Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

  • High max 9.8
    ELSA-2017-2423 2 CVEs

    Important: log4j security update (Oracle Linux 7)

    [0:1.2.17-16] - Fix socket receiver deserialization vulnerability - Resolves: CVE-2017-5645

  • Medium
    ELSA-2017-2060 15 CVEs

    Moderate: GStreamer security, bug fix, and enhancement update (Oracle Linux 7)

    clutter-gst2 [2.0.18-1] - Update to 2.0.18 - Remove obsolete patches - Use license macro for COPYING - Resolves: #1386833 gnome-video-effects [0.4.3-1] - Update to 0.4.3 - Resolves: #1386968 [0.4.1-5] - Fix URL (rhbz#1380981) gstreamer-plugins-bad-free [0.10.…

  • Medium
    ELSA-2017-1868 1 CVE

    Moderate: python security and bug fix update (Oracle Linux 7)

    [2.7.5-58.0.1] - Add Oracle Linux distribution in platform.py [orabug 20812544] [2.7.5-58] - Set stream to None in case an _open() fails. Resolves: rhbz#1432003 [2.7.5-57] - Fix implicit declaration warnings of functions added by patches 147 and 265 Resolves:…

  • Medium
    ELSA-2017-1852 1 CVE

    Moderate: openldap security, bug fix, and enhancement update (Oracle Linux 7)

    [2.4.44-5] - fix CVE-2017-9287 openldap: Double free vulnerability in servers/slapd/back-mdb/search.c (#1458210) [2.4.44-4] - NSS: Include some CHACHA20POLY1305 ciphers (#1432907) [2.4.44-3] - NSS: re-register NSS_Shutdown callback (#1405354) [2.4.44-2] - Inc…

  • Medium
    ELSA-2017-1860 2 CVEs

    Moderate: libtasn1 security, bug fix, and enhancement update (Oracle Linux 7)

    [4.10-1] - Updated to the 4.x branch (#1360639)

  • Medium
    ELSA-2017-2000 7 CVEs

    Moderate: tigervnc and fltk security, bug fix, and enhancement update (Oracle Linux 7)

    fltk [1.3.4-1] - Re-base to 1.3.4 (+ sync with Fedora) tigervnc [1.8.0-1] - Update to 1.8.0 Resolves: bz#1388620 [1.7.90-2] - Make RandR callbacks optional Resolves: bz#1444948 [1.7.90-1] - Update to 1.7.90 Resolves: bz#1388620 [1.7.1-3] - Delete underlying s…

  • Medium
    ELSA-2017-2016 1 CVE

    Moderate: curl security, bug fix, and enhancement update (Oracle Linux 7)

    [7.29.0-42] - fix use of uninitialized variable detected by Covscan [7.29.0-41] - make FTPS work with --proxytunnel (#1420327) [7.29.0-40] - make FTPS work with --proxytunnel (#1420327) [7.29.0-39] - work around race condition in PK11_FindSlotByName() in NSS …

  • Medium
    ELSA-2017-2128 1 CVE

    Moderate: gdm and gnome-session security, bug fix, and enhancement update (Oracle Linux 7)

    gdm [3.22.3-11] - Add japanese translation Resolves: #1449632 [3.22.3-10] - Add patches to try to maintain some semblance of compatibility when live upgrading between 7.3 and 7.4 Related: #1448786 [3.22.3-9] - Make sure reauthentication is run within the user…

  • Medium
    ELSA-2017-2258 2 CVEs

    Moderate: gtk-vnc security, bug fix, and enhancement update (Oracle Linux 7)

    [0.7.0-2] - Fix reserved data size (rhbz #1416783) - Fix inverted args in tests (rhbz #1416783) - Avoid sign extension problems (rhbz #1416783) - Fix crash with opening via GSocketAddress (rhbz #1416783) - Fix crash & error reporting during connection timeout…

