Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

Medium

ELSA-2016-2601 1 CVE

Moderate: fontconfig security and bug fix update (Oracle Linux 7)

[2.10.95-10] - Fix a regression in the previous change. (#1355930) [2.10.95-9] - CVE-2016-5384: Validate offsets in cache files properly. (#1355930) [2.10.95-8] - Update 45-latin.conf to add some hints to fall back for Windows fonts (#1073460)

Nov 9, 2016
Medium max 8.8

ELSA-2016-2599 7 CVEs

Moderate: tomcat security, bug fix, and enhancement update (Oracle Linux 7)

[0:7.0.69-10] - Related: rhbz#1368122 [0:7.0.69-9] - Resolves: rhbz#1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header - Resolves: rhbz#1368122 [0:7.0.69-7] - Resolves: rhbz#1362545 [0:7.0.69-6] - Related: rhbz#1201409…

Nov 9, 2016
Medium

ELSA-2016-2587 1 CVE

Moderate: wget security and bug fix update (Oracle Linux 7)

[1.14-13] - Fix CVE-2016-4971 (#1345778) - Added support for non-ASCII URLs (Related: CVE-2016-4971) [1.14-12] - Fix wget to include Host header on CONNECT as required by HTTP 1.1 (#1203384) - Run internal test suite during build (#1295846) - Fix -nv being do…

Nov 9, 2016
Medium max 7.8

ELSA-2016-2588 1 CVE

Moderate: openssh security, bug fix, and enhancement update (Oracle Linux 7)

[6.6.1p1-31 + 0.9.3-9] - Do not depend on selinux-policy (#1373297) [6.6.1p1-30 + 0.9.3-9] - Drop dependency on libcap-ng for ssh-keycat (#1357859) [6.6.1p1-29 + 0.9.3-9] - Rework SELinux context handling with chroot using libcap-ng (#1357859) [6.6.1p1-28 + 0…

Nov 9, 2016
Medium

ELSA-2016-2582 4 CVEs

Moderate: nettle security and bug fix update (Oracle Linux 7)

[2.7.1-8] - Use a cache-silent version of mpz_powm to prevent cache-timing attacks against RSA and DSA in shared VMs. (#1364897,CVE-2016-6489) [2.7.1-5] - Fixed SHA-3 implementation to conform to final standard (#1252936) - Fixed CVE-2015-8803 CVE-2015-8804 C…

Nov 9, 2016
Medium

ELSA-2016-2610 1 CVE

Moderate: systemd security and bug fix update (Oracle Linux 7)

[219-30.0.1.3] - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [22224874] - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469] - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475] - rules: load sg module (…

Nov 9, 2016
High

ELSA-2016-2574 28 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

- [3.10.0-514.OL7] - Oracle Linux certificates (Alexey Petrenko) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com) - Update x509.genkey [bug 24817676] [3.10.0-514] - [mm] remove gup_flags FOL…

Nov 9, 2016
Medium

ELSA-2016-2579 2 CVEs

Moderate: libreoffice security, bug fix, and enhancement update (Oracle Linux 7)

libcmis [0.5.1-2] - Resolves: rhbz#1330591 fix Google Drive login - Related: rhbz#1330591 fix changelog entry [0.5.1-1] - Related: rhbz#1290152 new upstream release [0.5.0-2] - Related: rhbz#1290152 autoreconf is not needed - Related: rhbz#1290152 add a bunch…

Nov 9, 2016
High

ELSA-2016-3635 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.17] - sched: panic on corrupted stack end (Jann Horn) [Orabug: 24971921] {CVE-2016-1583} - ecryptfs: forbid opening files without mmap handler (Jann Horn) [Orabug: 24971921] {CVE-2016-1583} - proc: prevent stacking filesystems on top (…

Nov 3, 2016
High

ELSA-2016-3636 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.14.1] - ecryptfs: forbid opening files without mmap handler (Jann Horn) [Orabug: 24971919] {CVE-2016-1583} - RDS: IB: fix panic with handlers running post teardown (Santosh Shilimkar) [Orabug: 24395795]

Nov 3, 2016
High max 7.0

ELSA-2016-2098 1 CVE 1 exploited

Important: kernel security update (Oracle Linux 7)

- [3.10.0-327.36.3.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.36.3] - [mm] remove gup_flags FOLL_WRITE games from __get_user_pages() (Alexander Gordeev) [1385123 1385124] {CVE-2016-5195}

Oct 24, 2016
High max 7.0

ELSA-2016-3633 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.13.3] - mm, gup: close FOLL MAP_PRIVATE race (Linus Torvalds) [Orabug: 24928591] {CVE-2016-5195}

Oct 21, 2016
High max 7.0

ELSA-2016-3632 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.16] - mm: remove gup_flags FOLL_WRITE games from __get_user_pages() (Linus Torvalds) [Orabug: 24927306] {CVE-2016-5195} [4.1.12-61.1.15] - drivers/nvme: provide a module parameter for setting number of I/O queues (Shan Hai) [Orabug: 24…

