Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

  • High
    ELSA-2016-3591 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.9.2] - KEYS: potential uninitialized variable (Dan Carpenter) [Orabug: 24393864] {CVE-2016-4470}

  • High
    ELSA-2016-3593 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-37.6.2] - KEYS: potential uninitialized variable (Dan Carpenter) [Orabug: 24393865] {CVE-2016-4470} - ovl: fix permission checking for setattr (Miklos Szeredi) [Orabug: 24393742] {CVE-2015-8660}

  • Critical
    ELSA-2016-1551 12 CVEs

    Critical: firefox security update (Oracle Linux 7)

    [45.3.0-1.0.1] - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files [45.3.0-1] - Update to 45.3.0 ESR [45.2.0-3] - Added fix for mozbz#256180 [45.2.0-2] - Added fix for mozbz#975832, rhbz#1…

  • High
    ELSA-2016-1539 3 CVEs

    Important: kernel security and bug fix update (Oracle Linux 7)

    [3.10.0-327.28.2.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.28.2] - [net] bridge: include in6.h in if_bridge.h for struct in6_addr (Jiri Benc) [1331285 1268057] - [net] inet: defines IPPROTO_* needed for module alias generation (Jiri Benc)…

  • Medium
    ELSA-2016-1538 1 CVE

    Moderate: golang security, bug fix, and enhancement update (Oracle Linux 7)

    [1.6.3-1] - Resolves: rhbz#1358278 - CVE-2016-5386 [1.6.2-1] - rebase to 1.6.2 - Resolves: rhbz#1346331

  • High
    ELSA-2016-1546 19 CVEs

    Important: libtiff security update (Oracle Linux 7)

    [4.0.3-25] - Add patches for CVEs: CVE-2015-7554, CVE-2015-8683, CVE-2015-8665, CVE-2015-8781, CVE-2015-8782, CVE-2015-8783, CVE-2015-8784 - Related: #1299920 [4.0.3-24] - Update patches for CVEs: CVE-2014-8127, CVE-2014-8130 - Related: #1299920 [4.0.3-23] - …

  • High
    ELSA-2016-3587 3 CVEs

    Important: kernel-uek security update (Oracle Linux 7)

    kernel-uek [4.1.12-37.6.1] - vfs: rename: check backing inode being equal (Miklos Szeredi) [Orabug: 24010060] {CVE-2016-6198} {CVE-2016-6197} - vfs: add vfs_select_inode() helper (Miklos Szeredi) [Orabug: 24010060] {CVE-2016-6198} {CVE-2016-6197} - ovl: verif…

  • High
    ELSA-2016-3588 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.9.1] - mlx4: Increase SYNC_TPT command timeout (Mukesh Kacker) [Orabug: 22895790] - neigh: do not modify unlinked entries (Julian Anastasov) [Orabug: 23072705] - mm/slab: Improve performance of slabinfo stats gathering (Aruna Ramakrishn…

  • High
    ELSA-2016-1504 7 CVEs

    Important: java-1.7.0-openjdk security update (Oracle Linux 7)

    [1:1.7.0.111-2.6.7.1.0.1] - Add oracle-enterprise.patch - Fix DISTRO_NAME to 'Oracle Linux' [1:1.7.0.111-2.6.7.1] - Bump to jdk7u111 b01 to fix TCK regressions (7081817 & 8162344) - Resolves: rhbz#1350038 [1:1.7.0.111-2.6.7.0] - Bump to 2.6.7 and u111b00. - U…

  • Medium
    ELSA-2016-1486 1 CVE

    Moderate: samba security and bug fix update (Oracle Linux 7)

    [4.2.10-7] - resolves: #1351960 - Fix CVE-2016-2119 [4.2.10-6.3] - resolves: #1350759 - Fix idmap_hash when used with other modules - resolves: #1351260 - Fix krb5 encryption type setup during join

  • Critical
    ELSA-2016-1458 8 CVEs

    Critical: java-1.8.0-openjdk security update (Oracle Linux 7)

    [1:1.8.0.101-3.b13] - Replace bad 8159244 patch from upstream 8u with fresh backport from OpenJDK 9. - Resolves: rhbz#1350034 [1:1.8.0.101-2.b13] - Add missing hunk from 8147771, missed due to inclusion of unneeded 8138811 - Resolves: rhbz#1350034 [1:1.8.0.10…

  • High
    ELSA-2016-1422 1 CVE

    Important: httpd security and bug fix update (Oracle Linux 7)

    [2.4.6-40.0.1.4] - replace index.html with Oracle's index page oracle_index.html [2.4.6-40.4] - add security fix for CVE-2016-5387 [2.4.6-40.3] - add 451 (Unavailable For Legal Reasons) response status-code (#1353269) [2.4.6-40.2] - mod_cache: treat cache as …

