix CPU synchronization rou…

May 14, 2019
High max 5.9

ELSA-2019-4640 13 CVEs

Important: qemu security update (Oracle Linux 7)

[15:3.1.0-3.el7] - x86: Document CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 as fixed (Mark Kanda) [Orabug: 29744956] {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091} [15:3.1.0-2.el7] - x86: Add mds feature (Karl Heubaum) - …

May 14, 2019
High max 5.9

ELSA-2019-4636 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.33.2] - x86/speculation/mds: Make cpu_matches() __cpuinit (Patrick Colp) [Orabug: 29751729] {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091} - x86/speculation/mds: Only worry about firmware loaded microcode (Patrick C…

May 14, 2019
High max 5.9

ELSA-2019-4628 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1844.4.5.2] - x86/mds: Add empty commit for CVE-2019-11091 (Konrad Rzeszutek Wilk) [Orabug: 29721848] {CVE-2019-11091} - x86/speculation/mds: Make mds_mitigation mutable after init (Konrad Rzeszutek Wilk) [Orabug: 29721835] {CVE-2018-12126} {CVE-2018…

May 14, 2019
High

ELSA-2019-4631 0 CVEs

Important: qemu security update (Oracle Linux 7)

[12:2.9.0-21.el7] - x86: Add mds feature (Karl Heubaum) - e1000: Never increment the RX undersize count register (Chris Kenna) - i386: Add some MSR based features on Cascadelake-Server CPU model (Tao Xu) [Orabug: 29643540] - i386: Update stepping of Cascadela…

May 14, 2019
High

ELSA-2019-1131 2 CVEs

Important: freeradius security update (Oracle Linux 7)

[3.0.13-10] - Fixes two EAP-PWD security issues Resolves: bz#1699413 authentication bypass with an invalid curve attack

May 9, 2019
High max 8.6

ELSA-2019-1022 1 CVE

Important: python-jinja2 security update (Oracle Linux 7)

[2.7.2-3] - Fix for CVE-2016-10745 Resolves: rhbz#1701308

May 8, 2019
High max 7.3

ELSA-2019-1017 1 CVE

Important: ghostscript security update (Oracle Linux 7)

[9.07-31.el7_6.11] - Resolves: #1673398 - CVE-2019-3839 ghostscript: missing attack vector protections for CVE-2019-6116 - fix for pdf2dsc regression added

May 7, 2019
High

ELSA-2019-1024 1 CVE

Important: flatpak security update (Oracle Linux 7)

[1.0.2-5] - Fix IOCSTI sandbox bypass (#1700651)

May 7, 2019
High

ELSA-2019-0818 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-957.12.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-957.12.1] - [kernel] locking/…

Apr 23, 2019
High

ELSA-2019-0809 1 CVE

Important: ovmf security update (Oracle Linux 7)

[20180508-3.gitee3198e672e2.el7_6.1] - ovmf-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch [bz#1684006] - ovmf-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch [bz#1684006] - Resolves: bz#1684006 (CVE-2018-12180 OVMF: edk2: Buffer Overfl…

Apr 23, 2019
High

ELSA-2019-0791 3 CVEs

Important: java-1.7.0-openjdk security update (Oracle Linux 7)

[1:1.7.0.221-2.6.18.0.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.221-2.6.18.0] - Bump to 2.6.18 and OpenJDK 7u221-b02. - Resolves: rhbz#1693468

Apr 22, 2019
High

ELSA-2019-4619 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.26.10] - x86/apic: Make arch_setup_hwirq NUMA node aware (Henry Willard) [Orabug: 29534769] [4.1.12-124.26.9] - KEYS: encrypted: fix buffer overread in valid_master_desc() (Eric Biggers) [Orabug: 29591025] {CVE-2017-13305} [4.1.12-124.26.8] - scsi…

Apr 20, 2019
High

ELSA-2019-0775 3 CVEs

Important: java-1.8.0-openjdk security update (Oracle Linux 7)

[1:1.8.0.212.b04-0] - Update to aarch64-shenandoah-jdk8u212-b04. - Resolves: rhbz#1693468 [1:1.8.0.212.b03-0] - Update to aarch64-shenandoah-jdk8u212-b03. - Resolves: rhbz#1693468 [1:1.8.0.212.b02-0] - Update to aarch64-shenandoah-jdk8u212-b02. - Remove patch…

Apr 17, 2019
Medium

ELSA-2019-0778 2 CVEs

Moderate: java-11-openjdk security update (Oracle Linux 7)