  • Medium
    ELSA-2017-2285 1 CVE

    Moderate: authconfig security, bug fix, and enhancement update (Oracle Linux 7)

    [6.2.8-30] - do not use /usr and LIBDIR together (#1455233) [6.2.8-29] - update translations (#1449625) [6.2.8-28] - ignore PAM_IGNORE for pam_succeed_if so application do not fail in pam_setcred() (#1450425) [6.2.8-27] - fix typo in the patch for CVE-2017-74…

  • Low
    ELSA-2017-1950 1 CVE

    Low: samba security, bug fix, and enhancement update (Oracle Linux 7)

    [4.6.2-8] - resolves: #1459936 - Fix regression with 'follow symlinks = no' [4.6.2-7] - resolves: #1461336 - Fix smbclient username parsing - resolves: #1460937 - Fix username normalization with winbind [4.6.2-6] - resolves: #1459179 - Fix smbclient session s…

  • Medium
    ELSA-2017-1975 1 CVE

    Moderate: libreoffice security and bug fix update (Oracle Linux 7)

    [1:5.0.6.2-14.0.1] - Replaced RedHat colors with Oracle colors, and the filename redhat.soc with oracle.soc in specfile - Build with --with-vendor='Oracle America, Inc.' [1:5.0.6.2-14] - Resolves: rhbz#1454693 segv on interrupting tiled rendering [1:5.0.6.2-1…

  • Low max 9.1
    ELSA-2017-2247 5 CVEs

    Low: tomcat security, bug fix, and enhancement update (Oracle Linux 7)

    [0:7.0.76-2] - Resolves: rhbz#1459747 CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism - Resolves: rhbz#1441481 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used [0:7.0.76-1] - Resolves: rhbz#14148…

  • Medium max 7.8
    ELSA-2017-2029 5 CVEs

    Moderate: openssh security, bug fix, and enhancement update (Oracle Linux 7)

    [7.4p1-11 + 0.10.3-1] - Compiler warnings (#1341754) [7.4p1-10 + 0.10.3-1] - Add missing messages in FIPS mode (#1341754) [7.4p1-9 + 0.10.3-1] - Allow harmless syscalls for s390 crypto modules (#1451809) [7.4p1-8 + 0.10.3-1] - Fix multilib issue in documentat…

  • Medium
    ELSA-2017-1916 5 CVEs

    Moderate: glibc security, bug fix, and enhancement update (Oracle Linux 7)

    [2.17-196] - Avoid large allocas in the dynamic linker (#1452721) [2.17-195] - Rounding issues on POWER (#1457177) [2.17-194] - Use a built-in list of system call names (#1439165) [2.17-193] - Inhibit FMA while compiling sqrt, pow (#1413638) [2.17-192] - Excl…

  • Medium
    ELSA-2017-1983 2 CVEs

    Moderate: postgresql security and enhancement update (Oracle Linux 7)

    [9.2.21-1] - update to 9.2.21 per release notes http://www.postgresql.org/docs/9.2/static/release-9-2-21.html http://www.postgresql.org/docs/9.2/static/release-9-2-20.html http://www.postgresql.org/docs/9.2/static/release-9-2-19.html [9.2.18-2] - package libp…

  • Medium max 6.5
    ELSA-2017-1865 3 CVEs

    Moderate: X.org X11 libraries security, bug fix and enhancement update (Oracle Linux 7)

    libICE [1.0.9-9] - Add upstream patch to not pull libbsd - Add custom patch for Fedora 24 & 25 [1.0.9-8] - Fix changelog [1.0.9-7] - Use libbsd for randoms (CVE-2017-2626, rhbz#1427715) [1.0.9-6] - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Reb…

  • Medium
    ELSA-2017-2299 1 CVE

    Moderate: NetworkManager and libnl3 security, bug fix and enhancement update (Oracle Linux 7)

