Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

  • High
    ELSA-2017-3631 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-103.7.4] - ipv6: avoid overflow of offset in ip6_find_1stfragopt (Sabrina Dubroca) [Orabug: 27011255] {CVE-2017-7542} - udp: consistently apply ufo or fragmentation (Willem de Bruijn) [Orabug: 26921320] {CVE-2017-1000112}

  • Critical
    ELSA-2017-2998 14 CVEs

    Critical: java-1.8.0-openjdk security update (Oracle Linux 7)

    [1:1.8.0.151-1.b12] - repack policies adapted to new counts and paths - note that also c-j-c is needed to make this apply in next update - Resolves: rhbz#1499207 [1:1.8.0.151-0.b12] - Correct fix to RH1191652 root patch so existing COMMON_CCXXFLAGS_JDK is not…

  • High max 5.1
    ELSA-2017-2930 9 CVEs

    Important: kernel security and bug fix update (Oracle Linux 7)

    - [3.10.0-693.5.2.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-693.5.2] - [mm] page_cgroup:…

  • High
    ELSA-2017-2907 7 CVEs

    Important: wpa_supplicant security update (Oracle Linux 7)

    [1:2.6-5.1] - avoid key reinstallation (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)

  • High
    ELSA-2017-2885 7 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [52.4.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [52.4.0-2] - Update to 52.4.0 (b2)

  • Medium
    ELSA-2017-2882 1 CVE

    Moderate: httpd security update (Oracle Linux 7)

    [2.4.6-67.0.1.el7_4.5] - replace index.html with Oracle's index page oracle_index.html [2.4.6-67.5] - Resolves: #1493064 - CVE-2017-9798 httpd: Use-after-free by limiting unregistered HTTP method

  • Medium
    ELSA-2017-3629 1 CVE

    Moderate: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-103.7.3] - brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx() (Tim Tianyang Chen) [Orabug: 26943541] {CVE-2017-7541} [4.1.12-103.7.2] - rebuild bumping release

  • Critical
    ELSA-2017-2836 6 CVEs

    Critical: dnsmasq security update (Oracle Linux 7)

    [2.76-2.2] - Small correction of CVE-2017-14491 [2.76-2.1] - Fix CVE-2017-14491 - Fix CVE-2017-14492 - Fix CVE-2017-14493 - Fix CVE-2017-14494 - Fix CVE-2017-14496 - Fix CVE-2017-14495 - extra fixes

  • Critical
    ELSA-2017-2831 7 CVEs

    Critical: firefox security update (Oracle Linux 7)

    [52.4.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [52.4.0-1] - Update to 52.4.0 ESR [52.3.0-3] - Update to 52.3.0 ESR (b2) - Require correct nss version

  • High
    ELSA-2017-2832 1 CVE

    Important: nss security update (Oracle Linux 7)

    [3.28.4-12] - Backport patch to simplify transcript calculation for CertificateVerify

  • High
    ELSA-2017-2788 1 CVE

    Important: augeas security update (Oracle Linux 7)

    [1.4.0-2.el7_4.1] - Fix CVE-2017-7555, improper handling of escaped strings (RHBZ#1481545)

  • Medium max 7.4
    ELSA-2017-2790 3 CVEs

    Moderate: samba security update (Oracle Linux 7)

    [4.6.2-11] - resolves: #1491213 - CVE-2017-12150 CVE-2017-12151 CVE-2017-12163

  • High
    ELSA-2017-3621 3 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.19.7] - Bluetooth: Properly check L2CAP config option output buffer length (Ben Seri) [Orabug: 26796364] {CVE-2017-1000251} [3.8.13-118.19.6] - xen: fix bio vec merging (Roger Pau Monne) [Orabug: 26645550] {CVE-2017-12134} [3.8.13-118.1…

  • High
    ELSA-2017-3620 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-103.3.8.1] - Bluetooth: Properly check L2CAP config option output buffer length (Ben Seri) [Orabug: 26796363] {CVE-2017-1000251}

