Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

  • High
    ELSA-2016-3651 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.15.1] - Revert 'i40e: Set defport behavior for the Main VSI when in promiscuous mode' (Jack Vogel) [Orabug: 22683573] - mlx4: avoid multiple free on id_map_ent (Wengang Wang) - xen-netfront: cast grant table reference first to type int …

  • High
    ELSA-2016-3648 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-61.1.22] - ocfs2: fix trans extend while free cached blocks (Junxiao Bi) [Orabug: 25136991] - ocfs2: fix trans extend while flush truncate log (Junxiao Bi) [Orabug: 25136991] - ocfs2: extend enough credits for freeing one truncate record wh…

  • Medium max 6.4
    ELSA-2016-2872 2 CVEs

    Moderate: sudo security update (Oracle Linux 7)

    [1.8.6p3-25] - Update noexec syscall blacklist - Fixes CVE-2016-7032 and CVE-2016-7076 Resolves: rhbz#1391937

  • High max 7.5
    ELSA-2016-2850 1 CVE 1 exploited

    Important: thunderbird security update (Oracle Linux 7)

    [45.5.1-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [45.5.1-1] - Update to 45.5.1

  • Critical max 7.5
    ELSA-2016-2843 1 CVE 1 exploited

    Critical: firefox security update (Oracle Linux 7)

    [45.5.1-1.0.1] - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files [45.5.1-1] - Update to 45.5.1 ESR

  • High
    ELSA-2016-2825 1 CVE

    Important: thunderbird security update (Oracle Linux 7)

    [45.5.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [45.5.0-1] - Update to 45.5.0

  • Medium
    ELSA-2016-2824 1 CVE

    Moderate: expat security update (Oracle Linux 7)

    [2.0.1-13] - updated security fix for CVE-2016-0718 [2.0.1-12] - add security fix for CVE-2016-0718

  • High max 9.8
    ELSA-2016-2819 3 CVEs

    Important: memcached security update (Oracle Linux 7)

    [0:1.4.15-10.el7_3.1] - fix vulnerabilities allowing remote code execution (CVE-2016-8704, CVE-2016-8705, CVE-2016-8706) [0:1.4.15-10] - fix binding to IPv6 address (#1298603) - enable SASL support (#1263696) - don't allow authentication with bad SASL credent…

  • High max 9.1
    ELSA-2016-2809 1 CVE

    Important: ipsilon security update (Oracle Linux 7)

    [1.0.0-13] - Backport patch for CVE-2016-8638 RHBZ#1394116

  • High
    ELSA-2016-3644 10 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-61.1.19] - acpi: Disable ACPI table override if securelevel is set (Linn Crosetto) [Orabug: 25058966] {CVE-2016-3699} - aacraid: Check size values after double-fetch from user (Dave Carroll) [Orabug: 25060060] {CVE-2016-6480} {CVE-2016-6480…

  • High
    ELSA-2016-3645 9 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.14.2] - aacraid: Check size values after double-fetch from user (Dave Carroll) [Orabug: 25060050] {CVE-2016-6480} {CVE-2016-6480} - IB/srpt: Simplify srpt_handle_tsk_mgmt() (Bart Van Assche) [Orabug: 25060011] {CVE-2016-6327} - audit: f…

  • Medium max 5.3
    ELSA-2016-2779 3 CVEs

    Moderate: nss and nss-util security update (Oracle Linux 7)

    nss [3.21.3-2.0.1] - Added nss-vendor.patch to change vendor [3.21.3-2] - Mozilla #1314604 / Red Hat CVE-2016-8635 [3.21.3-1.1] - rebuild [3.21.3-1] - Rebase to NSS 3.21.3 - Resolves: #1383887 nss-util [3.21.3-1.1] - rebuild [3.21.3-1] - Rebase to nss-3.21.3 …

  • Critical
    ELSA-2016-2780 6 CVEs

    Critical: firefox security update (Oracle Linux 7)

    [45.5.0-1.0.1] - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files [45.5.0-1] - Update to 45.5.0 ESR [45.4.0-3] - Added upcoming upstream patches mozbz#1018486 [45.4.0-2] - Added Laszlo Er…

