Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

High max 8.8

ELSA-2026-86606 1 CVE

Important: gvfs security update (Oracle Linux 7)

[1.36.2-7.0.1] - Backport fix for CVE-2026-84268 [Orabug: 40186814]

Nov 4, 2026
Medium max 7.8

ELSA-2026-95281 1 CVE

Moderate: xorg-x11-server-Xwayland security update (Oracle Linux 8)

[21.1.3-20.5] - Add missing antecedent for CVE-2026-93520 fix Resolves: https://redhat.atlassian.net/browse/RHEL-299853

Nov 4, 2026
High max 9.1

ELSA-2026-93471 2 CVEs

Important: perl-YAML:1.24 security update (Oracle Linux 8)

perl-YAML [1.24-4] - CVE-2017-20285 perl-YAML:1.24/perl-YAML: perl-yaml: Arbitrary destructor method execution via crafted YAML document destructor method execution via crafted YAML document - CVE-2019-25777 perl-YAML:1.24/perl-YAML: perl-yaml: Arbitrary code…

Nov 4, 2026
High max 9.8

ELSA-2026-500570 12 CVEs

Important: ovirt-engine-wildfly security update (Oracle Linux 8)

ovirt-engine-wildfly [24.0.1-4] - Update all bundled CXF release artifacts to 3.6.13 ovirt-engine-wildfly-overlay [24.0.1-4] - Require WildFly 24.0.1-4 with the CXF 3.6.13 update

Nov 4, 2026
High max 9.6

ELSA-2026-95194 17 CVEs

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.54.2-0.el9_8.2] - Update bundled Skia to aa789d9bd566

Nov 4, 2026
High max 8.6

ELSA-2026-95086 6 CVEs

Important: tesseract security update (Oracle Linux 9)

[4.1.1-11] - Fix incomplete CVE-2026-88051: reset 'size_used_' on validation failure in 'GenericVector::read()'; check 'fontinfo_table_' and 'fontset_table_' read return values in 'ReadIntTemplates' [4.1.1-10] - Replace ASSERT_HOST around LSTM model Load with…

Nov 4, 2026
High max 9.8

ELSA-2026-500571 12 CVEs

Important: ovirt-engine-wildfly security update (Oracle Linux 9)

ovirt-engine-wildfly [24.0.1-4] - Update all bundled CXF release artifacts to 3.6.13 ovirt-engine-wildfly-overlay [24.0.1-4] - Require WildFly 24.0.1-4 with the CXF 3.6.13 update

Nov 4, 2026
High max 8.6

ELSA-2026-95085 6 CVEs

Important: tesseract security update (Oracle Linux 10)

[5.3.4-11] - Fix incomplete CVE-2026-88051: reset 'size_used_' on validation failure in 'GenericVector::read()'; check 'fontinfo_table_' and 'fontset_table_' read return values in 'ReadIntTemplates' [5.3.4-10] - Replace ASSERT_HOST around LSTM model Load with…

Nov 4, 2026
Medium max 7.5

ELSA-2026-94485 2 CVEs

Moderate: cockpit security, bug fix, and enhancement update (Oracle Linux 8)

[310.10-1.0.1] - Fixed cockpit_ws_t selinux issue for tmpfs [Orabug: 36013589] - Move update-motd out of cockpit_ws_t context [Orabug: 36013589] - Update documentation links [Orabug: 34706402] - Drop subscription-manager-cockpit requirement for ol [Orabug: 34…

Nov 3, 2026
Medium max 6.6

ELSA-2026-76777 2 CVEs

Moderate: glibc security update (Oracle Linux 8)

[2.28-251.0.5.48] - Forward port of Oracle patches to 2.28-251.48 Reviewed-by: Kris Van Hees <kris.van.hees@oracle.com> Oracle history: July-28-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.5.40 - Fixed orabug 39809344 - Default ldso uses…

Nov 3, 2026
High max 9.8

ELSA-2026-94405 145 CVEs

Important: firefox security update (Oracle Linux 8)

[153.6.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [153.6.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [153.6.0-1] - Upd…

Nov 3, 2026
Medium max 5.9

ELSA-2026-80798 4 CVEs

Moderate: glibc security update (Oracle Linux 8)

[2.28-251.0.5.48] - Forward port of Oracle patches to 2.28-251.48 Reviewed-by: Kris Van Hees <kris.van.hees@oracle.com> Oracle history: July-28-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.5.40 - Fixed orabug 39809344 - Default ldso uses…

Nov 3, 2026
High max 7.5

ELSA-2026-94749 1 CVE

Important: python-dns security update (Oracle Linux 8)

[1.15.0-13] - CVE-2026-114605 python-dns: dnspython: Denial of Service via excessive DNS compression pointer traversal Resolves: RHEL-290592