  • High
    ELSA-2017-2771 1 CVE

    Important: emacs security update (Oracle Linux 7)

    [1:24.3-20] - fix unsafe enriched mode translations (#1490452)

  • Medium
    ELSA-2017-2728 2 CVEs

    Moderate: postgresql security update (Oracle Linux 7)

    [9.2.23-1] - update to 9.2.23 per release notes http://www.postgresql.org/docs/9.2/static/release-9-2-23.html [9.2.22-1] - update to 9.2.22 per release notes http://www.postgresql.org/docs/9.2/static/release-9-2-22.html

  • Medium
    ELSA-2017-2685 1 CVE

    Moderate: bluez security update (Oracle Linux 7)

    [4.66-2] - sdpd heap fixes Resolves: #1490008

  • High
    ELSA-2017-2679 1 CVE

    Important: kernel security update (Oracle Linux 7)

    - [3.10.0-693.2.2.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-693.2.2] - [net] l2cap: prev…

  • Medium
    ELSA-2017-2569 1 CVE

    Moderate: 389-ds-base security and bug fix update (Oracle Linux 7)

    [1.3.6.19-1] - Bump version to 1.3.6.19-1 - Remove old mozldap and db4 requirements - Resolves: Bug 1483865 - Crash while binding to a server during replication online init [1.3.6.1-18] - Bump version to 1.3.6.1-18 - Require srvcore 4.1.3 - Resolves: Bug 1479…

  • Medium
    ELSA-2017-2551 2 CVEs

    Moderate: poppler security update (Oracle Linux 7)

    [0.26.5-17] - Resolves: rhbz#1482934 CVE-2017-9776

  • High
    ELSA-2017-2534 14 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [52.3.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [52.3.0-1] - Update to 52.3.0 [52.2.1-1] - Update to 52.2.1

  • High
    ELSA-2017-3609 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-103.3.8] - fs/exec.c: account for argv/envp pointers (Kees Cook) [Orabug: 26638900] {CVE-2017-1000365} {CVE-2017-1000365} [4.1.12-103.3.7] - i40e/i40evf: check for stopped admin queue (Mitch Williams) [Orabug: 26654222] [4.1.12-103.3.6] - x…

  • Medium
    ELSA-2017-2492 1 CVE

    Moderate: xmlsec1 security update (Oracle Linux 7)

    [1.2.20-7] - CVE-2017-1000061 - Related: #1472092 - Fix mis-applied patch hunk [1.2.20-6] - CVE-2017-1000061 - Resolves: #1472092

  • High max 4.4
    ELSA-2017-3606 4 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.19.4] - l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() (Guillaume Nault) [Orabug: 26586047] {CVE-2016-10200} - xfs: fix two memory leaks in xfs_attr_list.c error paths (Mateusz Guzik) [Orabug: 26586022] {CVE-2016-9685} - KE…

  • High max 9.8
    ELSA-2017-2486 1 CVE

    Important: groovy security update (Oracle Linux 7)

    [1.8.9-8] - Fix Information disclosure vulnerability - Resolves: CVE-2016-6814

  • High max 9.8
    ELSA-2017-2489 2 CVEs

    Important: mercurial security update (Oracle Linux 7)

    [2.6.2-8] - Fix CVE-2017-1000115 and CVE-2017-1000116

  • High max 4.4
    ELSA-2017-3605 5 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-94.5.9] - dentry name snapshots (Al Viro) [Orabug: 26630936] {CVE-2017-7533} [4.1.12-94.5.8] - scsi: libiscsi: use kvzalloc for iscsi_pool_init (Kyle Fortin) [Orabug: 26621191] - mm: introduce kv[mz]alloc helpers (Kyle Fortin) [Orabug: 2662…

  • High
    ELSA-2017-2484 1 CVE

    Important: git security update (Oracle Linux 7)