    NetworkManager [1:1.8.0-9] - device: don't change MTU unless explicitly configured (rh #1460760) - core: don't remove external IPv4 addresses (rh #1459813) [1:1.8.0-8] - cli: fix output of iface in overview output (rh#1460219) - ppp: unexport NMPPPManager ins…

  • Medium max 6.2
    ELSA-2017-1931 3 CVEs

    Moderate: bash security and bug fix update (Oracle Linux 7)

    [4.2.46-28] - CVE-2016-9401 - Fix crash when '-' is passed as second sign to popd Resolves: #1429838 [4.2.46-27] - CVE-2016-7543: Fix for arbitrary code execution via SHELLOPTS+PS4 variables Resolves: #1426026 [4.2.46-26] - CVE-2016-0634: Fix for arbitrary co…

  • Medium
    ELSA-2017-2004 2 CVEs

    Moderate: git security and bug fix update (Oracle Linux 7)

    [1.8.3.1-11] - dissalow repo names beginning with dash Resolves: CVE-2017-8386 [-1.8.3.1-10] - do not put unsanitized branch names in Resolves: CVE-2014-9938 [-1.8.3.1-9] - add control of GSSAPI credential delegation to enable HTTP(S)-SSO authentication Resol…

  • Medium max 7.5
    ELSA-2017-1854 5 CVEs

    Moderate: pidgin security, bug fix, and enhancement update (Oracle Linux 7)

    [2.10.11-5] - Drop MXit support in RHEL Resolves: #1439296 [2.10.11-4] - Silence -Wsign-compare - Rename the previous patch for consistency Resolves: #1445921, #1446368 [2.10.11-3] - Avoid a use-after-free in an error path Resolves: #1445921 [2.10.11-2] - Add…

  • Medium max 5.4
    ELSA-2017-1856 3 CVEs

    Moderate: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 7)

    [1.5.3-141.el7] - kvm-Fix-memory-slot-page-alignment-logic-bug-1455745.patch [bz#1455745] - kvm-Do-not-hang-on-full-PTY.patch [bz#1452067] - kvm-serial-fixing-vmstate-for-save-restore.patch [bz#1452067] - kvm-serial-reinstate-watch-after-migration.patch [bz#1…

  • Medium
    ELSA-2017-2192 21 CVEs

    Moderate: mariadb security and bug fix update (Oracle Linux 7)

    [1:5.5.56-2] - Do not fix context and change owner if run by root in mariadb-prepare-db-dir Related: #1458940 - Check properly that datadir includes only expected files Related: #1356897 [1:5.5.56-1] - Rebase to 5.5.56 That release also fixes the following se…

  • Low
    ELSA-2017-2180 1 CVE

    Low: ghostscript security and bug fix update (Oracle Linux 7)

    [9.07-28] - Security fix for CVE-2017-8291 updated to address SIGSEGV [9.07-27] - Added security fix for CVE-2017-8291 (bug #1446063) [9.07-26] - Updated requirements for lcms2 to avoid possible issues in the future [9.07-25] - Added security fix for CVE-2017…

  • High max 4.4
    ELSA-2017-1842 32 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

  • Medium
    ELSA-2017-2292 7 CVEs

    Moderate: gnutls security, bug fix, and enhancement update (Oracle Linux 7)

    [3.3.26-9] - Address crash in OCSP status request extension, by eliminating the unneeded parsing (CVE-2017-7507, #1455828) [3.3.26-7] - Address interoperability issue with 3.5.x (#1388932) - Reject CAs which are both trusted and blacklisted in trust module (#…

  • Medium
    ELSA-2017-1871 45 CVEs

    Moderate: tcpdump security, bug fix, and enhancement update (Oracle Linux 7)

    [14:4.9.0-5] - Resolves: #1441597; use bigger capture buffer than in upstream [14:4.9.0-4] - Drop downstream patch (drop root privileges) - Add libcap-ng as a new build dependency - Related: #1262283 [14:4.9.0-3] - Fix tests according to our patches and libpc…

