Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

Medium

ELSA-2017-1574 1 CVE

Moderate: sudo security update (Oracle Linux 7)

[1.7.2p1-29.0.2] - Fix CVE-2017-1000368

Jun 23, 2017
High

ELSA-2017-1561 19 CVEs

Important: thunderbird security update (Oracle Linux 7)

[52.2.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [52.2.0-1] - Update to 52.2.0

Jun 21, 2017
High

ELSA-2017-1484 1 CVE

Important: kernel security update (Oracle Linux 7)

- [3.10.0-514.21.2.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-514.21.2] - [mm] enlarge st…

Jun 19, 2017
High

ELSA-2017-1481 1 CVE

Important: glibc security update (Oracle Linux 7)

[2.17-157.4] - Avoid large allocas in the dynamic linker (#1452720)

Jun 19, 2017
Critical

ELSA-2017-1440 19 CVEs

Critical: firefox security update (Oracle Linux 7)

[52.2.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Force requirement of newer gdk-pixbuf2 to ensure a proper update (Todd Vierling) [orabug 19847484] [52.2.0-1] - Update to 52.2.0 ESR [52.1.1-1] - Update to 52.1.1 …

Jun 14, 2017
High

ELSA-2017-1430 2 CVEs

Important: qemu-kvm security and bug fix update (Oracle Linux 7)

[1.5.3-126.el7_3.9] - kvm-spice-fix-spice_chr_add_watch-pre-condition.patch [bz#1452332] - Resolves: bz#1452332 (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop) [1.5.3-126.el7_3.8] - kvm-char-change-qe…

Jun 13, 2017
High

ELSA-2017-3579 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-94.3.6] - net/packet: fix overflow in check for tp_reserve (Andrey Konovalov) [Orabug: 26143545] {CVE-2017-7308} - net/packet: fix overflow in check for tp_frame_nr (Andrey Konovalov) [Orabug: 26143545] {CVE-2017-7308} - net/packet: fix ove…

Jun 1, 2017
High

ELSA-2017-3580 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.18.4] - net/packet: fix overflow in check for tp_reserve (Andrey Konovalov) [Orabug: 26143552] {CVE-2017-7308} - net/packet: fix overflow in check for tp_frame_nr (Andrey Konovalov) [Orabug: 26143552] {CVE-2017-7308} - net/packet: fix o…

Jun 1, 2017
High

ELSA-2017-1365 1 CVE

Important: nss security and bug fix update (Oracle Linux 7)

[3.28.4-1.2.0.1] - Added nss-vendor.patch to change vendor [3.28.4-1.2] - Include CKBI 2.14 and updated CA constraints from NSS 3.28.5 [3.28.4-1.1] - Fix zero-length record treatment in SSL3_GatherData

May 30, 2017
High

ELSA-2017-1382 1 CVE

Important: sudo security update (Oracle Linux 7)

[1.8.6p3-28] - Fixes CVE-2017-1000367 Resolves: rhbz#1455399

May 30, 2017
High

ELSA-2017-1308 5 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

- [3.10.0-514.21.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-514.21.1] - [kernel] sched/…

May 26, 2017
High

ELSA-2017-3575 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.18.3] - dccp/tcp: do not inherit mc_list from parent (Eric Dumazet) [Orabug: 26108571] {CVE-2017-8890}

May 25, 2017
High

ELSA-2017-3574 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-94.3.5] - dccp/tcp: do not inherit mc_list from parent (Eric Dumazet) [Orabug: 26132091] {CVE-2017-8890}

May 25, 2017
High max 9.8

ELSA-2017-1270 1 CVE 1 exploited

Important: samba security update (Oracle Linux 7)

[3.6.23-43.0.1] - Remove use-after-free talloc_tos() inlined function problem (John Haxby) [orabug 18253258] [3.6.24-43] - resolves: #1450782 - Fix CVE-2017-7494

May 24, 2017
High

ELSA-2017-1263 1 CVE

Important: libtirpc security update (Oracle Linux 7)

[0.2.4-0.8_3] - Fixed for CVE-2017-8779 (bz 1449462)

May 22, 2017
High

ELSA-2017-1264 1 CVE

Important: kdelibs security update (Oracle Linux 7)

[6:4.14.8-6] - KAuth: verify that whoever is calling us is actually who he says he is (CVE-2017-8422) Resolves: CVE-2017-8422