Oct 21, 2016
Critical

ELSA-2016-2079 5 CVEs

Critical: java-1.8.0-openjdk security update (Oracle Linux 7)

[1:1.8.0.111-0.b15] - added nss restricting requires - Resolves: rhbz#1381990 [1:1.8.0.111-0.b15] - Turn debug builds on for all JIT architectures. Always AssumeMP on RHEL. - Resolves: rhbz#1381990 [1:1.8.0.111-0.b15] - Update to aarch64-jdk8u111-b15, with AA…

Oct 19, 2016
High

ELSA-2016-3626 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.14] - net: add recursion limit to GRO (Sabrina Dubroca) [Orabug: 24829133] {CVE-2016-7039}

Oct 13, 2016
High

ELSA-2016-2047 1 CVE

Important: kernel security update (Oracle Linux 7)

- [3.10.0-327.36.2.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.36.2] - [net] add recursion limit to GRO (Sabrina Dubroca) [1378405 1374191] {CVE-2016-7039}

Oct 10, 2016
High max 8.1

ELSA-2016-2046 5 CVEs

Important: tomcat security update (Oracle Linux 7)

[0:7.0.54-8] - Resolves: rhbz#1368121 [0:7.0.54-7] - Resolves: rhbz#1362212 Tomcat: CGI sets environmental variable based on user supplied Proxy request header - Resolves: rhbz#1368121 [0:7.0.54-5] - Resolves: rhbz#1362567 [0:7.0.54-4] - Resolves: CVE-2015-53…

Oct 10, 2016
High

ELSA-2016-3625 2 CVEs

Important: Unbreakable Enterprise kernel security and bugfix update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.13] - HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Scott Bauer) [Orabug: 24803597] {CVE-2016-5829} [4.1.12-61.1.12] - ocfs2: Fix start offset to ocfs2_zero_range_for_truncate() (Ashish Samant) [Orabug: 24…

Oct 6, 2016
High

ELSA-2016-3623 2 CVEs

Important: Unbreakable Enterprise kernel security and bugfix update (Oracle Linux 7)

kernel-uek [3.8.13-118.13.2] - HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Scott Bauer) [Orabug: 24798695] {CVE-2016-5829} [3.8.13-118.13.1] - Revert 'rds: skip rx/tx work when destroying connection' (Brian Maly) [Orabug: 24790…

Oct 6, 2016
High

ELSA-2016-1985 1 CVE

Important: thunderbird security update (Oracle Linux 7)

[45.4.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [45.4.0-1] - Update to 45.4.0

Oct 3, 2016
High max 5.3

ELSA-2016-1978 1 CVE

Important: python-twisted-web security update (Oracle Linux 7)

[8.2.0-5] - Rebase HTTPoxy patch and bump release for rebuild Resolves: rhbz#1358789 [8.2.0-4] - Fix HTTPoxy CVE-2016-1000111 Resolves: rhbz#1358789

Sep 29, 2016
High

ELSA-2016-1944 1 CVE

Important: bind security update (Oracle Linux 7)

[30:9.3.6-25.P1.9] - Fix CVE-2016-2776 [30:9.3.6-25.P1.8] - Fix issue with patch for CVE-2016-1285 and CVE-2016-1286 found by test suite [30:9.3.6-25.P1.7] - Fix CVE-2016-1285 and CVE-2016-1286 [30:9.3.6-25.P1.6] - Fix CVE-2015-8704 [30:9.3.6-25.P1.5] - Fix C…

Sep 28, 2016
High

ELSA-2016-1940 9 CVEs

Important: openssl security update (Oracle Linux 7)

[1.0.1e-48.3] - fix CVE-2016-2177 - possible integer overflow - fix CVE-2016-2178 - non-constant time DSA operations - fix CVE-2016-2179 - further DoS issues in DTLS - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio() - fix CVE-2016-2181 - DTLS1 replay prote…

Sep 27, 2016
High

ELSA-2016-3617 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.11.2] - Btrfs: fix truncation of compressed and inlined extents (Ashish Samant) [Orabug: 22307285] {CVE-2015-8374} - Btrfs: fix file corruption and data loss after cloning inline extents (Divya Indi) [Orabug: 22307285] {CVE-2015-8374} -…

Sep 22, 2016
High

ELSA-2016-3619 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.10] - netfilter: x_tables: make sure e->next_offset covers remaining blob size (Florian Westphal) [Orabug: 24682076] {CVE-2016-4997} {CVE-2016-4998} - netfilter: x_tables: validate e->target_offset early (Florian Westphal) [Orabug: 246…

Sep 22, 2016
Critical

ELSA-2016-1912 12 CVEs

Critical: firefox security update (Oracle Linux 7)

[45.4.0-1.0.1] - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files [45.4.0-1] - Update to 45.4.0 ESR