  • High
    ELSA-2016-1392 1 CVE

    Important: thunderbird security update (Oracle Linux 7)

    [45.2-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [45.2-1] - Update to 45.2 [45.1.1-1] - Update to 45.1.1 [45.1.0-5] - Do not add symlinks to some langpacks [45.1.0-4] - Update to 45.1.0 [45.0-5] - Update to …

  • High max 8.1
    ELSA-2016-1292 14 CVEs

    Important: libxml2 security update (Oracle Linux 7)

    [2.9.1-6.0.1.3] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [libxml2-2.9.1-6.3] - Heap-based buffer overread in xmlNextChar (CVE-2016-1762) - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugz…

  • High
    ELSA-2016-1293 3 CVEs

    Important: setroubleshoot and setroubleshoot-plugins security update (Oracle Linux 7)

    setroubleshoot [3.2.24-4.0.1] - Add setroubleshoot-oracle-enterprise.patch to change bug reporting URL to linux.oracle.com [3.2.24-4] - Catch all subprocess module exceptions [3.2.24-3] - Use subprocess.check_output() with a sequence of program arguments [3.2…

  • Medium
    ELSA-2016-1296 1 CVE

    Moderate: ocaml security update (Oracle Linux 7)

    [4.01.0-22.7] - Fix buffer overflow and information leak CVE-2015-8869 resolves: rhbz#1343100

  • High
    ELSA-2016-1277 2 CVEs

    Important: kernel security and bug fix update (Oracle Linux 7)

    - [3.10.0-327.22.2.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.22.2] - [infiniband] security: Restrict use of the write() interface (Don Dutile) [1332553 1316685] {CVE-2016-4565} [3.10.0-327.22.1] - [mm] mmu_notifier: fix memory corruption …

  • High
    ELSA-2016-1237 7 CVEs

    Important: ImageMagick security update (Oracle Linux 7)

    [6.7.2.7-5] - Add fix for CVE-2016-3714, CVE-2016-3715, CVE-2016-3716 and CVE-2016-3717

  • High
    ELSA-2016-3570 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-37.5.1] - sched/core: Clear the root_domain cpumasks in init_rootdomain() (Xunlei Pang) [Orabug: 23520741] - ocfs2: bump up o2cb network protocol version (Junxiao Bi) [Orabug: 23515810] - IB/security: Restrict use of the write() interface (…

  • High
    ELSA-2016-3573 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.7.1] - megaraid_sas : Update threshold based reply post host index register (Sumit.Saxena@avagotech.com) [Orabug: 23562756] - xen/events: Don't move disabled irqs (Ross Lagerwall) [Orabug: 23055234] - xen/events: Mask a moving irq (Bori…

  • Critical
    ELSA-2016-1217 6 CVEs

    Critical: firefox security update (Oracle Linux 7)

    [45.2.0-1.0.1] - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files [45.2.0-1] - Update to 45.2.0 ESR [45.1.1-2] - Added fix for mozbz#1270046 - new Samba auth response

  • High
    ELSA-2016-1205 2 CVEs

    Important: spice security update (Oracle Linux 7)

    [0.12.4-15.1] - Fix heap-based memory corruption within smartcard handling Resolves: CVE-2016-0749 - Fix host memory access from guest with invalid primary surface parameters Resolves: CVE-2016-2150

  • Medium
    ELSA-2016-1139 8 CVEs

    Moderate: squid security update (Oracle Linux 7)

    [7:3.3.8-26.3] - Related: #1330576 - CVE-2016-4553 squid: Cache poisoning issue in HTTP Request handling - Related: #1334491 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556 squid: various flaws [7:3.3.8-26.2] - Related: #1330576 - CVE-2016-4051 CVE-2016-4052 CVE-…

  • Medium
    ELSA-2016-1141 5 CVEs

    Moderate: ntp security update (Oracle Linux 7)

    [4.2.6p5-10.el6_8.1] - don't allow spoofed packets to demobilize associations (CVE-2015-7979, CVE-2016-1547) - don't allow spoofed packet to enable symmetric interleaved mode (CVE-2016-1548) - check mode of new source in config command (CVE-2016-2518) - make …

  • High max 7.8
    ELSA-2016-3568 1 CVE

    Important: docker-engine security update (Oracle Linux 7)

    [1.10.3-1.0.3] - CVE-2016-3697: docker: Potential privilege escalation via confusion of usernames and UIDs [orabug 23279003]

  • High
    ELSA-2016-3565 4 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.6.2] - KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. (David Howells) [Orabug: 23279020] {CVE-2016-0758} - net: add validation for the socket syscall protocol argument (Hannes Frederic Sowa) [Orabug: 23267997…