May 22, 2017
Medium max 6.4

ELSA-2017-1265 3 CVEs

Moderate: samba security and bug fix update (Oracle Linux 7)

[4.4.4-13] - resolves: #1437816 - Fix krb5 memory cache in libads sasl code - resolves: #1437741 - Fix CVE-2016-2125, CVE-2016-2126 and CVE-2017-2619

May 22, 2017
High

ELSA-2017-1262 1 CVE

Important: rpcbind security update (Oracle Linux 7)

[0.2.0-38_3] - Fixed typo in memory leaks patch (bz 1449462)

May 22, 2017
High

ELSA-2017-3565 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-94.3.4] - ipv6: catch a null skb before using it in a DTRACE (Shannon Nelson) [Orabug: 26075879] - sparc64: Do not retain old VM_SPARC_ADI flag when protection changes on page (Khalid Aziz) [Orabug: 26038830] [4.1.12-94.3.3] - nfsd: stricte…

May 16, 2017
High

ELSA-2017-3566 11 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.18.2] - nfsd: stricter decoding of write-like NFSv2/v3 ops (J. Bruce Fields) [Orabug: 25986990] {CVE-2017-7895} [3.8.13-118.18.1] - fnic: Update fnic driver version to 1.6.0.24 (John Sobecki) [Orabug: 24448585] - xen-netfront: Rework th…

May 16, 2017
High max 7.8

ELSA-2017-1230 1 CVE 1 exploited

Important: ghostscript security update (Oracle Linux 7)

[8.70-23.el6_9.2] - Security fix for CVE-2017-8291 updated to address SIGSEGV [8.70-23.el6_9.1] - Added security fix for CVE-2017-8291 (bug #1446063)

May 12, 2017
High max 7.8

ELSA-2017-1208 30 CVEs

Important: jasper security update (Oracle Linux 7)

[1.900.1-21] - Bump release [1.900.1-20] - Multiple security fixes (fixed by thoger): CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089 CVE-2016-2116 CVE-2016-8654 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692 CVE-2016-8693 CVE-2016-8883 CVE-2…

May 9, 2017
Medium

ELSA-2017-1204 6 CVEs

Moderate: java-1.7.0-openjdk security update (Oracle Linux 7)

[1:1.7.0.141-2.6.10.1.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.141-2.6.10.1] - Bump to u141b02 to include S8011123 fix for TCK failure. - Resolves: rhbz#1438751 [1:1.7.0.141-2.6.10.0] - Bump to 2.6.10 and u141b00. - Adjust RH1022017 following applicatio…

May 9, 2017
High

ELSA-2017-1201 29 CVEs

Important: thunderbird security update (Oracle Linux 7)

[52.1.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [52.1.0-1] - Update to 52.1.0 [52.0.1-1] - Update to 52.0.1

May 8, 2017
Critical

ELSA-2017-1106 31 CVEs

Critical: firefox security update (Oracle Linux 7)

[52.1.0-2.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [52.1.0-2] - Update to 52.1.0 ESR (Build3) [52.1.0-1] - Update to 52.1.0 ESR

Apr 20, 2017
Critical

ELSA-2017-1100 1 CVE

Critical: nss and nss-util security update (Oracle Linux 7)

nss [3.28.4-1.0.1] - Added nss-vendor.patch to change vendor - Temporarily disable some tests until expired PayPalEE.cert is renewed [3.28.4-1] - Rebase to 3.28.4 nss-util [3.28.4-1] - Rebase to NSS 3.28.4 to accommodate base64 encoding fix

Apr 20, 2017
Medium

ELSA-2017-1108 6 CVEs

Moderate: java-1.8.0-openjdk security and bug fix update (Oracle Linux 7)

[1:1.8.0.131-2.b13] - Backport 'S8153711: [REDO] JDWP: Memory Leak: GlobalRefs never deleted when processing invokeMethod command' - Resolves: rhbz#1442162 [1:1.8.0.131-1.b11] - Update to aarch64-jdk8u131-b11. - Drop upstreamed patches for 8147910, 8161993, 8…

Apr 20, 2017
High max 7.5

ELSA-2017-1095 2 CVEs

Important: bind security update (Oracle Linux 7)

[32:9.9.4-38.3] - Fix CVE-2017-3136 (ISC change 4575) - Fix CVE-2017-3137 (ISC change 4578)

Apr 19, 2017
High max 5.5

ELSA-2017-0987 1 CVE

Important: qemu-kvm security update (Oracle Linux 7)

