Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

  • High
    ELSA-2018-3350 6 CVEs

    Important: java-1.7.0-openjdk security update (Oracle Linux 7)

    [1:1.7.0.201-2.6.16.1.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.201-2.6.16.1] - Bump to 2.6.16 and u201b00. - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES) - Resolves: rhbz#1633817

  • High
    ELSA-2018-3410 1 CVE

    Important: xorg-x11-server security update (Oracle Linux 7)

    [1.20.1-5.1] - CVE-2018-14665: Disable -logfile and -modulepath when running with elevated privileges [1.20.1-5] - Call LeaveVT from xf86CrtcCloseScreen [1.20.1-4] - Hide the modesetting driver's atomic ioctl support behind Option 'Atomic'

  • High
    ELSA-2018-3458 7 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [60.2.1-4.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [60.2.1-4] - Fixing minor issues [60.2.1-3] - Reverting deleting of key3db [60.2.1-2] - Update to 60.2.1 - Added fix for rhbz#1546988 [60.0-1] - Rebase to v…

  • High
    ELSA-2018-4265 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.21.1] - hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:447! (Mike Kravetz) [Orabug: 28839992] - scsi: libsas: fix memory leak in sas_smp_get_phy_events() (Jason Yan) [Orabug: 27927687] {CVE-2018-7757} - KVM: vmx: shadow more fields that are rea…

  • Medium max 6.5
    ELSA-2018-3041 2 CVEs

    Moderate: python security and bug fix update (Oracle Linux 7)

    [2.7.5-76.0.1] - Add Oracle Linux distribution in platform.py [orabug 20812544] [2.7.5-76] - Remove an unversioned obsoletes tag Resolves: rhbz#1627059 [2.7.5-75] - Provide the /usr/libexec/platform-python symlink to the main binary Resolves: rhbz#1599159 [2.…

  • Medium
    ELSA-2018-3107 1 CVE

    Moderate: wpa_supplicant security and bug fix update (Oracle Linux 7)

    [1:2.6-12] - Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526) [1:2.6-11] - Better handling of /run/wpa_supplicant (rh #1507919) [1:2.6-10] - Fix memory leak when macsec MKA/PSK is used (rh #1500442) - Fix authentication failure when the MAC is…

  • Medium max 9.8
    ELSA-2018-3157 5 CVEs

    Moderate: curl and nss-pem security and bug fix update (Oracle Linux 7)

    curl [7.29.0-51] - require a new enough version of nss-pem to avoid regression in yum (#1610998) [7.29.0-50] - remove dead code, detected by Coverity Analysis - remove unused variable, detected by GCC and Clang [7.29.0-49] - make curl --speed-limit work with …

  • Medium max 5.9
    ELSA-2018-3050 3 CVEs

    Moderate: gnutls security, bug fix, and enhancement update (Oracle Linux 7)

    [3.3.29-8.0.1] - Include ECDSA KAT into selftests for FIPS140-2 compliance [Orabug 27484156] [3.3.29-8] - Backported --sni-hostname option which allows overriding the hostname advertised to the peer (#1444792) - Improved counter-measures in TLS CBC record pad…

  • Medium
    ELSA-2018-3052 1 CVE

    Moderate: wget security and bug fix update (Oracle Linux 7)

    [1.14-18] - Fix CVE-2018-0494 (#1576106) [1.14-17] - Fix segfault when Digest Authentication header is missing 'qop' part (#1545310) [1.14-16] - Fixed various security flaws (CVE-2017-13089, CVE-2017-13090)

  • High max 7.8
    ELSA-2018-3083 29 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

    [3.10.0-957] - [mm] mlock: avoid increase mm->locked_vm on mlock() when already mlock2(, MLOCK_ONFAULT) (Rafael Aquini) [1633059] [3.10.0-956] - [block] blk-mq: fix hctx debugfs entry related race between update hw queues and cpu hotplug (Ming Lei) [1619988] …

  • Medium
    ELSA-2018-3092 4 CVEs

    Moderate: glibc security, bug fix, and enhancement update (Oracle Linux 7)

