Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

Critical max 9.8

ELSA-2016-0676 5 CVEs 1 exploited

Critical: java-1.7.0-openjdk security update (Oracle Linux 7)

[1:1.7.0.101-2.6.6.1.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.101-2.6.6.1] - added Patch666 fontpath.patch to fix tck regressions - Resolves: rhbz#1325427 [1:1.7.0.101-2.6.6.0] - Fix ztos handling in templateTable_ppc_64.cpp to be same as others in 7. -…

Apr 21, 2016
Critical max 9.8

ELSA-2016-0650 6 CVEs 1 exploited

Critical: java-1.8.0-openjdk security update (Oracle Linux 7)

[1:1.8.0.91-0.b14] - Add additional fix to Zero patch to properly handle result on 64-bit big-endian - Resolves: rhbz#1325422 [1:1.8.0.91-0.b14] - Revert settings to production defaults so we can at least get a build. - Resolves: rhbz#1325422 [1:1.8.0.91-0.b1…

Apr 20, 2016
Critical

ELSA-2016-0612 8 CVEs

Critical: samba and samba4 security, bug fix, and enhancement update (Oracle Linux 7)

ipa [4.2.0-15.0.1.6.1] - Drop redhat-access-plugin-ipa requires for OL7 Blank out header-logo.png product-name.png Replace login-screen-logo.png [20362818] [4.2.0-15.6.1] - Rebuild against newer Samba version - Related: #1322690 libldb [1.1.25-1] - Rebase lib…

Apr 12, 2016
High

ELSA-2016-0594 4 CVEs

Important: graphite2 security, bug fix, and enhancement update (Oracle Linux 7)

[1.3.6-1] - Related: rhbz#1309052 CVE-2016-1521 CVE-2016-1522 CVE-2016-1523 CVE-2016-1526 [1.3.5-1] - Resolves: rhbz#1309052 CVE-2016-1521 CVE-2016-1522 CVE-2016-1523 CVE-2016-1526 [1.2.4-6] - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild …

Apr 5, 2016
Medium

ELSA-2016-0534 24 CVEs

Moderate: mariadb security and bug fix update (Oracle Linux 7)

[1:5.5.47-1] - Rebase to 5.5.47 Also fixes: CVE-2015-4792 CVE-2015-4802 CVE-2015-4815 CVE-2015-4816 CVE-2015-4819 CVE-2015-4826 CVE-2015-4830 CVE-2015-4836 CVE-2015-4858 CVE-2015-4861 CVE-2015-4870 CVE-2015-4879 CVE-2015-4913 CVE-2015-7744 CVE-2016-0505 CVE-2…

Mar 31, 2016
Medium

ELSA-2016-0532 3 CVEs

Moderate: krb5 security update (Oracle Linux 7)

[1.13.2-12] - Fix CVE-2015-8631, CVE-2015-8630, and CVE-2015-8629 - Remove obsolete trigger to enable building of package - Resolves: #1306969

Mar 31, 2016
High

ELSA-2016-3529 2 CVEs

Important: kernel-uek security update (Oracle Linux 7)

kernel-uek [4.1.12-32.2.3] - rebuild bumping release [4.1.12-32.2.2] - x86/iopl/64: properly context-switch IOPL on Xen PV (Andy Lutomirski) [Orabug: 22997978] {CVE-2016-3157} - fs/hugetlbfs/inode.c: fix bugs in hugetlb_vmtruncate_list() (Mike Kravetz) [Orabu…

Mar 28, 2016
High

ELSA-2016-0512 1 CVE

Important: java-1.7.0-openjdk security update (Oracle Linux 7)

[1:1.7.0.99-2.6.5.0.0.1] - Add oracle-enterprise.patch - Fix DISTRO_NAME to 'Oracle Linux' [1:1.7.0.99-2.6.5.0] - Explictly required libXcomposite-devel for PR2867 as nothing else pulls it in - Resolves: rhbz#1320655

Mar 24, 2016
Critical

ELSA-2016-0513 1 CVE

Critical: java-1.8.0-openjdk security update (Oracle Linux 7)

[1:1.8.0.77-0.b03] - Remove what remains of the SunEC sources in the remove-intree-libraries script. - Resolves: rhbz#1320664 [1:1.8.0.77-0.b03] - Update to u77b03. - Drop 8146566 which is applied upstream. - Replace s390 Java options patch with general versi…

Mar 24, 2016
High

ELSA-2016-3528 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.4.2] - pipe: Fix buffer offset after partially failed read (Ben Hutchings) [Orabug: 22985903] {CVE-2016-0774} {CVE-2015-1805} {CVE-2016-0774}

Mar 23, 2016
High

ELSA-2016-0496 2 CVEs

Important: git security update (Oracle Linux 7)

[1.7.1-4.1] - fix heap overflow CVE-2016-2315 CVE-2016-2324 Resolves: #1318252 [1.7.1-4] - fix CVE-2013-0308

Mar 23, 2016
Medium max 9.8

ELSA-2016-0465 2 CVEs

Moderate: openssh security update (Oracle Linux 7)