Nov 3, 2026
High max 7.4

ELSA-2026-94510 3 CVEs

Important: freerdp security update (Oracle Linux 8)

[2:2.11.7-15] - Backport several CVE fixes (CVE-2026-109242, CVE-2026-110837, CVE-2026-111880) Resolves: RHEL-282289, RHEL-283715, RHEL-286595

Nov 3, 2026
High max 7.1

ELSA-2026-94519 1 CVE

Important: raptor2 security update (Oracle Linux 8)

[2.0.15-18] - CVE-2025-71436 raptor2: raptor2: arbitrary code execution via heap-based buffer overflow in language tag handling heap-based buffer overflow in language tag handling - Resolves: RHEL-287843

Nov 3, 2026
Critical max 9.4

ELSA-2026-86192 22 CVEs

Critical: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 8)

[10.0.114-1.0.2] - Add support for Oracle Linux - build dotnet-host [10.0.114-1] - Update to .NET SDK 10.0.114 and Runtime 10.0.14 - Resolves: RHEL-291741 [10.0.113-2] - Update to .NET SDK 10.0.113 and Runtime 10.0.13 - Resolves: RHEL-277805

Nov 3, 2026
High max 7.8

ELSA-2026-92431 1 CVE

Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 8)

[10.0.114-1.0.2] - Add support for Oracle Linux - build dotnet-host [10.0.114-1] - Update to .NET SDK 10.0.114 and Runtime 10.0.14 - Resolves: RHEL-291741 [10.0.113-2] - Update to .NET SDK 10.0.113 and Runtime 10.0.13 - Resolves: RHEL-277805

Nov 3, 2026
Medium max 7.8

ELSA-2026-93930 2 CVEs

Moderate: kernel security update (Oracle Linux 9)

[5.14.0-687.65.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Nov 3, 2026
High max 7.8

ELSA-2026-93975 5 CVEs

Important: gimp security update (Oracle Linux 9)

[2:3.0.4-4.15] - fix CVE-2026-106062 - fix CVE-2026-112257 - fix CVE-2026-112258 - fix CVE-2026-112260 - fix CVE-2026-112261

Nov 3, 2026
High max 9.8

ELSA-2026-93957 145 CVEs

Important: firefox security update (Oracle Linux 9)

[153.6.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [153.6.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Ab…

Nov 3, 2026
High max 7.5

ELSA-2026-94533 3 CVEs

Important: cockpit security update (Oracle Linux 9)

[356.4-1.0.1] - Apply the patch for duplicate reference [Orabug: 39250109] - Storage: Enable btrfs support [Orabug: 37464632] - Replaced upstream urls in documentation with oracle links [Orabug: 36528753] - Drop subscription-manager-cockpit requirement for ol…

Nov 3, 2026
High max 7.3

ELSA-2026-88421 1 CVE

Important: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 9)

[10.1.0-17.el9_8.9] - kvm-qcow2-Add-keep_data_file-command-line-option.patch [RHEL-164549] - kvm-qcow2-Simplify-size-round-up-in-co_create_opts.patch [RHEL-164549] - kvm-iotests-common.filter-Sort-keep_data_file.patch [RHEL-164549] - kvm-iotests-244-Add-test-…

Nov 3, 2026
Critical max 9.1

ELSA-2026-94500 5 CVEs

Critical: fence-agents security update (Oracle Linux 9)

[4.10.0-110.8] - bundled PyJWT: upgrade to v2.15.1 to fix CVE-2026-102266, CVE-2026-102267, CVE-2026-102268, CVE-2026-102271, and CVE-2026-102272 Resolves: RHEL-281011, RHEL-281460, RHEL-286482, RHEL-278388, RHEL-281053

Nov 3, 2026
High max 8.8

ELSA-2026-94629 14 CVEs

Important: dpdk security update (Oracle Linux 9)

[25.11-2] - Backport fixes for CVE-2026-86846 CVE-2026-86848 CVE-2026-86561 CVE-2026-86562 CVE-2026-86563 CVE-2026-86567 CVE-2026-86566 CVE-2026-86849 CVE-2026-86845 CVE-2026-86847 CVE-2026-86856 CVE-2026-86565 CVE-2026-93683 CVE-2026-100236

Nov 3, 2026
Critical max 9.1

ELSA-2026-94501 5 CVEs

Critical: fence-agents security update (Oracle Linux 10)

[4.16.0-21.7] - bundled PyJWT: upgrade to v2.15.1 to fix CVE-2026-102266, CVE-2026-102267, CVE-2026-102268, CVE-2026-102271, and CVE-2026-102272 Resolves: RHEL-281025, RHEL-281457, RHEL-286479, RHEL-278385, RHEL-281051

Nov 3, 2026
High max 8.8

ELSA-2026-94630 14 CVEs

Important: dpdk security update (Oracle Linux 10)