    [2.17-260.0.9] - Regenerate plural.c - OraBug 28806294. - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> [2.17-260.0.7] - intl: Port to Bison 3.0 - Backport of upstream gettext commit 19f23e290a5e4a82b9edf9f5a4f8ab6192871be9 - OraBug 28806294. - Rev…

  • Medium
    ELSA-2018-3221 5 CVEs

    Moderate: openssl security, bug fix, and enhancement update (Oracle Linux 7)

    [1.0.2k-16.0.1] - sha256 is used for the RSA pairwise consistency test instead of sha1 [1.0.2k-16] - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA - fix incorrect error message on FIPS DSA parameter generation (#1603597) [1.0.2k-14] - …

  • Low
    ELSA-2018-3229 3 CVEs

    Low: zziplib security update (Oracle Linux 7)

    [0.13.62-9] - Fix covscan warning - 'Variable 'file' going out of scope leaks the storage it points to.' has been introduced by the original version of 0001-fix-CVE-2018-7725.patch - Related: 1558596 [0.13.62-8] - Fix CVE-2018-7727 - Resolves: 1558891 [0.13.6…

  • Medium
    ELSA-2018-3113 1 CVE

    Moderate: libvirt security, bug fix, and enhancement update (Oracle Linux 7)

    [4.5.0-10] - conf: correct false boot order error during domain parse (rhbz#1601318) [4.5.0-9] - virDomainDefCompatibleDevice: Relax alias change check (rhbz#1621910) - virDomainDetachDeviceFlags: Clarify update semantics (rhbz#1621910) - virDomainNetDefCheck…

  • Medium max 7.5
    ELSA-2018-3127 1 CVE

    Moderate: 389-ds-base security, bug fix, and enhancement update (Oracle Linux 7)

    [1.3.8.4-15] - Bump version to 1.3.8.4-15 - Resolves: Bug 1624004 - Fix regression in last patch [1.3.8.4-14] - Bump version to 1.3.8.4-14 - Resolves: Bug 1624004 - potential denial of service attack [1.3.8.4-13] - Bump version to 1.3.8.4-13 - Resolves: Bug 1…

  • Medium
    ELSA-2018-3335 1 CVE

    Moderate: xerces-c security update (Oracle Linux 7)

    [3.1.1-9] - Fix CVE-2016-4463 - Resolves: #1534481

  • Medium max 5.4
    ELSA-2018-3056 3 CVEs

    Moderate: samba security, bug fix, and enhancement update (Oracle Linux 7)

    [4.8.3-4] - resolves: #1614132 - Fix delete-on-close after smb2_find - resolves: #1614265 - Fix CVE-2018-1139 - resolves: #1614269 - Fix CVE-2018-10858 [4.8.3-3] - resolves: #1581016 - Add smbclient quiet argument [4.8.3-2] - related: #1538743 - Fix local use…

  • Medium
    ELSA-2018-3065 5 CVEs

    Moderate: libkdcraw security update (Oracle Linux 7)

    [4.10.5-5] - Resolves: #1557171, #1557189, #1558954 use the system LibRaw

  • Low
    ELSA-2018-3327 4 CVEs

    Low: libmspack security update (Oracle Linux 7)

    [0.5-0.6.alpha] - Fixes for CVE-2018-14679 CVE-2018-14680 CVE-2018-14681 CVE-2018-14682 - resolves: rhbz#1611550 rhbz#1611551 rhbz#1611552 rhbz#1611553

  • Medium max 6.5
    ELSA-2018-3242 1 CVE

    Moderate: glusterfs security, bug fix, and enhancement update (Oracle Linux 7)

    [3.12.2-18] - fixes bugs bz#1524336 bz#1622029 bz#1622452 [3.12.2-17] - fixes bugs bz#1615578 bz#1619416 bz#1619538 bz#1620469 bz#1620765 [3.12.2-16] - fixes bugs bz#1569657 bz#1608352 bz#1609163 bz#1609724 bz#1610825 bz#1611151 bz#1612098 bz#1615338 bz#16154…