[6.6.1p1-25 + 0.9.3-9] - CVE-2016-1908: possible fallback from untrusted to trusted X11 forwarding (#1298741) [6.6.1p1-24 + 0.9.3-9] - CVE-2016-3115: missing sanitisation of input for X11 forwarding (#1317818)

Mar 21, 2016
High

ELSA-2016-0459 2 CVEs

Important: bind security update (Oracle Linux 7)

[30:9.3.6-25.P1.8] - Fix issue with patch for CVE-2016-1285 and CVE-2016-1286 found by test suite [30:9.3.6-25.P1.7] - Fix CVE-2016-1285 and CVE-2016-1286

Mar 16, 2016
High

ELSA-2016-0460 22 CVEs

Important: thunderbird security update (Oracle Linux 7)

[38.7.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [38.7.0-1] - Update to 38.7.0

Mar 16, 2016
Medium

ELSA-2016-0448 1 CVE

Moderate: samba security update (Oracle Linux 7)

[3.6.23-25.0.1] - Remove use-after-free talloc_tos() inlined function problem (John Haxby) [orabug 18253258] [3.6.23-25] - resolves: #1314668 - Fix CVE-2015-7560

Mar 15, 2016
High

ELSA-2016-0430 1 CVE

Important: xerces-c security update (Oracle Linux 7)

[3.1.1-8] Resolves: CVE-2016-0729

Mar 10, 2016
Medium

ELSA-2016-0428 1 CVE

Moderate: libssh2 security update (Oracle Linux 7)

[1.4.2-2.el6_7.1] - use secrects of the appropriate length in Diffie-Hellman (CVE-2016-0787) [1.4.2-2] - fix basic functionality of libssh2 in FIPS mode (#968575)

Mar 10, 2016
High

ELSA-2016-0372 5 CVEs

Important: openssl098e security update (Oracle Linux 7)

[0.9.8e-20.0.1.1] - Updated the description [0.9.8e-20.1] - fix CVE-2015-0293 - triggerable assert in SSLv2 server - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement - disable SSLv2 in the generic TLS method [0.9.8e-20] - fix for CVE-2014-0224 - SSL/TLS MITM…

Mar 9, 2016
Critical

ELSA-2016-0370 1 CVE

Critical: nss-util security update (Oracle Linux 7)

[3.19.1-5] - Actually apply the fix for CVE-2016-1950 from NSS 3.19.2.3 ... [3.19.1-4] - Rebuild to ensure use of correct NSPR. [3.19.1-3] - Include the fix for CVE-2016-1950 from NSS 3.19.2.3

Mar 9, 2016
Critical

ELSA-2016-0373 26 CVEs

Critical: firefox security update (Oracle Linux 7)

[38.7.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Force requirement of newer gdk-pixbuf2 to ensure a proper update (Todd Vierling) [orabug 19847484] [38.7.0-1] - Update to 38.7.0 ESR

Mar 9, 2016
High

ELSA-2016-0346 1 CVE

Important: postgresql security update (Oracle Linux 7)

[9.2.15-1] - update to 9.2.15 per release notes http://www.postgresql.org/docs/9.2/static/release-9-2-15.html

Mar 2, 2016
High

ELSA-2016-0301 5 CVEs

Important: openssl security update (Oracle Linux 7)

[1.0.1e-42.4] - fix CVE-2016-0702 - side channel attack on modular exponentiation - fix CVE-2016-0705 - double-free in DSA private key parsing - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn [1.0.1e-42.3] - fix CVE-2015-3197 - SSLv2 ciphersui…

Mar 1, 2016
High

ELSA-2016-3519 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.3.2] - x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection (Andy Lutomirski) [Orabug: 22742507] {CVE-2015-5157} - x86/nmi/64: Reorder nested NMI checks (Andy Lutomirski) [Orabug: 22742507] {CVE-2015-5157} - x86/nmi/…

Feb 18, 2016
High

ELSA-2016-0258 2 CVEs

Important: thunderbird security update (Oracle Linux 7)

[38.6.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [38.6.0-1] - Update to 38.6.0

Feb 18, 2016
Critical

ELSA-2016-0197 3 CVEs

Critical: firefox security update (Oracle Linux 7)

[38.6.1-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [38.6.1-1] - Update to 38.6.1 ESR

Feb 16, 2016
Medium

ELSA-2016-0189 1 CVE

Moderate: polkit security update (Oracle Linux 7)

[0.112-6] - Fix CVE-2015-3256 Resolves: #1271790

Feb 16, 2016
Critical

ELSA-2016-0176 2 CVEs

Critical: glibc security and bug fix update (Oracle Linux 7)

[2.17-106.0.1.4] - Remove strstr and strcasestr implementations using sse4.2 instructions. - Upstream commits 584b18eb4df61ccd447db2dfe8c8a7901f8c8598 and 1818483b15d22016b0eae41d37ee91cc87b37510 backported. [2.17-106.4] - Revert problematic libresolv change,…