    [1.8.3.1-12] - prevent command injection via malicious ssh URLs Resolves: CVE-2017-1000117

  • High
    ELSA-2017-2473 1 CVE

    Important: kernel security and bug fix update (Oracle Linux 7)

    - [3.10.0-693.1.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-693.1.1] - [fs] dentry name …

  • High
    ELSA-2017-2480 1 CVE

    Important: subversion security update (Oracle Linux 7)

    [1.7.14-11] - add security fix for CVE-2017-9800

  • High
    ELSA-2017-2471 1 CVE

    Important: spice security update (Oracle Linux 7)

    [0.12.8-2.1] - Redo build properly versioned as a zstream build Related: CVE-2017-7506 [0.12.8-3] - Prevent potential buffer/integer overflows with invalid MonitorsConfig messages sent from an authenticated client Resolves: CVE-2017-7506

  • High
    ELSA-2017-2479 5 CVEs

    Important: httpd security update (Oracle Linux 7)

    [2.4.6-67.0.1.el7_4.2] - replace index.html with Oracle's index page oracle_index.html [2.4.6-67.2] - Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw() authentication bypass - Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer deref…

  • Critical
    ELSA-2017-2456 15 CVEs

    Critical: firefox security update (Oracle Linux 7)

    [52.3.0-3.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Force requirement of newer gdk-pixbuf2 to ensure a proper update (Todd Vierling) [orabug 19847484] [52.3.0-3] - Fix for rhbz#1470294 - bundling newer libffi for pp…

  • High max 9.8
    ELSA-2017-2459 1 CVE

    Important: libsoup security update (Oracle Linux 7)

    [2.56.0-4] - Fix chunked decoding buffer overrun (CVE-2017-2885) (rh #1479322)

  • High
    ELSA-2017-2389 6 CVEs

    Important: freeradius security update (Oracle Linux 7)

    [3.0.13-8] - Avoid misinterpreting zero-size malloc in data2vp_extended() fix. - Related: Bug#1469414 CVE-2017-10984 freeradius: Out-of-bounds write in data2vp_wimax() [3.0.13-7] - Resolves: Bug#1469409 CVE-2017-10978 freeradius: Out-of-bounds read/write due …

  • Critical
    ELSA-2017-2424 18 CVEs

    Critical: java-1.7.0-openjdk security update (Oracle Linux 7)

    [1:1.7.0.151-2.6.11.0.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.151-2.6.11.0] - Bump to 2.6.11 and u151b00. - Update java-access-bridge-security.patch to apply against 2.6.11. - Apply fix for 8185716 so ppc uses correct ins_encode format - Resolves: rhbz…

  • High
    ELSA-2017-2388 1 CVE

    Important: evince security update (Oracle Linux 7)

    [3.22.1-5.2] - Related: #1469528 ensure .desktop file is still valid [3.22.1-5.1] + Fix arbitrary code execution via filename in tar-compressed comics archive - Resolves: #1469528

  • Medium
    ELSA-2017-1859 1 CVE

    Moderate: golang security, bug fix, and enhancement update (Oracle Linux 7)

    [1.8.3-1] - bump to 1.8.3 - fix CVE-2017-8932 - Resolves: rhbz#1452616, rhbz#1452241, rhbz#1457169, rhbz#1448346

  • Medium max 5.9
    ELSA-2017-2335 1 CVE

    Moderate: pki-core security update (Oracle Linux 7)

    [10.4.1-11] - Resolves: rhbz #1469432 - ########################################################################## - RHEL 7.4: - ########################################################################## - Bugzilla Bug #1469432 - CMC plugin default change - R…

  • Medium
    ELSA-2017-2445 1 CVE

    Moderate: qemu-kvm security update (Oracle Linux 7)

    [1.5.3-141.el7_4.1] - kvm-qemu-nbd-Ignore-SIGPIPE.patch [bz#1468107] - Resolves: bz#1468107 (CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.4.z])