  • Medium
    ELSA-2018-3073 8 CVEs

    Moderate: zsh security and bug fix update (Oracle Linux 7)

    [5.0.2-31] - fix defects detected by Coverity related to CVE-2017-18206 and CVE-2018-1083 [5.0.2-30] - fix stack-based buffer overflow in utils.c:checkmailpath() (CVE-2018-1100) - fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083) - fix st…

  • Low
    ELSA-2018-3059 1 CVE

    Low: X.org X11 security, bug fix, and enhancement update (Oracle Linux 7)

    freeglut [3.0.0-8] - HTTPS URLs - Pin soname to libglut.so.3 in the %files glob [3.0.0-7] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [3.0.0-6] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild [3.0.0-5] - Re…

  • Medium
    ELSA-2018-3090 1 CVE

    Moderate: ovmf security, bug fix, and enhancement update (Oracle Linux 7)

    [20180508-3.gitee3198e672e2.el7] - ovmf-redhat-provide-virtual-bundled-OpenSSL-in-OVMF.patch [bz#1607792] - Resolves: bz#1607792 (add 'Provides: bundled(openssl) = 1.1.0h' to the spec file) [20180508-2.gitee3198e672e2] - OvmfPkg/PlatformBootManagerLib: connec…

  • Low max 4.8
    ELSA-2018-3249 1 CVE

    Low: setup security and bug fix update (Oracle Linux 7)

    [2.8.71-10] - fix crudp name in /etc/protocols (#1566469) - do not list /sbin/nologin and /usr/sbin/nologin in /etc/shells (#1571104)

  • Low
    ELSA-2018-3253 2 CVEs

    Low: jasper security update (Oracle Linux 7)

    [1.900.1-33] - remove implicit declaration of jas_eprintf (#1585830) [1.900.1-32] - Fix CVE-2016-9396 (#1583721) - Fix CVE-2017-1000050 (#1585830)

  • Low
    ELSA-2018-3032 11 CVEs

    Low: binutils security, bug fix, and enhancement update (Oracle Linux 7)

    [2.27-34.base.0.1] - Backport of upstream commit a5def14f1ca70e14d9433cb229c9369fa3051598 Add a test for R_386_GOT32/R_386_GOT32X IFUNC reloc error [Orabug 27930573] [2.27-34.base] - Fix seg-fault parsing corrupt AOUT format files. (#1579799) - Fix seg-fault …

  • Low
    ELSA-2018-3071 2 CVEs

    Low: krb5 security, bug fix, and enhancement update (Oracle Linux 7)

    [1.15.1-34] - In FIPS mode, add plaintext fallback for RC4 usages and taint - Resolves: #1570600 [1.15.1-33] - Use SHA-256 instead of MD5 for audit ticket IDs - Resolves: #1570600 [1.15.1-32] - Include preauth name in trace output if possible - Update cert ge…

  • Low max 3.8
    ELSA-2018-3158 1 CVE

    Low: sssd security, bug fix, and enhancement update (Oracle Linux 7)

    [1.16.2-13] - Resolves: rhbz#1593756 - sssd needs to require a newer version of libtalloc and libtevent to avoid an issue in GPO processing [1.16.2-12] - Resolves: rhbz#1610667 - sssd_ssh leaks file descriptors when more than one certificate is converted into…

  • Low
    ELSA-2018-3246 3 CVEs

    Low: libcdio security update (Oracle Linux 7)

    [0.92-3] - fix CVE-2017-18198 and CVE-2017-18199 - Resolves: rhbz#1553769 - Resolves: rhbz#1553604 [0.92-2] - fix CVE-2017-18201 - Resolves: rhbz#1553621

  • Medium
    ELSA-2018-3140 6 CVEs

    Moderate: GNOME security, bug fix, and enhancement update (Oracle Linux 7)

    PackageKit [1.1.10-1.0.1] - remove PackageKit-0.3.8-Fedora-Vendor.conf.patch [1.1.10-1] - New upstream release - Resolves: #1576494 accountsservice [0.6.50-2] - Fix user switching Resolves: #1597350 [0.6.50-1] - Update to 0.6.50 Related: #1576538 Related: 159…