  • High
    ELSA-2016-2702 1 CVE

    Important: policycoreutils security update (Oracle Linux 7)

    [2.0.83-30.1.0.1] - Lazy unmount private, shared entry(Joe Jin)[orabug 12560705] [2.0.83-30.1] - sandbox: create a new session for sandboxed processes Resolves: CVE-2016-7545

  • Medium
    ELSA-2016-2577 3 CVEs

    Moderate: libvirt security, bug fix, and enhancement update (Oracle Linux 7)

    [2.0.0-10] - virtlogd: Don't stop or restart along with libvirtd (rhbz#1372576) [2.0.0-9] - Add helper for removing transient definition (rhbz#1368774) - qemu: Remove stale transient def when migration fails (rhbz#1368774) - qemu: Don't use query-migrate on d…

  • Medium
    ELSA-2016-2597 1 CVE

    Moderate: firewalld security, bug fix, and enhancement update (Oracle Linux 7)

    [0.4.3.2-8] - Exclude firewallctl (RHBZ#1374799) [0.4.3.2-7] - Tolerate ipv6_rpfilter fail (RHBZ#1285769) - Fix set_rules to copy the rule before extracting the table (RHBZ#1373260) - Translation update (RHBZ#1273296) - Conflict with NetworkManager < 1:1.4.0-…

  • Low
    ELSA-2016-2591 2 CVEs

    Low: krb5 security, bug fix, and enhancement update (Oracle Linux 7)

    [1.14.1-26] - Use responder in non-preauth AS reqs - Resolves: #1363690 [1.14.1-25] - Fix bad debug_log() call in selinux handling - Resolves: #1292153 [1.14.1-24] - Fix KKDCPP with TLS SNI by always presenting 'Host:' header - Resolves: #1364993 [1.14.1-23] …

  • Medium
    ELSA-2016-2674 1 CVE

    Moderate: libgcrypt security update (Oracle Linux 7)

    [1.5.3-13.1] - fix CVE-2016-6313 - predictable PRNG output (#1366105) [1.5.3-13] - touch only urandom in the selftest and when /dev/random is unavailable for example by SELinux confinement - fix the RSA selftest key (p q swap)

  • Medium
    ELSA-2016-2585 2 CVEs

    Moderate: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 7)

    [1.5.3-126.el7] - kvm-virtio-recalculate-vq-inuse-after-migration.patch [bz#1376542] - Resolves: bz#1376542 (RHSA-2016-1756 breaks migration of instances) [1.5.3-125.el7] - kvm-nbd-server-Set-O_NONBLOCK-on-client-fd.patch [bz#1285453] - Resolves: bz#1285453 (…

  • Medium
    ELSA-2016-2576 1 CVE

    Moderate: libguestfs and virt-p2v security, bug fix, and enhancement update (Oracle Linux 7)

    libguestfs [1:1.32.7-3] - Rebase to libguestfs 1.32 in RHEL 7.3 resolves: rhbz#1218766 - The full tests are now run after the package has been built. - New tool and subpackage: virt-dib (safe diskimage-builder replacement). - New subpackage libguestfs-inspect…

  • Medium
    ELSA-2016-2603 1 CVE

    Moderate: libreswan security and bug fix update (Oracle Linux 7)

    [3.15-8.0.1] - add libreswan-oracle.patch to detect Oracle Linux distro [3.15-8] - Resolves: rhbz#1361721 libreswan pluto segfault [UPDATED] - Resolves: rhbz#1276524 [USGv6] IKEv2.EN.R.1.1.3.2 case failed due to response to bad INFORMATIONAL request [UPDATED]…

  • Medium
    ELSA-2016-2575 3 CVEs

    Moderate: curl security, bug fix, and enhancement update (Oracle Linux 7)

    [7.29.0-35] - fix incorrect use of a previously loaded certificate from file (related to CVE-2016-5420) [7.29.0-34] - acknowledge the --no-sessionid/CURLOPT_SSL_SESSIONID_CACHE option (required by the fix for CVE-2016-5419) [7.29.0-33] - fix re-using connecti…