[1.5.3-126.el7_3.6] - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1430059] - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1430059] - kvm-cirrus-add-option-to-disable-blitter.patch [bz#1430059] - kvm-cirrus-fix-cirrus_i…

Apr 18, 2017
High

ELSA-2017-3539 7 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.34] - uek-rpm: enable CONFIG_KSPLICE. (Jamie Iles) [Orabug: 25698171] - ksplice: add sysctls for determining Ksplice features. (Jamie Iles) [Orabug: 25698171] - signal: protect SIGNAL_UNKILLABLE from unintentional clearing. (Jamie Iles…

Apr 13, 2017
High

ELSA-2017-3537 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.17.5] - block: fix use-after-free in seq file (Vegard Nossum) [Orabug: 25877530] {CVE-2016-7910}

Apr 13, 2017
Medium

ELSA-2017-0906 3 CVEs

Moderate: httpd security and bug fix update (Oracle Linux 7)

[2.4.6-45.0.1.4] - replace index.html with Oracle's index page oracle_index.html [2.4.6-45.4] - Resolves: #1396197 - Backport: mod_proxy_wstunnel - AH02447: err/hup on backconn [2.4.6-45.3] - prefork: fix delay completing graceful restart (#1327624) - mod_lda…

Apr 12, 2017
High max 6.5

ELSA-2017-0920 1 CVE

Important: 389-ds-base security and bug fix update (Oracle Linux 7)

[1.3.5.10-20] - Bump version to 1.3.5.10-20 - Resolves: bug 1437005 - CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages [1.3.5.10-19] - Release 1.3.5.10-19 - Resolves: bug 1429495 - ns-slapd dies under heavy load - Resolves: bug 1429498 - A fi…

Apr 12, 2017
Medium

ELSA-2017-0914 1 CVE

Moderate: libreoffice security and bug fix update (Oracle Linux 7)

[1:5.0.6.2-5.0.1.1] - Replaced RedHat colors with Oracle colors, and the filename redhat.soc with oracle.soc in specfile - Build with --with-vendor='Oracle America, Inc.' [1:5.0.6.2-5.1] - Resolves: rhbz#1435534 CVE-2017-3157 Arbitrary file disclosure in Calc…

Apr 12, 2017
High max 5.5

ELSA-2017-0933 4 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

- [3.10.0-514.16.1.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-514.16.1] - [tty] n_hdlc: g…

Apr 12, 2017
Medium max 7.5

ELSA-2017-0935 2 CVEs

Moderate: tomcat security update (Oracle Linux 7)

[0:7.0.69-11] - Resolves: rhbz#1413591 CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing - Resolves: rhbz#1402662 CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests

Apr 12, 2017
Medium max 5.5

ELSA-2017-0907 1 CVE

Moderate: util-linux security and bug fix update (Oracle Linux 7)

[2.23.2-33.0.1.el7_u3.2] - fix Oracle bug 23001516 - backport lscpu: correct the Virtualization type on Xen DomU PV guest - Reviewed-by: Joe Jin <joe.jin@oracle.com> [2.23.2-33.el7_3.2] * fix CVE-2017-2616 - Sending SIGKILL to other processes with root privil…

Apr 12, 2017
High

ELSA-2017-3534 18 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.17.4] - Revert 'fix minor infoleak in get_user_ex()' (Brian Maly) [Orabug: 25790392] {CVE-2016-9644} [3.8.13-118.17.3] - net: ping: check minimum size on ICMP header length (Kees Cook) [Orabug: 25766911] {CVE-2016-8399} [3.8.13-118.17.2…

Mar 31, 2017
High

ELSA-2017-3533 22 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.33] - Revert 'x86/mm: Expand the exception table logic to allow new handling options' (Brian Maly) [Orabug: 25790387] {CVE-2016-9644} - Revert 'fix minor infoleak in get_user_ex()' (Brian Maly) [Orabug: 25790387] {CVE-2016-9644} [4.1.1…

Mar 31, 2017
Medium max 6.5

ELSA-2017-0838 6 CVEs

Moderate: openjpeg security update (Oracle Linux 7)

[1.5.1-16] - Revert previous changes in patch for CVE-2016-5159 - Fix memory leaks Related: #1419772 [1.5.1-15] - Add two more allocation checks to patch for CVE-2016-5159 Related: #1419772 [1.5.1-14] - Fix CWE-825 errors in patch for CVE-2016-5158 Related: #…

Mar 22, 2017