  • High max 7.5
    ELSA-2018-4262 10 CVEs

    Important: qemu security update (Oracle Linux 7)

    [12:2.9.0-17.el7] - i386: Remove generic SMT thread check (Babu Moger) [Orabug: 28676425] - pc: Fix typo on PC_COMPAT_2_12 (Eduardo Habkost) [Orabug: 28676425] - i386: Enable TOPOEXT feature on AMD EPYC CPU (Babu Moger) [Orabug: 28676425] - net: ignore packet…

  • Critical
    ELSA-2018-3005 7 CVEs

    Critical: firefox security and bug fix update (Oracle Linux 7)

    [60.3.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [60.3.0-1] - Update to 60.3.0 ESR [60.2.2-2] - Added patch for rhbz#1633932

  • High
    ELSA-2018-4261 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.20.7] - Revert 'rds: RDS (tcp) hangs on sendto() to unresponding address' (Brian Maly) [Orabug: 28837953] [4.1.12-124.20.6] - x86/speculation: Retpoline should always be available on Skylake (Alexandre Chartre) [Orabug: 28801831] [4.1.12-124.20.5]…

  • Critical
    ELSA-2018-2942 7 CVEs

    Critical: java-1.8.0-openjdk security update (Oracle Linux 7)

    [1:1.8.0.191.b12-0] - Update to aarch64-shenandoah-jdk8u191-b12. - Resolves: rhbz#1633817 [1:1.8.0.191.b10-0] - Update to aarch64-shenandoah-jdk8u191-b10. - Drop 8146115/PR3508/RH1463098 applied upstream. - Resolves: rhbz#1633817 [1:1.8.0.181.b16-0] - Add new…

  • High max 7.5
    ELSA-2018-2921 1 CVE

    Important: tomcat security update (Oracle Linux 7)

    [0:7.0.76-8] - Resolves: rhbz#1608608 CVE-2018-1336 tomcat: A bug in the UTF 8 decoder can lead to DoS

  • High
    ELSA-2018-2918 4 CVEs

    Important: ghostscript security update (Oracle Linux 7)

    [9.07-29.el7_5.2] - Fix MediaPosition, ManualFeed and MediaType with pxl devices (bug #1629842) [9.07-29.el7_5.1] - Added security fixes for: - CVE-2018-16509 (bug #1621156) - CVE-2018-15910 (bug #1621157) - CVE-2018-16542 (bug #1621380) [9.07-29] - Fix rare …

  • High
    ELSA-2018-4249 2 CVEs

    Important: openssl security update (Oracle Linux 7)

    [1.0.2k-12.0.3] - Oracle bug 28672370: backport CVE-2018-0732 - Oracle bug 28672351: backport CVE-2018-0737

  • High
    ELSA-2018-2916 2 CVEs

    Important: spamassassin security update (Oracle Linux 7)

    [3.4.0-4] - Add missing Requires for perl(XSLoader) and perl(ExtUtils::MakeMaker), - which are no longer auto-generated due to a (expected) change in rpm-build - Related: rhbz#1632998 [3.4.0-3] - Fix CVE-2018-11781 - Local user code injection in the meta rule…

  • High
    ELSA-2018-4244 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.20.1] - bnxt_en: xdp: don't make drivers report attachment mode (partial backport) (Somasundaram Krishnasamy) [Orabug: 27988326] - bpf: make bnxt compatible w/ bpf_xdp_adjust_tail (Nikita V. Shirokov) [Orabug: 27988326] - bnxt_en: add meta pointer…

  • High
    ELSA-2018-4245 3 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.25.1] - x86/spectre_v2: Don't check microcode versions when running under hypervisors (Konrad Rzeszutek Wilk) [Orabug: 27959785] - rds: CVE-2018-7492: Fix NULL pointer dereference in __rds_rdma_map (Hakon Bugge) [Orabug: 28552792] {CVE-…