  • Medium
    ELSA-2016-1086 1 CVE

    Moderate: libndp security update (Oracle Linux 7)

    [1.2-6] - libndp: fix hop limit validation [CVE-2016-3698] [1.2-5] - libndp: validate the IPv6 hop limit [CVE-2016-3698] - libndb: reject redirect and router advertisements from non-link-local [CVE-2016-3698]

  • High
    ELSA-2016-3559 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-37.3.1] - KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. (David Howells) [Orabug: 23279022] {CVE-2016-0758} - uek-rpm: ol6: revert DRM for experimental or OL6-incompatible drivers (Todd Vierling) [Orabug: 2327082…

  • High
    ELSA-2016-1041 2 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [38.8.0-2.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [38.8.0-2] - Update to 38.8.0

  • High
    ELSA-2016-1033 1 CVE

    Important: kernel security and bug fix update (Oracle Linux 7)

    - [3.10.0-327.18.2.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.18.2] - [lib] keys: Fix ASN.1 indefinite length object parsing (David Howells) [1308814 1308815] {CVE-2016-0758} [3.10.0-327.18.1] - [scsi] bnx2fc: Fix FCP RSP residual parsing …

  • High
    ELSA-2016-1025 8 CVEs

    Important: pcre security update (Oracle Linux 7)

    [8.32-15.1] - Fix CVE-2015-2328 (infinite recursion compiling pattern with recursive reference in a group with indefinite repeat) (bug #1330508) - Fix CVE-2015-8385 (buffer overflow caused by named forward reference to duplicate group number) (bug #1330508) -…

  • High max 8.4
    ELSA-2016-0726 5 CVEs 3 exploited

    Important: ImageMagick security update (Oracle Linux 7)

    [6.7.2.7-4] - Add fix for CVE-2016-3714, CVE-2016-3715, CVE-2016-3716 and CVE-2016-3717

  • High
    ELSA-2016-0722 7 CVEs

    Important: openssl security update (Oracle Linux 7)

    [1.0.1e-51.5] - fix CVE-2016-2105 - possible overflow in base64 encoding - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate() - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC - fix CVE-2016-2108 - memory corruption in ASN.1 encoder - …

  • Critical max 9.8
    ELSA-2016-0723 5 CVEs 1 exploited

    Critical: java-1.6.0-openjdk security update (Oracle Linux 7)

    [1:1.6.0.39-1.13.11.0] - Update to IcedTea 1.13.11 & OpenJDK 6 b39. - Resolves: rhbz#1325432

  • High
    ELSA-2016-0724 1 CVE

    Important: qemu-kvm security update (Oracle Linux 7)

    [1.5.3-105.el7_2.4] - kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patch [bz#1331412] - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.patch [bz#1331412] - kvm-vga-add-vbe_enabled-helper.patch [bz#1331412] - kvm-vga-factor-out-vga-register-set…

  • Medium
    ELSA-2016-3554 1 CVE

    Moderate: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [4.1.12-37.2.2] - sctp: Prevent soft lockup when sctp_accept() is called during a timeout event (Karl Heiss) [Orabug: 23222731] {CVE-2015-8767}

  • Medium
    ELSA-2016-3551 1 CVE

    Moderate: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-118.6.1] - skbuff: skb_segment: orphan frags before copying (Dongli Zhang) [Orabug: 23018911] - RDS/IB: VRPC DELAY / OSS RECONNECT CAUSES 5 MINUTE STALL ON PORT FAILURE (Venkat Venkatsubra) [Orabug: 22888920] - mlx4_core: Introduce restrict…

  • High max 8.8
    ELSA-2016-0706 2 CVEs

    Important: mercurial security update (Oracle Linux 7)

    [2.6.2-6] - fix previous patch for CVE-2016-3069 [2.6.2-5] - Fix CVE-2016-3068 and CVE-2016-3069

  • Critical
    ELSA-2016-0695 5 CVEs

    Critical: firefox security update (Oracle Linux 7)

    [45.1.0-1.0.1.el7_2] - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files [45.1.0-1] - Update to 45.1.0 ESR [45.0.2-1] - Update to 45.0.2 ESR [45.0.1-1] - Update to 45.0.1 ESR [45.0-5] - Fi…

  • Medium
    ELSA-2016-0685 2 CVEs

    Moderate: nss, nspr, nss-softokn, and nss-util security, bug fix, and enhancement update (Oracle Linux 7)

    nspr [4.11.0-1] - Rebase to NSPR 4.11 nss [3.21.0-9.0.1] - Added nss-vendor.patch to change vendor [3.21.0-9] - Rebuild to require the latest nss-util build and nss-softokn build. [3.21.0-8] - Update the minimum nss-softokn build required at runtime. [3.21.0-…