Sep 21, 2016
High

ELSA-2016-1847 3 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

- [3.10.0-327.36.1.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.36.1] - [x86] Use pte_none() to test for empty PTE (Larry Woodman) [1363860 1347159] - [x86] Disallow running with 32-bit PTEs to work around erratum (Larry Woodman) [1363860 13…

Sep 14, 2016
High

ELSA-2016-1844 23 CVEs

Important: libarchive security update (Oracle Linux 7)

[3.1.2-10] - Fixes variation of CVE-2016-5418: Hard links could include '..' in their path. [3.1.2-9] - Fixes CVE-2016-5418: Archive Entry with type 1 (hardlink) causes file overwrite (#1365777) [3.1.2-8] - a bunch of security fixes (rhbz#1353065)

Sep 12, 2016
High

ELSA-2016-3612 1 CVE

Important: ntp security update (Oracle Linux 7)

[4.2.6p5-22.0.1.el7_2.2] - add disable monitor to default ntp.conf [CVE-2013-5211]

Sep 9, 2016
High

ELSA-2016-1809 1 CVE

Important: thunderbird security update (Oracle Linux 7)

[45.3.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [45.3.0-1] - Update to 45.3.0

Sep 5, 2016
Medium

ELSA-2016-1797 1 CVE

Moderate: ipa security update (Oracle Linux 7)

[3.0.0-50.el6.2] - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in certificate revocation - cert-revoke: fix permission check bypass (CVE-2016-5404)

Sep 1, 2016
High

ELSA-2016-3596 11 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-61.1.6] - blk-mq: avoid setting hctx->tags->cpumask before allocation (Akinobu Mita) [Orabug: 24464170] [4.1.12-61.1.3] - ocfs2: improve recovery performance (Junxiao Bi) [Orabug: 24395729] - qed: Utilize FW 8.10.3.0 (Yuval Mintz) [Orabug: …

Aug 26, 2016
High

ELSA-2016-1776 5 CVEs

Important: java-1.6.0-openjdk security update (Oracle Linux 7)

[1:1.6.0.40-1.13.12.4.0.1] - Add oracle-enterprise.patch [1:1.6.0.40-1.13.12.4] - Bump source tarballs to try and really fix TCK failures this time. - Resolves: rhbz#1350043 [1:1.6.0.40-1.13.12.3] - Bump source tarballs to missing -DNDEBUG on JDK native code.…

Aug 26, 2016
Medium

ELSA-2016-1626 3 CVEs

Moderate: python security update (Oracle Linux 7)

[2.6.6-66.0.1] - Add Oracle Linux distribution in platform.py [orabug 21288328] (Keshav Sharma) [2.6.6-66] - Fix for CVE-2016-1000110 HTTPoxy attack Resolves: rhbz#1359161 [2.6.6-65] - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303…

Aug 18, 2016
High

ELSA-2016-1633 1 CVE

Important: kernel security and bug fix update (Oracle Linux 7)

- [3.10.0-327.28.3.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.28.3] - [net] tcp: enable per-socket rate limiting of all 'challenge acks' (Florian Westphal) [1355603 1355605] {CVE-2016-5696} - [net] tcp: uninline tcp_oow_rate_limited() (Flo…

Aug 18, 2016
High

ELSA-2016-3594 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [4.1.12-37.6.3] - tcp: make challenge acks less predictable (Eric Dumazet) [Orabug: 24010103] [Orabug: 2401010] {CVE-2016-5696}

Aug 15, 2016
High

ELSA-2016-3595 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.10.2] - tcp: make challenge acks less predictable (Eric Dumazet) [Orabug: 24010012] [Orabug: 2401010] {CVE-2016-5696} [3.8.13-118.10.1] - ocfs2: call ocfs2_journal_access_di() before ocfs2_journal_dirty() in ocfs2_write_end_nolock() (ya…

Aug 15, 2016
Medium max 8.1

ELSA-2016-1613 1 CVE

Moderate: php security and bug fix update (Oracle Linux 7)

[5.4.16-36.3] - don't set environmental variable based on user supplied Proxy request header CVE-2016-5385 [5.4.16-36.2] - fix segmentation fault in header_register_callback #1346758

Aug 11, 2016
Medium

ELSA-2016-1606 2 CVEs

Moderate: qemu-kvm security update (Oracle Linux 7)

[1.5.3-105.el7_2.7] - kvm-block-iscsi-avoid-potential-overflow-of-acb-task-cdb.patch [bz#1358996] - Resolves: bz#1358996 (CVE-2016-5126 qemu-kvm: Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl [rhel-7.2.z]) [1.5.3-105.el7_2.6] - kvm-virtio-error-out-i…

Aug 11, 2016
High

ELSA-2016-1602 16 CVEs

Important: mariadb security update (Oracle Linux 7)

[1:5.5.50-1] - Rebase to 5.5.50 Resolves: #1359628

Aug 11, 2016