Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

Critical

ELSA-2018-0122 11 CVEs

Critical: firefox security update (Oracle Linux 7)

[52.6.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Force requirement of newer gdk-pixbuf2 to ensure a proper update (Todd Vierling) [orabug 19847484] [52.6.0-1] - Update to 52.6.0 ESR

Jan 24, 2018
High max 7.5

ELSA-2018-0102 1 CVE

Important: bind security update (Oracle Linux 7)

[32:9.9.4-51.2] - Fix CVE-2017-3145

Jan 22, 2018
High

ELSA-2018-4018 0 CVEs

Important: microcode_ctl security update (Oracle Linux 7)

[2.1-22.5.0.3] - Revert Intel 20180108 microcode for CPUIDs: {CVE-2017-5715} 306c3 (06-3c-03 rev 0x23, Haswell); 306d4 (06-3d-04 rev 0x28, Broadwell); 306f2 (06-3f-02 rev 0x3b, Haswell); 306f4 (06-3f-04 rev 0x10, Haswell); 306e4 (06-3e-04 rev 0x42a, Ivy Bridg…

Jan 20, 2018
High

ELSA-2018-4012 0 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-94.7.8] - x86/pti/efi: broken conversion from efi to kernel page table (Pavel Tatashin) [Orabug: 27378087] [Orabug: 27352353] {CVE-2017-5754} - x86/spec: Always set IBRS to guest value on VMENTER and host on VMEXIT (redux) (Konrad Rzeszutek…

Jan 19, 2018
High

ELSA-2018-4017 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-112.14.13] - Revert 'kernel.spec: Require the new microcode_ctl.' (Brian Maly) [4.1.12-112.14.12] - xen-blkback: add pending_req allocation stats (Ankur Arora) [Orabug: 27386890] - xen-blkback: move indirect req allocation out-of-line (Ankur Arora) [O…

Jan 18, 2018
High

ELSA-2018-0093 0 CVEs

Important: microcode_ctl security update (Oracle Linux 7)

[1:1.17-25.4.0.1] - Enable early microcode load to allow updating Broadwell model 79 - Make sure 'modprobe microcode' is not executed on Broadwell model 79 - Run dracut upon microcode update - Add updated Intel 20180108 microcode for CPUIDs: {CVE-2017-5715} 3…

Jan 17, 2018
High

ELSA-2018-0095 15 CVEs

Important: java-1.8.0-openjdk security update (Oracle Linux 7)

[1:1.8.0.161-0.b14] - Update to b14 with updated Zero fix for 8174962 (S8194828) - Resolves: rhbz#1528233 [1:1.8.0.161-0.b13] - Update to b13 including Zero fix for 8174962 (S8194739) and restoring tzdata2017c update - Resolves: rhbz#1528233 [1:1.8.0.161-0.b1…

Jan 17, 2018
High

ELSA-2018-4011 0 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-112.14.11] - x86/pti/efi: broken conversion from efi to kernel page table (Pavel Tatashin) [Orabug: 27363926] [Orabug: 27352353] {CVE-2017-5754} - x86/spec: Always set IBRS to guest value on VMENTER and host on VMEXIT (redux) (Konrad Rzeszutek Wilk) […

Jan 12, 2018
High max 5.6

ELSA-2018-4006 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-112.14.10] - x86/ia32: save and clear registers on syscall. (Jamie Iles) [Orabug: 27355759] {CVE-2017-5754} - x86/IBRS: Save current status of MSR_IA32_SPEC_CTRL (Boris Ostrovsky) [Orabug: 27355887] - pti: Rename X86_FEATURE_KAISER to X86_FEATURE_PTI …

Jan 9, 2018
High

ELSA-2018-0061 4 CVEs

Important: thunderbird security update (Oracle Linux 7)

[52.5.2-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [52.5.2-1] - Update to 52.5.2

Jan 8, 2018
High max 5.6

ELSA-2018-4004 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-112.14.5] - x86/ibrs: Remove 'ibrs_dump' and remove the pr_debug (Konrad Rzeszutek Wilk) [Orabug: 27350825] [4.1.12-112.14.4] - kABI: Revert kABI: Make the boot_cpu_data look normal (Konrad Rzeszutek Wilk) {CVE-2017-5715} [4.1.12-112.14.3] - userns: p…

Jan 5, 2018
High max 5.6

ELSA-2018-0029 1 CVE

Important: libvirt security update (Oracle Linux 7)

[3.2.0-14.0.1.el7_4.7] - bump release and rebuild [3.2.0-14.el7_4.7] - qemu: Properly store microcode version in QEMU caps cache (CVE-2017-5715) [3.2.0-14.el7_4.6] - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD (CVE-2017-5715) - util: i…

Jan 5, 2018
High max 5.6

ELSA-2018-0007 3 CVEs

Important: kernel security update (Oracle Linux 7)

