Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

  • High
    ELSA-2018-4071 4 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.14.1] - ctf: drop the run-as-root error (Nick Alcock) [Orabug: 27852654] - rds: Node crashes when trace buffer is opened (Ka-Cheong Poon) [Orabug: 27846191] - xfs: fix accidental reversion of aa6a6227435cb (Darrick J. Wong) [Orabug: 27845869] [4.1…

  • Medium
    ELSA-2018-1055 1 CVE

    Moderate: libvncserver security update (Oracle Linux 7)

    [0.9.9-12] - Fix CVE-2018-7225 (improper client cut text length sanitization) (bug #1548440)

  • High
    ELSA-2018-1058 1 CVE

    Important: libvorbis security update (Oracle Linux 7)

    [1.3.3-8.1] - Backport fix for CVE-2018-5146

  • High
    ELSA-2018-1099 1 CVE

    Important: firefox security update (Oracle Linux 7)

    [52.7.3-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [52.7.3-1] - Update to 52.7.3 ESR

  • Medium
    ELSA-2018-0855 3 CVEs

    Moderate: ntp security, bug fix, and enhancement update (Oracle Linux 7)

    [4.2.6p5-28.0.1] - Bump release to avoid ULN conflict with Oracle modified errata. [4.2.6p5-28] - fix buffer overflow in datum refclock driver (CVE-2017-6462) - fix crash with invalid unpeer command (CVE-2017-6463) - fix potential crash with invalid server co…

  • Medium
    ELSA-2018-0805 6 CVEs

    Moderate: glibc security, bug fix, and enhancement update (Oracle Linux 7)

    [2.17-222] - Restore internal GLIBC_PRIVATE symbols for use during upgrades (#1523119) [2.17-221] - CVE-2018-1000001: Fix realpath() buffer underflow (#1534635) - i386: Fix unwinding for 32-bit C++ application (#1529982) - Reduce thread and dynamic loader sta…

  • Low
    ELSA-2018-0849 1 CVE

    Low: gcc security, bug fix, and enhancement update (Oracle Linux 7)

    [4.8.5-28.0.1] - [Orabug: 27557686] (Egeyar Bagcioglu) - Introduce 'oracle_release' into .spec file. Echo it to gcc/DEV-PHASE. [4.8.5-28] - Minor testsuite fixes to clean up test results (#1469697) - retpoline support for spectre mitigation (#1535655) [4.8.5-…

  • Low
    ELSA-2018-0913 1 CVE

    Low: policycoreutils security, bug fix, and enhancement update (Oracle Linux 7)

    [2.5-22.0.1] - Lazy unmount private, shared entry (Joe Jin) [orabug 12560705] [2.5-22] - semanage: Fix fcontext help message (#1499259) - semanage: Improve semanage-user.8 man page (#1079946) - semodule: Improve man page (#1337192) [2.5-21] - Update translati…

  • Low
    ELSA-2018-0842 1 CVE

    Low: xdg-user-dirs security and bug fix update (Oracle Linux 7)

    [0.15-5] - Start using autostart mechanism instead of xinitrc.d script Resolves: #1412762

  • Low
    ELSA-2018-0816 5 CVEs

    Low: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 7)

    [1.5.3-156.el7] - kvm-vnc-Fix-qemu-crashed-when-vnc-client-disconnect-sudd.patch [bz#1527405] - kvm-fix-full-frame-updates-for-VNC-clients.patch [bz#1527405] - kvm-vnc-update-fix.patch [bz#1527405] - kvm-vnc-return-directly-if-no-vnc-client-connected.patch [b…

  • Medium max 6.5
    ELSA-2018-0666 2 CVEs

    Moderate: krb5 security, bug fix, and enhancement update (Oracle Linux 7)

    [1.15.1-18] - Expose context errors in pkinit_server_plugin_init - Resolves: #1460089 [1.15.1-17] - Drop certauth test changes that prevented runnig it - Resolves: #1498767 [1.15.1-16] - Drop irrelevant DIR trigger logic - Resolves: #1431198 [1.15.1-15] - Fix…

  • Low max 5.3
    ELSA-2018-0980 1 CVE

    Low: openssh security, bug fix, and enhancement update (Oracle Linux 7)

    [7.4p1-16 + 0.10.3-2] - Fix for CVE-2017-15906 (#1517226) [7.4p1-15 + 0.10.3-2] - Do not hang if SSH AuthorizedKeysCommand output is too large (#1496467) - Do not segfault pam_ssh_agent_auth if keyfile is missing (#1494268) - Do not segfault in audit code dur…

