Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

High

ELSA-2018-4242 5 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1818.3.3] - net: net_failover: fix typo in net_failover_slave_register() (Liran Alon) [Orabug: 28122110] - virtio_net: Extend virtio to use VF datapath when available (Sridhar Samudrala) [Orabug: 28122110] - virtio_net: Introduce VIRTIO_NET_F_STANDBY…

Oct 10, 2018
Critical

ELSA-2018-2884 2 CVEs

Critical: firefox security update (Oracle Linux 7)

[60.2.2-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [60.2.2-1] - Update to 60.2.2 ESR

Oct 8, 2018
High max 7.8

ELSA-2018-4233 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.24.3] - exec: Limit arg stack to at most 75% of _STK_LIM (Kees Cook) [Orabug: 28710010] {CVE-2018-14634}

Sep 28, 2018
High max 7.8

ELSA-2018-4230 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.19.6] - exec: Limit arg stack to at most 75% of _STK_LIM (Kees Cook) [Orabug: 28709994] {CVE-2018-14634}

Sep 28, 2018
Medium

ELSA-2018-2835 2 CVEs

Moderate: firefox security update (Oracle Linux 7)

[60.2.1-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [60.2.1-1] - Update to 60.2.1 ESR

Sep 27, 2018
High max 7.8

ELSA-2018-2748 1 CVE 1 exploited

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-862.14.4.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-862.14.4] - [scsi] Revert: lp…

Sep 26, 2018
High

ELSA-2018-4227 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.19.5] - nsfs: mark dentry with DCACHE_RCUACCESS (Cong Wang) [Orabug: 28576290] {CVE-2018-5873} - dm crypt: add middle-endian variant of plain64 IV (Konrad Rzeszutek Wilk) [Orabug: 28604628] - IB/ipoib: Improve filtering log message (Yuval Shaia) […

Sep 26, 2018
Medium

ELSA-2018-2768 1 CVE

Moderate: nss security update (Oracle Linux 7)

[3.36.0-7] - Backport upstream fix for CVE-2018-12384 - Remove nss-lockcert-api-change.patch, which turned out to be a mistake (the symbol was not exported from libnss) [3.36.0-6] - Exercise SSL tests which only run under non-FIPS setting

Sep 25, 2018
Medium max 7.5

ELSA-2018-2757 4 CVEs

Moderate: 389-ds-base security and bug fix update (Oracle Linux 7)

[1.3.7.5-28] - Bump version to 1.3.7.5-28 - Resolves: Bug 1628676 - 389-ds-base: race condition on reference counter leads to DoS using persistent search - Resolves: Bug 1628677 - Crash in delete_passwdPolicy when persistent search connections are terminated …

Sep 25, 2018
Medium

ELSA-2018-2766 1 CVE

Moderate: flatpak security update (Oracle Linux 7)

[0.8.8-4] - Add patch for CVE-2018-6560 (#1547376)

Sep 25, 2018
High max 8.3

ELSA-2018-2731 1 CVE

Important: spice and spice-gtk security update (Oracle Linux 7)

spice [0.14.0-2.0.2] - add arm suppport [0.14.0-2.5] - Fix flexible array buffer overflow Resolves: rhbz#1596008 spice-gtk [0.34-3.2] - Fix flexible array buffer overflow Resolves: rhbz#1596008

Sep 20, 2018
High

ELSA-2018-4216 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.19.2] - tcp: add tcp_ooo_try_coalesce() helper (Eric Dumazet) [Orabug: 28639707] {CVE-2018-5390} - tcp: call tcp_drop() from tcp_data_queue_ofo() (Eric Dumazet) [Orabug: 28639707] {CVE-2018-5390} - tcp: detect malicious patterns in tcp_collapse_of…

Sep 14, 2018
High max 5.6

ELSA-2018-4215 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.24.2] - x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit (Vlastimil Babka) [Orabug: 28505476] {CVE-2018-3620} - x86/speculation/l1tf: Protect PAE swap entries against L1TF (Vlastimil Babka) [Orabug: 28505476] {CVE-2018-36…

Sep 13, 2018
Critical

ELSA-2018-2692 5 CVEs

Critical: firefox security update (Oracle Linux 7)

[60.2.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [60.2.0-1] - Update to 60.2.0 ESR [60.1.0-9] - Do not set user agent (rhbz#1608065) - GTK dialogs are localized now (rhbz#1619373) - JNLP association works again (r…

Sep 12, 2018
High

ELSA-2018-4211 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.24.1] - mm/mempolicy: fix use after free when calling get_mempolicy (zhong jiang) [Orabug: 28022108] {CVE-2018-10675} - Fix up non-directory creation in SGID directories (Linus Torvalds) [Orabug: 28459478] {CVE-2018-13405} - ALSA: seq: …