- [3.10.0-693.11.6.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-693.11.6] - [x86] spec_ctrl…

Jan 4, 2018
High max 5.6

ELSA-2018-0023 1 CVE

Important: qemu-kvm security update (Oracle Linux 7)

[1.5.3-141.el7_4.6] - Fix CVE-2017-5715 [1.5.3-141.el7_4.5] - kvm-vfio-pci-Only-mmap-TARGET_PAGE_SIZE-regions.patch [bz#1515110] - Resolves: bz#1515110 (Regression in QEMU handling for sub-page MMIO BARs for vfio-pci devices [rhel-7.4.z])

Jan 4, 2018
High max 5.6

ELSA-2018-0012 1 CVE

Important: microcode_ctl security update (Oracle Linux 7)

[2.1-22.2] - Update Intel CPU microde for 06-3f-02, 06-4f-01, and 06-55-04 - Resolves: #1527358 [2.1-22.1] - Update to upstream 2.1-13. Intel CPU microcode update to 20170707. - Resolves: #1474844

Jan 4, 2018
High

ELSA-2018-4001 8 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-112.14.2] - fuse: Call end_queued_requests() after releasing fc->lock in fuse_dev_release() (Ashish Samant) [Orabug: 26431550] - rds: Fix inaccurate accounting of unsignaled wrs in rds_ib_xmit_rdma (Hakon Bugge) [Orabug: 27097105] - rds: Fix inaccurat…

Jan 3, 2018
High

ELSA-2017-3659 1 CVE

Important: Unbreakable Enterprise kernel security and bugfix update (Oracle Linux 7)

[4.1.12-112.14.1] - ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() (Eryu Guan) [Orabug: 27233471] [4.1.12-112.13.1] - cgroup: make sure a parent css isnt offlined before its children (Tejun Heo) [Orabug: 27179269] [4.1.12-112.12.1] - ctf:…

Dec 13, 2017
Medium max 6.5

ELSA-2017-3402 2 CVEs

Moderate: postgresql security update (Oracle Linux 7)

[9.2.23-3] - setup: keep PGSETUP_* variables after switching to not-privileged user [9.2.23-2] - fix CVE-2017-12172

Dec 7, 2017
High

ELSA-2017-3657 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.20.1] - tty: Fix race in pty_write() leading to NULL deref (Todd Vierling) [Orabug: 25392692] - ocfs2/dlm: ignore cleaning the migration mle that is inuse (xuejiufei) [Orabug: 26479780] - KEYS: fix dereferencing NULL payload with nonzer…

Dec 7, 2017
High

ELSA-2017-3651 5 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-103.10.1] - mm, thp: Do not make page table dirty unconditionally in follow_trans_huge_pmd() (Kirill A. Shutemov) [Orabug: 27200879] {CVE-2017-1000405} - NFS: Add static NFS I/O tracepoints (Chuck Lever) - storvsc: dont assume SG list is contiguous (A…

Dec 7, 2017
High

ELSA-2017-3392 16 CVEs

Important: java-1.7.0-openjdk security and bug fix update (Oracle Linux 7)

[1:1.7.0.161-2.6.12.0.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.161-2.6.12.0] - Remove superfluous %1 from policy JAR file path. - Resolves: rhbz#1499207 [1:1.7.0.161-2.6.12.0] - Update location of policy JAR files following 8157561. - Resolves: rhbz#149…

Dec 6, 2017
Medium max 7.8

ELSA-2017-3384 1 CVE

Moderate: liblouis security update (Oracle Linux 7)

[2.5.2-12] - Resolves: CVE-2017-15101

Dec 5, 2017
High

ELSA-2017-3382 1 CVE

Important: firefox security update (Oracle Linux 7)

[52.5.1-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Force requirement of newer gdk-pixbuf2 to ensure a proper update (Todd Vierling) [orabug 19847484] [52.5.1-1] - Update to 52.5.1 ESR

Dec 5, 2017
High

ELSA-2017-3372 3 CVEs

Important: thunderbird security update (Oracle Linux 7)

[52.5.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [52.5.0-1] - Update to 52.5.0

Dec 4, 2017
Medium max 4.3

ELSA-2017-3379 1 CVE

Moderate: sssd security and bug fix update (Oracle Linux 7)

[1.15.2-50.8] - Resolves: rhbz#1508972 - Accessing IdM kerberos ticket fails while id mapping is applied [rhel-7.4.z] - Resolves: rhbz#1509177 - Race condition between refreshing the cr_domain list and a request that is using the list can cause a segfault is …

Dec 4, 2017
Medium

ELSA-2017-3368 2 CVEs

Moderate: qemu-kvm security update (Oracle Linux 7)