[25.11-2] - Backport fixes for CVE-2026-86846 CVE-2026-86848 CVE-2026-86561 CVE-2026-86562 CVE-2026-86563 CVE-2026-86567 CVE-2026-86566 CVE-2026-86849 CVE-2026-86845 CVE-2026-86847 CVE-2026-86856 CVE-2026-86565 CVE-2026-93683 CVE-2026-100236

Nov 3, 2026
High max 8.8

ELSA-2026-94514 13 CVEs

Important: freerdp security, bug fix, and enhancement update (Oracle Linux 10)

[2:3.32.2-1] - Update to 3.32.2 - Backport gateway freeze and busy-loop fixes, including partial-header handling - Reset completed RDG header state before control-packet dispatch - Keep WebSocket and chunked-transfer decoder state separate Resolves: RHEL-2774…

Nov 3, 2026
High max 9.8

ELSA-2026-93956 145 CVEs

Important: firefox security update (Oracle Linux 10)

[153.6.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [153.6.0-1] - Update to 153.6.0 ESR

Nov 3, 2026
Medium max 7.8

ELSA-2026-93911 1 CVE

Moderate: kernel security update (Oracle Linux 10)

[6.12.0-211.73.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Nov 3, 2026
Medium max 7.7

ELSA-2026-76781 4 CVEs

Moderate: glibc security, bug fix, and enhancement update (Oracle Linux 10)

[2.39-145.0.1] - Forward port Oracle chnages to 2.39-145. Oracle history: Sep-01-2026 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.39-128.0.1 - Forward port Oracle changes to 2.39-128. - Reviewed-by: Elena Zannoni <elena.zannoni@oracle.com> Jul-15-2026 Cup…

Nov 3, 2026
Critical max 9.2

ELSA-2026-93077 3 CVEs

Critical: python-pillow security update (Oracle Linux 8)

[5.1.1-36] - CVE-2026-112900 python-pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE Resolves: RHEL-295960 [5.1.1-35] - CVE-2026-112398 python-pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to co…

Nov 2, 2026
Critical max 9.8

ELSA-2026-93414 1 CVE

Critical: kernel security update (Oracle Linux 8)

[4.18.0-553.182.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Nov 2, 2026
High max 8.1

ELSA-2026-93627 1 CVE

Important: wireshark security update (Oracle Linux 8)

[1:2.6.2-22] - DoS via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) - Resolves: RHEL-272318

Nov 2, 2026
High max 7.5

ELSA-2026-93438 2 CVEs

Important: libXi security update (Oracle Linux 8)

[1.7.10-4] - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow Resolves: RHEL-293443 [1.7.10-3] - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply Resolves: RHEL-293…

Nov 2, 2026
High max 7.3

ELSA-2026-93978 1 CVE

Important: ghostscript security update (Oracle Linux 8)

[9.27-20] - CVE-2026-112177 ghostscript: Reintroduction of .charkeys -dSAFER bypass in RHEL 8 -dSAFER bypass in RHEL 8

Nov 2, 2026
High max 7.1

ELSA-2026-93924 2 CVEs

Important: qt5-qtbase security update (Oracle Linux 8)

[5.15.3-10] - Fix CVE-2026-19248: unbounded recursion and O(N2) behavior in QDom Resolves: RHEL-261130 - Fix CVE-2026-11573: denial of services via uncontrolled recursion in XML serialization Resolves: RHEL-277662

Nov 2, 2026
High max 8.1

ELSA-2026-94011 5 CVEs

Important: bind9.16 security update (Oracle Linux 8)

[32:9.16.23-0.22.21] - CVE-2026-94300 bind9.16: bind: Arbitrary code execution via GSS-TSIG UDP message replay [32:9.16.23-0.22.20] - CVE-2026-97313 bind9.16: bind: Denial of service via assertion failure in RPZ query processing [32:9.16.23-0.22.19] - CVE-202…

Nov 2, 2026
High max 9.8

ELSA-2026-500573 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.361.4] - vhost-scsi: zero misaligned I/O bounce pages (Shubham Antil) [Orabug: 40193932] [5.4.17-2136.361.3] - KVM: x86: Use active memslots for the per-vCPU MMIO cache (Jinu Kim) [Orabug: 40180571] - drbd: fix 'LOGIC BUG' in drbd_al_begin_io_non…

Nov 2, 2026
High max 8.1

ELSA-2026-93925 3 CVEs

Important: bind security, bug fix, and enhancement update (Oracle Linux 8)

[32:9.11.36-18] - CVE-2026-94300 bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay [32:9.11.36-17] - CVE-2026-19630 bind: BIND: Denial of Service via unbounded processing of crafted DNS messages processing of crafted DNS messages [32:9.11.3…

Nov 2, 2026
High max 9.8

ELSA-2026-93436 6 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.182.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Nov 2, 2026