Feb 16, 2016
High

ELSA-2016-0204 1 CVE

Important: 389-ds-base security and bug fix update (Oracle Linux 7)

[1.3.4.0-26] - release 1.3.4.0-26 - Resolves: bug 1299346 - deadlock on connection mutex (DS 48341) [1.3.4.0-25] - release 1.3.4.0-25 - Resolves: bug 1299757 - CVE-2016-0741 389-ds-base: Worker threads do not detect abnormally closed connections causing DoS […

Feb 16, 2016
High

ELSA-2016-0185 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

- [3.10.0-327.10.1.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.10.1] - [of] return NUMA_NO_NODE from fallback of_node_to_nid() (Thadeu Lima de Souza Cascardo) [1300614 1294398] - [net] openvswitch: do not allocate memory from offline numa n…

Feb 16, 2016
Medium max 7.8

ELSA-2016-0188 1 CVE

Moderate: sos security and bug fix update (Oracle Linux 7)

[3.2-35.0.1.3] - Recreated patch for [orabug 18913115] - Make the selinux plugin fixfiles option useful (John Haxby) [orabug 18913115] - Added remove_gpgstring.patch [Bug 18313898] - Added sos-oracle-enterprise.patch - Added sos-oraclelinux-vendor-vendorurl.p…

Feb 16, 2016
Medium

ELSA-2015-1053 19 CVEs

Moderate: php55 security and bug fix update (Oracle Linux 7)

php55 [2.0-1] - fix incorrect selinux contexts #1194336 php55-php [5.5.21-2.0.1] - add dtrace-utils as build dependency [5.5.21-2] - core: fix use-after-free vulnerability in the process_nested_data function (unserialize) CVE-2015-2787 - core: fix NUL byte in…

Feb 4, 2016
Medium

ELSA-2015-2515 1 CVE

Moderate: git19-git security update (Oracle Linux 7)

[1.9.4-3.1] - fix arbitrary code execution via crafted URLs Resolves: #1273889 [1.9.4-3] - fix CVE-2014-9390 Resolves: rhbz#1220552

Feb 4, 2016
Medium

ELSA-2015-1219 8 CVEs

Moderate: php54-php security update (Oracle Linux 7)

[5.4.40-3] - fix more functions accept paths with NUL character #1213407 [5.4.40-2] - core: fix multipart/form-data request can use excessive amount of CPU usage CVE-2015-4024 - fix various functions accept paths with NUL character CVE-2015-4025, CVE-2015-402…

Feb 4, 2016
High

ELSA-2015-1066 28 CVEs

Important: php54 security and bug fix update (Oracle Linux 7)

php54 [2.0-1] - fix incorrect selinux contexts #1194332 php54-php [5.4.40-1] - rebase to PHP 5.4.40 for various security fix #1209887 [5.4.37-1] - rebase to PHP 5.4.37 [5.4.36-1] - rebase to PHP 5.4.36 #1168193 - fix package name in description - php-fpm own …

Feb 4, 2016
High

ELSA-2015-1186 18 CVEs

Important: php55-php security update (Oracle Linux 7)

[5.5.21-4] - fix more functions accept paths with NUL character #1213407 [5.5.21-3] - core: fix multipart/form-data request can use excessive amount of CPU usage CVE-2015-4024 - fix various functions accept paths with NUL character CVE-2015-4025, CVE-2015-402…

Feb 4, 2016
Medium

ELSA-2015-1666 4 CVEs

Moderate: httpd24-httpd security update (Oracle Linux 7)

[2.4.12-6.0.1.el7.1] - replace index.html with Oracles index page oracle_index.html - update vstring in specfile [2.4.12-6.1] - core: fix chunk header parsing defect (CVE-2015-3183) - core: replace of ap_some_auth_required with ap_some_authn_required and ap_f…

Feb 4, 2016
Medium max 5.9

ELSA-2015-1064 6 CVEs

Moderate: python27 security, bug fix, and enhancement update (Oracle Linux 7)

python27 [1.1-17] - Require python-pip and python-wheel (note: in rh-python34 this is not necessary, because 'python' depends on these). python27-python [2.7.8-3] - Add httplib fix for CVE-2013-1752 Resolves: rhbz#1187779 [2.7.8-2] - Fix %check unset DISPLAY …

Feb 4, 2016
High

ELSA-2016-0083 1 CVE

Important: qemu-kvm security and bug fix update (Oracle Linux 7)

[1.5.3-105.el7_2.3] - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298047] - Resolves: bz#1298047 (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-7.2.z]) [1.5.3-105.el7_2.2] - kvm-raw-pos…

Jan 28, 2016
Critical

ELSA-2016-0071 2 CVEs

Critical: firefox security update (Oracle Linux 7)

[38.6.0-1.0.1] - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files [38.6.0-1] - Update to 38.6.0 ESR

Jan 27, 2016
Medium

ELSA-2016-0073 1 CVE

Moderate: bind security update (Oracle Linux 7)

[30:9.3.6-25.P1.6] - Fix CVE-2015-8704

Jan 27, 2016