[1.5.3-141.el7_4.4] - kvm-multiboot-validate-multiboot-header-address-values.patch [bz#1501120] - Resolves: bz#1501120 (CVE-2017-14167 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image [rhel-7.4.z]) [1.5.3-141.el7_4.3] - kvm-bswap.h-Remove…

Nov 30, 2017
High

ELSA-2017-3315 1 CVE

Important: kernel security and bug fix update (Oracle Linux 7)

- [3.10.0-693.11.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-693.11.1] - [powerpc] perf:…

Nov 30, 2017
High

ELSA-2017-3270 1 CVE

Important: apr security update (Oracle Linux 7)

[1.3.9-5.1] - Resolves: #1507346 - CVE-2017-12613 apr: Out-of-bounds array deref in apr_time_exp*() functions

Nov 28, 2017
High

ELSA-2017-3269 1 CVE

Important: procmail security update (Oracle Linux 7)

[3.22-36.1] - Fixed possible buffer overflow in loadbuf function Resolves: CVE-2017-16844

Nov 28, 2017
Medium max 9.1

ELSA-2017-3263 1 CVE

Moderate: curl security update (Oracle Linux 7)

[7.29.0-42.el7_4.1] - fix buffer overflow while processing IMAP FETCH response (CVE-2017-1000257)

Nov 27, 2017
High

ELSA-2017-3260 2 CVEs

Important: samba security update (Oracle Linux 7)

[4.6.2-12] - resolves: #1514314 - Fix CVE-2017-14746 and CVE-2017-15275

Nov 27, 2017
Critical

ELSA-2017-3247 3 CVEs

Critical: firefox security update (Oracle Linux 7)

[52.5.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Force requirement of newer gdk-pixbuf2 to ensure a proper update (Todd Vierling) [orabug 19847484] [52.5.0-1] - Update to 52.5.0 ESR

Nov 17, 2017
Medium

ELSA-2017-3221 2 CVEs

Moderate: php security update (Oracle Linux 7)

[5.4.16-43] - gd: fix DoS vulnerability in gdImageCreateFromGd2Ctx() CVE-2016-10167 - gd: Signed Integer Overflow gd_io.c CVE-2016-10168

Nov 15, 2017
High max 5.5

ELSA-2017-3640 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-103.9.4] - thp: run vma_adjust_trans_huge() outside i_mmap_rwsem (Kirill A. Shutemov) [Orabug: 27026180] [4.1.12-103.9.3] - selinux: fix off-by-one in setprocattr (Stephen Smalley) [Orabug: 27001717] {CVE-2017-2618} {CVE-2017-2618} {CVE-2017-2618} - s…

Nov 13, 2017
High

ELSA-2017-3636 10 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.19.12] - nvme: Drop nvmeq->q_lock before dma_pool_alloc(), so as to prevent hard lockups (Aruna Ramakrishna) [Orabug: 25409587] [3.8.13-118.19.11] - nvme: Handle PM1725 HIL reset (Martin K. Petersen) [Orabug: 26277600] - char: lp: fix p…

Nov 2, 2017
Medium max 7.8

ELSA-2017-3111 7 CVEs

Moderate: liblouis security update (Oracle Linux 7)

[2.5.2-11] - Resolves: CVE-2017-13738, CVE-2017-13740, CVE-2017-13741, CVE-2017-13742, CVE-2017-13743, CVE-2017-13744, CVE-2014-8184

Nov 2, 2017
High max 7.1

ELSA-2017-3635 5 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-103.9.2] - Revert 'drivers/char/mem.c: deny access in open operation when securelevel is set' (Brian Maly) [Orabug: 27037811] [4.1.12-103.9.1] - xfs: use dedicated log worker wq to avoid deadlock with cil wq (Brian Foster) [Orabug: 27013241] - scsi: s…

Nov 2, 2017
High max 8.1

ELSA-2017-3081 4 CVEs 2 exploited

Important: tomcat security update (Oracle Linux 7)

[0:7.0.76-3] - Resolves: rhbz#1498344 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws - Resolves: rhbz#1495654 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache poisoning - Resolves: rhbz#1470596 CVE-2017-5647 Add follow up revis…

Oct 30, 2017
High max 8.8

ELSA-2017-3075 2 CVEs

Important: wget security update (Oracle Linux 7)

[1.14-15.1] - Fixed various security flaws (CVE-2017-13089, CVE-2017-13090)

Oct 26, 2017
High

ELSA-2017-3632 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.19.10] - mqueue: fix a use-after-free in sys_mq_notify() (Cong Wang) [Orabug: 26643556] {CVE-2017-11176} [3.8.13-118.19.9] - ipv6: avoid overflow of offset in ip6_find_1stfragopt (Sabrina Dubroca) [Orabug: 27011273] {CVE-2017-7542} - pa…

Oct 24, 2017