Sep 10, 2018
High

ELSA-2018-4210 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.19.1] - x86/entry/64: Ensure %ebx handling correct in xen_failsafe_callback (George Kennedy) [Orabug: 28402927] {CVE-2018-14678} - x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+ (Andi Kleen) [Orabug: 28488808] {CVE-2018-3620} - x86/…

Sep 6, 2018
High

ELSA-2018-4208 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.18.9] - rebuild bumping release [4.1.12-124.18.8] - Cipso: cipso_v4_optptr enter infinite loop (yujuan.qi) [Orabug: 28563992] {CVE-2018-10938} - Btrfs: fix list_add corruption and soft lockups in fsync (Liu Bo) [Orabug: 28119834] - x86/paravirt: F…

Sep 4, 2018
High max 7.5

ELSA-2018-2570 1 CVE

Important: bind security update (Oracle Linux 7)

[32:9.9.4-61.1] - Fix CVE-2018-5740

Aug 27, 2018
High max 8.5

ELSA-2018-2557 1 CVE

Important: postgresql security update (Oracle Linux 7)

[9.2.24-1] - update to the latest 9.2 release - fix CVE-2018-10915

Aug 23, 2018
High

ELSA-2018-2526 3 CVEs

Important: mutt security update (Oracle Linux 7)

[5:1.5.21-28] - Resolves: CVE-2018-14354 CVE-2018-14357 CVE-2018-14362

Aug 20, 2018
Medium

ELSA-2018-2439 21 CVEs

Moderate: mariadb security and bug fix update (Oracle Linux 7)

[1:5.5.60-1] - Rebase to 5.5.60 - CVE's fixed: #1558256, #1558260, #1559060 CVE-2017-3636 CVE-2017-3641 CVE-2017-3653 CVE-2017-10379 CVE-2017-10384 CVE-2017-10378 CVE-2017-10268 CVE-2018-2562 CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668 CVE-2018-27…

Aug 16, 2018
High

ELSA-2018-2462 2 CVEs

Important: qemu-kvm security and bug fix update (Oracle Linux 7)

[1.5.3-156.el7_5.5] - kvm-multiboot-bss_end_addr-can-be-zero.patch [bz#1549824] - kvm-multiboot-Remove-unused-variables-from-multiboot.c.patch [bz#1549824] - kvm-multiboot-Use-header-names-when-displaying-fields.patch [bz#1549824] - kvm-multiboot-fprintf-stde…

Aug 16, 2018
High

ELSA-2018-4200 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.18.6] - qla2xxx: Update the version to 9.00.00.00.41.0-k1. (Giridhar Malavali) [Orabug: 28172611] - qla2xxx: Utilize complete local DMA buffer for DIF PI inforamtion. (Giridhar Malavali) [Orabug: 28172611] - qla2xxx: Correction to total data segme…

Aug 16, 2018
High max 5.5

ELSA-2018-4198 1 CVE

Important: qemu security update (Oracle Linux 7)

[12:2.9.0-11.1.el7] - i386: Define the Virt SSBD MSR and handling of it (CVE-2018-3639) (Konrad Rzeszutek Wilk) [Orabug: 28110449] {CVE-2018-3639} - i386: define the AMD 'virt-ssbd' CPUID feature bit (CVE-2018-3639) (Konrad Rzeszutek Wilk) [Orabug: 28110449] …

Aug 15, 2018
High max 5.6

ELSA-2018-4196 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.18.5] - inet: frag: enforce memory limits earlier (Eric Dumazet) [Orabug: 28450977] - x86/mm/pageattr.c: fix page prot mask (Mihai Carabas) [Orabug: 28492122] - x86/pgtable.h: fix PMD/PUD mask (Mihai Carabas) [Orabug: 28492122] - x86/asm: Add pud/…

Aug 14, 2018
High max 5.6

ELSA-2018-2384 7 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-862.11.6.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-862.11.6] - [kernel] cpu/hotp…

Aug 14, 2018
High max 5.6

ELSA-2018-4195 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1818.1.6] - ipv4: frags: handle possible skb truesize change (Eric Dumazet) [Orabug: 28481663] {CVE-2018-5391} [4.14.35-1818.1.5] - inet: frag: enforce memory limits earlier (Eric Dumazet) [Orabug: 28481663] {CVE-2018-5391} - init/main.c: reorder boo…

Aug 14, 2018
High

ELSA-2018-4193 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.23.1] - xen/blkback: free requests on disconnection (Dongli Zhang) [Orabug: 22111941] - RDS: null pointer dereference in rds_atomic_free_op (Mohamed Ghannam) [Orabug: 27986376] {CVE-2018-5333} - ACPI: sbshc: remove raw pointer from prin…