  • High max 9.1
    ELSA-2017-1809 2 CVEs

    Important: tomcat security update (Oracle Linux 7)

    [0:7.0.69-12] - Resolves: rhbz#1441487 CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate facade object - Resolves: rhbz#1441480 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used - Resolves: r…

  • High
    ELSA-2017-3595 4 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-94.5.7] - Revert 'net/rds: Revert 'RDS: add reconnect retry scheme for stalled connections'' (Ajaykumar Hotchandani) [Orabug: 26444722] - Revert 'net/rds: use different workqueue for base_conn' (Ajaykumar Hotchandani) [Orabug: 26444722] - R…

  • High
    ELSA-2017-3596 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.19.3] - posix_acl: Clear SGID bit when setting file permissions (Jan Kara) [Orabug: 25507344] {CVE-2016-7097} {CVE-2016-7097}

  • High
    ELSA-2017-1793 8 CVEs

    Important: graphite2 security update (Oracle Linux 7)

    [1.3.10-1] - Resolves: rhbz#1472290 CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778

  • Critical
    ELSA-2017-1789 21 CVEs

    Critical: java-1.8.0-openjdk security update (Oracle Linux 7)

    [1:1.8.0.141-2.b16] - Update to aarch64-jdk8u141-b16. - Revert change to remove-intree-libraries.sh following backout of 8173207 - Resolves: rhbz#1466509 [1:1.8.0.141-2.b15] - Revert previous commit so we can revise the security update. - Resolves: rhbz#14684…

  • High max 7.5
    ELSA-2017-1680 2 CVEs

    Important: bind security and bug fix update (Oracle Linux 7)

    [32:9.9.4-50.1] - Bump again above RHEL-7.4 [32:9.9.4-38.5] - Fix CVE-2017-3142 and CVE-2017-3143 [32:9.9.4-38.4] - Update root servers and trust anchor (#1459649)

  • High
    ELSA-2017-1681 1 CVE

    Important: qemu-kvm security update (Oracle Linux 7)

    [1.5.3-126.el7_3.10] - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1460179] - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1460179] - Resolves: bz#1460179 (CVE-2017-9524 qemu-kvm: Qemu: nbd: segmentation fault due to clie…

  • High
    ELSA-2017-3589 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-94.3.8] - macsec: dynamically allocate space for sglist (Jason A. Donenfeld) [Orabug: 26368162] {CVE-2017-7477} - macsec: avoid heap overflow in skb_to_sgvec (Jason A. Donenfeld) [Orabug: 26368162] {CVE-2017-7477} - nfsd: check for oversize…

  • High
    ELSA-2017-3590 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.19.2] - nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields) [Orabug: 26366022] {CVE-2017-7645} [3.8.13-118.19.1] - selinux: quiet the filesystem labeling behavior message (Paul Moore) [Orabug: 25290650] - HID: hid-cypress: va…

  • High
    ELSA-2017-3587 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-94.3.7] - mm: fix new crash in unmapped_area_topdown() (Hugh Dickins) [Orabug: 26326143] {CVE-2017-1000364} - mm: larger stack guard gap, between vmas (Hugh Dickins) [Orabug: 26326143] {CVE-2017-1000364}

  • High
    ELSA-2017-1581 1 CVE

    Important: freeradius security update (Oracle Linux 7)

    [3.0.4-8] - Disable internal OpenSSL cache and fix session cache file permissions. Resolves: Bug#1459131 CVE-2017-9148 freeradius: TLS resumption authentication bypass

  • High
    ELSA-2017-1615 5 CVEs

    Important: kernel security and bug fix update (Oracle Linux 7)

    - [3.10.0-514.26.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-514.26.1] - [mm] enlarge st…

  • High max 8.8
    ELSA-2017-1576 1 CVE

    Important: mercurial security update (Oracle Linux 7)

    [1.4-5] - Fixes CVE-2017-9462