  • Medium
    ELSA-2018-0998 3 CVEs

    Moderate: openssl security and bug fix update (Oracle Linux 7)

    [1.0.2k-12.0.1] - sha256 is used for the RSA pairwise consistency test instead of sha1 [1.0.2k-12] - fix CVE-2017-3737 - incorrect handling of fatal error state - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus [1.0.2k-11] - fix d…

  • High
    ELSA-2018-1062 27 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

    - [3.10.0-862.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-862] - [netdrv] i40e: Fix attach…

  • High max 5.5
    ELSA-2018-4062 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-112.16.7] - mlx4: change the ICM table allocations to lowest needed size (Daniel Jurgens) [Orabug: 27718305] - autofs: use dentry flags to block walks during expire (Ian Kent) [Orabug: 26032471] [Orabug: 27766149] - autofs races (Al Viro) [Orabug: 277…

  • High
    ELSA-2018-0648 6 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [52.7.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [52.7.0-1] - Update to 52.7.0

  • High max 8.8
    ELSA-2018-4061 2 CVEs

    Important: kubernetes security update (Oracle Linux 7)

    [1.9.1-2.1.5] - Production built 1.9.1-2.1.5 - Fix the upgrade version check - Remove w/a from [Orabug 27125915] [1.9.1-2.1.4.dev] - Make sure worker node upgrade properly - [Orabug 27649898] [1.9.1-2.1.3.dev] - Ensure that the runtime mounts RO volumes read-…

  • High max 9.8
    ELSA-2018-0592 1 CVE

    Important: slf4j security update (Oracle Linux 7)

    [0:1.7.4-4] - Disallow EventData deserialization by default (CVE-2018-8088)

  • Critical
    ELSA-2018-0549 1 CVE

    Critical: firefox security update (Oracle Linux 7)

    [52.7.2-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Force requirement of newer gdk-pixbuf2 to ensure a proper update (Todd Vierling) [orabug 19847484] [52.7.2-1] - Update to 52.7.2 ESR

  • Critical
    ELSA-2018-0527 7 CVEs

    Critical: firefox security update (Oracle Linux 7)

    [52.7.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [52.7.0-1] - Update to 52.7.0 ESR

  • Medium
    ELSA-2018-0505 1 CVE

    Moderate: mailman security update (Oracle Linux 7)

    [3:2.1.15-26.1] - Related: #1545974 - Add import regular expression module [3:2.1.15-26] - Related: #1545974 - Bump release to make it higher than 7.5 [3:2.1.15-24.2] - Resolves: #1545974 - Add sanitizer to mitigate XSS injection [3:2.1.15-24.1] - Resolves: #…

  • High max 7.5
    ELSA-2018-0483 2 CVEs

    Important: dhcp security update (Oracle Linux 7)

    [12:4.2.5-58.0.1] - Added oracle-errwarn-message.patch [12:4.2.5-68] - Resolves: #1550000 - CVE-2018-5733 Avoid buffer overflow reference counter [12:4.2.5-58.2] - Resolves: #1549979 - CVE-2018-5732 Avoid buffer overflow in options parser

  • Medium
    ELSA-2018-0406 1 CVE

    Moderate: php security update (Oracle Linux 7)

    [5.4.16-43.1] - gd: fix buffer over-read into uninitialized memory CVE-2017-7890

  • Medium
    ELSA-2018-0418 1 CVE

    Moderate: libreoffice security update (Oracle Linux 7)

    [1:5.0.6.2-15.0.1] - Replaced RedHat colors with Oracle colors, and the filename redhat.soc with oracle.soc in specfile - Build with --with-vendor='Oracle America, Inc.' [1:5.0.6.2-15] - Resolves: rhbz#1545034 - CVE-2018-1055 CVE-2018-6871 [1:5.0.6.2-14] - Re…

  • High
    ELSA-2018-0414 2 CVEs

    Important: 389-ds-base security and bug fix update (Oracle Linux 7)

    [1.3.6.1-28] - Bump version to 1.3.6.1-28 - Resolves: Bug 1540105 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 [1.3.6.1-27] - Bump version to 1.3.6.1-27 - Resolves: Bug 1536343 - Indexing of internationalize…

  • High max 5.5
    ELSA-2018-0395 2 CVEs

    Important: kernel security and bug fix update (Oracle Linux 7)

    - [3.10.0-693.21.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-693.21.1] - [x86] platform/…