  • Medium
    ELSA-2016-2583 15 CVEs

    Moderate: ntp security and bug fix update (Oracle Linux 7)

    [4.2.6p5-25.0.1] - add disable monitor to default ntp.conf [CVE-2013-5211] [4.2.6p5-25] - don't allow spoofed packet to enable symmetric interleaved mode (CVE-2016-1548) - check mode of new source in config command (CVE-2016-2518) - make MAC check resilient a…

  • Low
    ELSA-2016-2573 1 CVE

    Low: glibc security, bug fix, and enhancement update (Oracle Linux 7)

    [2.17-157] - Rebuild with updated binutils (#1268008) [2.17-156] - malloc arena free free list management fix (#1276753) [2.17-155] - Basic validity check for locale-archive.tmpl (#1350733) [2.17-153] - Add Intel AVX-512 optimized routines (#1298526). [2.17-1…

  • Medium
    ELSA-2016-2606 2 CVEs

    Moderate: postgresql security and bug fix update (Oracle Linux 7)

    [9.2.18-1] - update to 9.2.18 per release notes http://www.postgresql.org/docs/9.2/static/release-9-2-18.html http://www.postgresql.org/docs/9.2/static/release-9-2-17.html http://www.postgresql.org/docs/9.2/static/release-9-2-16.html [9.2.15-2] - fix postgres…

  • High
    ELSA-2016-2595 9 CVEs

    Important: mariadb security and bug fix update (Oracle Linux 7)

    [5.5.52-1] - Rebase to 5.5.52, that also include fix for CVE-2016-6662 Resolves: #1377974 [1:5.5.50-2] - Rebuild Related: #1359629

  • Low
    ELSA-2016-2581 1 CVE

    Low: NetworkManager security, bug fix, and enhancement update (Oracle Linux 7)

    NetworkManager [1:1.4.0-12] - device: consider a device with slaves configured (rh#1333983) [1:1.4.0-11] - build: add RPM dependency for exact glib2 version (rh#1378809) [1:1.4.0-10] - device: improve connection matching for assuming bond and infiniband (rh#1…

  • Low
    ELSA-2016-2605 1 CVE

    Low: util-linux security, bug fix, and enhancement update (Oracle Linux 7)

    [2.23.2-33.0.1] - fix Oracle bug 23001516 - backport lscpu: correct the Virtualization type on Xen DomU PV guest - Reviewed-by: Joe Jin <joe.jin@oracle.com> [2.23.2-33] - improve patch for #1007734 (libblkid realpaths) [2.23.2-32] - improve patch for chrt(1) …

  • Low
    ELSA-2016-2593 1 CVE

    Low: sudo security, bug fix, and enhancement update (Oracle Linux 7)

    [1.8.6p7-20] - RHEL 7.3 erratum - fixed visudo's -q flag Resolves: rhbz#1350828 [1.8.6p7-19] - RHEL 7.3 erratum - removed INPUTRC from env_keep to prevent a potential info leak Resolves: rhbz#1340700 [1.8.6p7-18] - RHEL 7.3 erratum - removed requiretty flag f…

  • Medium
    ELSA-2016-2580 1 CVE

    Moderate: poppler security and bug fix update (Oracle Linux 7)

    [0.26.5-16] - Fix crash in Splash - Resolves: #1299492 [0.26.5-15] - Check array length - Resolves: #1299506 [0.26.5-14] - Show correct glyph or none instead of 'fi' - Resolves: #1298616 [0.26.5-13] - Check for groupColorSpace existance - Resolves: #1299479 […

  • Medium
    ELSA-2016-2600 5 CVEs

    Moderate: squid security, bug fix, and enhancement update (Oracle Linux 7)

    [7:3.5.20-2] - Resolves: #1378025 - host_verify_strict only accepts lowercase arguments [7:3.5.20-1] - Resolves: #1273942 - Rebase squid to latest mature 3.5 version (3.5.20) [7:3.5.10-9] - Related: #1349775 - Provide migration tools needed due to rebase to s…