[1:11.0.3.7-0.0.1] - link atomic for ix86 build [1:11.0.3.7-0] - Add -mstackrealign workaround to build flags to avoid SSE issues on x86 - Resolves: rhbz#1693468 [1:11.0.3.7-0] - Update to shenandoah-jdk-11.0.3+7 (April 2019 GA) - Resolves: rhbz#1693468 [1:11…

Apr 17, 2019
High max 8.1

ELSA-2019-0766 2 CVEs

Important: mod_auth_mellon security and bug fix update (Oracle Linux 7)

[0.14.0-2.4] - Actually apply the patch in the previous build - Resolves: rhbz#1697488 - CVE-2019-3877 mod_auth_mellon: open redirect in logout url when using URLs with backslashes [0.14.0-2.3] - Resolves: rhbz#1697488 - CVE-2019-3877 mod_auth_mellon: open re…

Apr 16, 2019
High

ELSA-2019-4609 0 CVEs

Important: kubernetes security update (Oracle Linux 7)

[1.9.11-2.5.1] - [OLCNE-235] [CVE-2019-9946] portmap inserts rules at the front of the iptables nat chains [1.9.11-2.4.1] - [CVE-2019-1002101] kubectl fix potential directory traversal [1.9.11-2.3.1] - [CVE-2019-1002100] Limit the number of operations in a si…

Apr 13, 2019
High

ELSA-2019-4610 0 CVEs

Important: kubernetes security update (Oracle Linux 7)

[1.10.5-2.5.4] - [OLCNE-235] [CVE-2019-9946] portmap inserts rules at the front of the iptables nat chains [1.10.5-2.4.4] - [CVE-2019-1002101] kubectl fix potential directory traversal [1.10.5-2.3.4] - [CVE-2019-1002100] Limit the number of operations in a si…

Apr 13, 2019
High max 6.4

ELSA-2019-4593 2 CVEs

Important: kubernetes kubeadm-upgrade kubeadm-ha-setup security update (Oracle Linux 7)

kubernetes [1.12.7-1.1.2] - [OLCNE-257] fix coredns issue and minor upgrade issue [1.12.7-1.1.1] - [OLCNE-235] [CVE-2019-9946] portmap inserts rules at the front of the iptables nat chains [1.12.7-1.0.1] - Add Oracle Build Files For Version v1.12.7 kubeadm-up…

Apr 13, 2019
High

ELSA-2019-4611 0 CVEs

Important: kubernetes security update (Oracle Linux 7)

[1.11.3-2.5.2] - [OLCNE-235] [CVE-2019-9946] portmap inserts rules at the front of the iptables nat chains [1.11.3-2.4.2] - [CVE-2019-1002101] kubectl fix potential directory traversal [1.11.3-2.3.2] - [CVE-2019-1002100] Limit the number of operations in a si…

Apr 13, 2019
High

ELSA-2019-4612 7 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1844.4.5] - x86/apic/x2apic: set back affinity of a single interrupt to one cpu (Mridula Shastry) [Orabug: 29510342] [4.14.35-1844.4.4] - ext4: fix data corruption caused by unaligned direct AIO (Lukas Czerner) [Orabug: 29598590] - swiotlb: checking …

Apr 12, 2019
High max 5.3

ELSA-2019-0710 1 CVE

Important: python security update (Oracle Linux 7)

[2.7.5-77.0.1] - Add Oracle Linux distribution in platform.py [orabug 20812544] [2.7.5-77] - Security fix for CVE-2019-9636 Resolves: rhbz#1689316

Apr 10, 2019
High max 7.3

ELSA-2019-4600 5 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.32.1] - x86/fpu: Factor out memset(xstate, 0) in fpu_finit() paths (Oleg Nesterov) [Orabug: 29012034] - x86/fpu: Always allow FPU in interrupt if use_eager_fpu() (Oleg Nesterov) [Orabug: 29012034] - x86/fpu: Fix 32-bit signal frame hand…

Apr 8, 2019
High

ELSA-2019-4597 1 CVE

Important: docker-engine security update (Oracle Linux 7)

[18.03.1.ol-0.0.14] - rebuild [18.03.1.ol-0.0.13] - update for CVE-2018-20699

Apr 2, 2019
High

ELSA-2019-0697 3 CVEs

Important: freerdp security update (Oracle Linux 7)

[1.0.2-15.1] - Fix CVE-2018-8786 (#1684152) - Fix CVE-2018-8787 (#1684156) - Fix CVE-2018-8788 (#1684163)

Apr 2, 2019