Aug 9, 2018
High

ELSA-2018-4190 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1818.0.15] - tcp: add tcp_ooo_try_coalesce() helper (Eric Dumazet) [Orabug: 28453849] {CVE-2018-5390} - tcp: call tcp_drop() from tcp_data_queue_ofo() (Eric Dumazet) [Orabug: 28453849] {CVE-2018-5390} - tcp: detect malicious patterns in tcp_collapse_…

Aug 7, 2018
High

ELSA-2018-4189 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-1818.0.14] - tcp: add tcp_ooo_try_coalesce() helper (Eric Dumazet) [Orabug: 28453849] {CVE-2018-5390} - tcp: call tcp_drop() from tcp_data_queue_ofo() (Eric Dumazet) [Orabug: 28453849] {CVE-2018-5390} - tcp: detect malicious patterns in tcp_collapse_…

Aug 6, 2018
High max 8.8

ELSA-2018-2285 1 CVE

Important: yum-utils security update (Oracle Linux 7)

[1.1.31-46.0.1] - needs-restarting not checking kernel-uek for reboot message [Orabug 27189714] - add bug27596617.patch to remove upstream URL reference [1.1.31-46] - reposync: prevent path traversal. - Resolves: bug#1600617

Jul 30, 2018
Medium

ELSA-2018-2286 1 CVE

Moderate: java-1.7.0-openjdk security update (Oracle Linux 7)

[1:1.7.0.191-2.6.15.4.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.191-2.6.15.4] - Bump to revised 2.6.15 tarball with PR3616 -notimestamp javadoc fix - Resolves: rhbz#1594249 [1:1.7.0.191-2.6.15.3] - Bump to revised 2.6.15 tarball with jdk7u191-b01 - Resol…

Jul 30, 2018
High

ELSA-2018-2252 11 CVEs

Important: thunderbird security update (Oracle Linux 7)

[52.9.1-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [52.9.1-1] - Update to 52.9.1

Jul 24, 2018
High

ELSA-2018-2240 1 CVE

Important: openslp security update (Oracle Linux 7)

[1:2.0.0-7] - Fix possible heap memory corruption, CVE-2017-17833 Resolves: #1575698

Jul 23, 2018
Medium

ELSA-2018-2242 1 CVE

Moderate: java-1.8.0-openjdk security and bug fix update (Oracle Linux 7)

[1:1.8.0.181-7.b13] - Update to aarch64-jdk8u181-b13 and aarch64-shenandoah-jdk8u181-b13. - Remove 8187577/PR3578 now applied upstream. - Resolves: rhbz#1594249 [1:1.8.0.181-3.b04] - Fix hook to show hs_err*.log files on failures. - Resolves: rhbz#1594249 [1:…

Jul 23, 2018
High

ELSA-2018-2181 1 CVE

Important: gnupg2 security update (Oracle Linux 7)

[2.0.22-5] - fix CVE-2018-12020 - missing sanitization of original filename

Jul 11, 2018
High max 5.5

ELSA-2018-4161 7 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.17.1] - block: update integrity interval after queue limits change (Ritika Srivastava) [Orabug: 27586756] - dccp: check sk for closed state in dccp_sendmsg() (Alexey Kodanev) [Orabug: 28001529] {CVE-2017-8824} {CVE-2018-1130} - net/rds: Implement …

Jul 10, 2018
High max 5.5

ELSA-2018-4164 9 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.22.1] - dm: fix race between dm_get_from_kobject() and __dm_destroy() (Hou Tao) {CVE-2017-18203} - drm: udl: Properly check framebuffer mmap offsets (Greg Kroah-Hartman) [Orabug: 27986407] {CVE-2018-8781} - kernel/exit.c: avoid undefine…

Jul 10, 2018
Critical

ELSA-2018-2113 11 CVEs

Critical: firefox security update (Oracle Linux 7)

[60.1.0-4.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [60.1.0-4] - Disabled jemalloc on all second arches [60.1.0-3] - Updated to 60.1.0 ESR build2 [60.1.0-2] - Disabled jemalloc on second arches [60.1.0-1] - Updated t…

Jul 4, 2018
Medium max 7.5

ELSA-2018-2123 1 CVE

Moderate: python security update (Oracle Linux 7)

[2.7.5-69.0.1] - Add Oracle Linux distribution in platform.py [orabug 20812544] [2.7.5-70] - Remove 3DS cipher to mitigate CVE-2016-2183 (sweet32). Resolves: rhbz#1584545

Jul 3, 2018