  • Medium
    ELSA-2016-2590 1 CVE

    Moderate: dhcp security, bug fix, and enhancement update (Oracle Linux 7)

    [12:4.2.5-47.0.1] - Added oracle-errwarn-message.patch [12:4.2.5-47] - 1269596 - fix undefined variable in dhclient-script [12:4.2.5-46] - unclosed TCP connections to OMAPI or failover ports can cause DoS (CVE-2016-2774) [12:4.2.5-45] - 1267489 - dhclient-scr…

  • High
    ELSA-2016-2615 1 CVE

    Important: bind security update (Oracle Linux 7)

    [32:9.9.4-38] - Fix CVE-2016-8864 [32:9.9.4-37] - Fix CVE-2016-2776 [32:9.9.4-36] - Added automatic interface scan functionality (#1294506) - Removed NetworkManager dispatcher script since it is not needed any more (#1294506) [32:9.9.4-35] - Added GeoIP suppo…

  • Low
    ELSA-2016-2586 1 CVE

    Low: python security, bug fix, and enhancement update (Oracle Linux 7)

    [2.7.5-48.0.1] - Add Oracle Linux distribution in platform.py [orabug 20812544] [2.7.5-48] - Fix for CVE-2016-1000110 HTTPoxy attack Resolves: rhbz#1359164 [2.7.5-47] - Fix for CVE-2016-5636: possible integer overflow and heap corruption in zipimporter.get_da…

  • Medium
    ELSA-2016-2598 4 CVEs

    Moderate: php security and bug fix update (Oracle Linux 7)

    [5.4.16-42] - bz2: fix improper error handling in bzread() CVE-2016-5399 [5.4.16-41] - gd: fix integer overflow in _gd2GetHeader() resulting in heap overflow CVE-2016-5766 - gd: fix integer overflow in gdImagePaletteToTrueColor() resulting in heap overflow CV…

  • High
    ELSA-2016-2658 5 CVEs

    Important: java-1.7.0-openjdk security update (Oracle Linux 7)

    [1:1.7.0.121-2.6.8.0.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.121-2.6.8.0] - Turn off HotSpot bootstrap to see if it resolves build issues. - Resolves: rhbz#1381990 [1:1.7.0.121-2.6.8.0] - Bump to 2.6.8 and u121b00. - Drop patches (S7081817, S8140344, S…

  • High
    ELSA-2016-2604 1 CVE

    Important: resteasy-base security and bug fix update (Oracle Linux 7)

    [3.0.6-4] - Resolves: rhbz1378619 - disable SerializerProvider by default [3.0.6-3] - Resolves: rhbz1357624 - fail to build with java 8 [3.0.6-2] - Resolves: rhbz1280539 - fix pom version

  • Medium
    ELSA-2016-2589 1 CVE

    Moderate: gimp security, bug fix, and enhancement update (Oracle Linux 7)

    gimp [2:2.8.16-3] - fix multiple use-after-free bugs when parsing XCF channel and layer properties (#1348617) [2:2.8.16-2] - add back obsoletes necessary for RHEL [2:2.8.16-1] - version 2.8.16 [2:2.8.14-3] - export-dialog-destroyed-crash patch: avoid subseque…

  • Medium
    ELSA-2016-2594 3 CVEs

    Moderate: 389-ds-base security, bug fix, and enhancement update (Oracle Linux 7)

    [1.3.5.10-11] - Release 1.3.5.10-11 - Resolves: bug 1321124 - Replication changelog can incorrectly skip over updates [1.3.5.10-10] - Release 1.3.5.10-10 - Resolves: bug 1370300 - set proper update status to replication agreement in case of failure (DS 48957)…

  • Low
    ELSA-2016-2602 1 CVE

    Low: mod_nss security, bug fix, and enhancement update (Oracle Linux 7)

    [1.0.14-7] - Add the permission patch to the repository (#1312583) [1.0.14-6] - Check the NSS certificate database directory for read permissions by the Apache user. (#1312583) [1.0.14-5] - Update clean semaphore patch to not free the pinList twice. (#1364560…