  • High max 7.5
    ELSA-2018-0377 1 CVE

    Important: quagga security update (Oracle Linux 7)

    [0.99.22.4-5] - Fixed CVE-2018-5379 - Double free vulnerability in bgpd when processing certain forms of UPDATE message allowing to crash or potentially execute arbitrary code - Resolves: rhbz#1546015

  • High max 9.8
    ELSA-2018-0378 11 CVEs

    Important: ruby security update (Oracle Linux 7)

    [2.0.0.648-33] - Fix always passing WEBrick test. [2.0.0.648-32] - Add Psych.safe_load * ruby-2.1.0-there-should-be-only-one-exception.patch * ruby-2.1.0-Adding-Psych.safe_load.patch Related: CVE-2017-0903 - Disable Tokyo TZ tests broken by recen tzdata updat…

  • High
    ELSA-2018-0349 14 CVEs

    Important: java-1.7.0-openjdk security update (Oracle Linux 7)

    [1:1.7.0.171-2.6.13.0.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.171-2.6.13.0] - Bump to 2.6.13 and u171b01. - Update java-1.7.0-openjdk-java-access-bridge-security.patch to apply after 8186080 - Update RC4 patch (8076221/PR2809) to apply after 8148108 (D…

  • High
    ELSA-2018-0350 1 CVE

    Important: gcab security update (Oracle Linux 7)

    [0.7-4] - Fixes the security issue known as CVE-2018-5345 - Resolves: #1533174

  • High max 7.1
    ELSA-2018-4040 9 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.20.3] - gre: fix a possible skb leak (Eric Dumazet) [Orabug: 26403972] {CVE-2017-9074} - ipv6: Fix leak in ipv6_gso_segment(). (David S. Miller) [Orabug: 26403972] {CVE-2017-9074} - ipv6: xfrm: Handle errors reported by xfrm6_find_1stfr…

  • High max 5.6
    ELSA-2018-4025 7 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-112.14.14] - drivers/char/mem.c: deny access in open operation when securelevel is set (Ethan Zhao) [Orabug: 27234850] [Orabug: 27234850] - hugetlb: fix nr_pmds accounting with shared page tables (Kirill A. Shutemov) [Orabug: 26988581] - x86/IBRS: Dro…

  • High
    ELSA-2018-0262 10 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [52.6.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [52.6.0-1] - Update to 52.6.0

  • Medium
    ELSA-2018-0260 1 CVE

    Moderate: systemd security update (Oracle Linux 7)

    [219-42.0.2.7] - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com) - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [22224874] - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 1846746…

  • High max 5.6
    ELSA-2018-4022 3 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.20.2] - x86: Add another set of MSR accessor functions (Borislav Petkov) [Orabug: 27444923] {CVE-2017-5753} - userns: prevent speculative execution (Elena Reshetova) [Orabug: 27444923] {CVE-2017-5753} - udf: prevent speculative executio…

  • High
    ELSA-2018-4021 0 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-61.63.1] - Revert 'kernel.spec: Require the new microcode_ctl.' (Brian Maly) - x86: Clean up IBRS functionality resident in common code (Kanth Ghatraju) [Orabug: 27439198] - x86: Display correct settings for the SPECTRE_V2 bug (Kanth Ghatraju) [Orabug…

  • Medium max 5.3
    ELSA-2018-0158 1 CVE

    Moderate: dhcp security update (Oracle Linux 7)

    [12:4.2.5-58.0.1.1] - Added oracle-errwarn-message.patch [12:4.2.5-58.1] - Resolves: #1523475 - Fix omapi socket descriptors leak

  • High
    ELSA-2018-0163 1 CVE

    Important: 389-ds-base security and bug fix update (Oracle Linux 7)

    [1.3.6.1-26] - Bump version to 1.3.6.1-25 - Resolves: Bug 1534430 - crash in slapi_filter_sprintf [1.3.6.1-25] - Bump version to 1.3.6.1-25 - Resolves: Bug 1526928 - search with CoS attribute is getting slower after modifying/adding CosTemplate - Resolves: Bu…

  • Medium
    ELSA-2018-0223 1 CVE

    Moderate: nautilus security update (Oracle Linux 7)

    [3.22.3-4] - Fix desktop files security issue (upstream bugzilla.gnome.org/777991) Resolves: #1490949

  • High
    ELSA-2018-0151 5 CVEs

    Important: kernel security and bug fix update (Oracle Linux 7)

    - [3.10.0-693.17.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-693.17.1] - [s390] locking/…