Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

High

ELSA-2016-0067 5 CVEs

Important: java-1.6.0-openjdk security update (Oracle Linux 7)

[1.6.0.38-1.13.10.0.0.1] - Add oracle-enterprise.patch [1:1.6.0.38-1.13.10.0] - Add patch to replace -fno-strict-overflow with -fwrapv on older RHEL 5.11 GCC. - Resolves: rhbz#1295772 [1:1.6.0.38-1.13.10.0] - Update to IcedTea 1.13.10 & OpenJDK 6 b38. - Resol…

Jan 26, 2016
High

ELSA-2016-0063 1 CVE

Important: ntp security update (Oracle Linux 7)

[4.2.6p5-5.el6_7.4] - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)

Jan 25, 2016
High

ELSA-2016-0064 1 CVE

Important: kernel security update (Oracle Linux 7)

[3.10.0-327.4.5.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.4.5] - [security] keys: Fix keyring ref leak in join_session_keyring() (David Howells) [1298931 1298036] {CVE-2016-0728}

Jan 25, 2016
High

ELSA-2016-0054 7 CVEs

Important: java-1.7.0-openjdk security update (Oracle Linux 7)

[1.7.0.95-2.6.4.0.0.1] - Update DISTRO_NAME in specfile [1:1.7.0.95-2.6.4.0] - Bump to 2.6.4 and u95b00. - Backport tarball creation script from OpenJDK 8 RPMs and update fsg.sh to work with it. - Drop 8072932or8074489 patch as applied upstream in u91b01. - A…

Jan 21, 2016
Critical

ELSA-2016-0049 7 CVEs

Critical: java-1.8.0-openjdk security update (Oracle Linux 7)

[1:1.8.0.71-2.b15] - Add md5sum for previous java.security file so it gets updated. - Resolves: rhbz#1295753 [1:1.8.0.71-1.b15] - Restore upstream version of system LCMS patch removed by 'sync with Fedora' - Add patch to turn off strict overflow on IndicRearr…

Jan 20, 2016
High

ELSA-2016-3509 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.2.5] - KEYS: Fix keyring ref leak in join_session_keyring() (Yevgeny Pats) [Orabug: 22563965] {CVE-2016-0728}

Jan 20, 2016
High

ELSA-2016-3510 1 CVE

Important: kernel-uek security update (Oracle Linux 7)

kernel-uek [4.1.12-32.1.2] - KEYS: Fix keyring ref leak in join_session_keyring() (Yevgeny Pats) [Orabug: 22563965] {CVE-2016-0728} [4.1.12-32.1.1] - ocfs2: return non-zero st_blocks for inline data (John Haxby) [Orabug: 22218243] - xen/events/fifo: Consume u…

Jan 20, 2016
Medium max 8.1

ELSA-2016-0043 2 CVEs

Moderate: openssh security update (Oracle Linux 7)

[6.6.1p1-23 + 0.9.3-9] - Disable undocumented feauture Roaming for good (#1298218) - prevents CVE-2016-0777 and CVE-2016-0778

Jan 14, 2016
High

ELSA-2016-3501 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.2.4] - KEYS: Don't permit request_key() to construct a new keyring (David Howells) [Orabug: 22373442] {CVE-2015-7872} [3.8.13-118.2.3] - dcache: Handle escaped paths in prepend_path (Eric W. Biederman) [Orabug: 22373283] - vfs: Test for…

Jan 8, 2016
Medium

ELSA-2016-0012 1 CVE

Moderate: gnutls security update (Oracle Linux 7)

[3.3.8-14] - Prevent downgrade attack to RSA-MD5 in server key exchange. [3.3.8-13] - Corrected reseed and respect of max_number_of_bits_per_request in FIPS140-2 mode. Also enhanced the initial tests. (#1228199)

Jan 7, 2016
Medium

ELSA-2016-0005 1 CVE

Moderate: rpcbind security update (Oracle Linux 7)

[0.2.0-11.el6_7] - Fix memory corruption in PMAP_CALLIT code (bz 1283638)

Jan 7, 2016
Medium

ELSA-2016-0008 1 CVE

Moderate: openssl security update (Oracle Linux 7)

[1.0.1e-42.2] - fix CVE-2015-7575 - disallow use of MD5 in TLS1.2

Jan 7, 2016
Medium

ELSA-2016-0006 5 CVEs

Moderate: samba security update (Oracle Linux 7)

[4.2.3-11] - resolves: #1290710 - CVE-2015-3223 Remote DoS in Samba (AD) LDAP server - CVE-2015-5299 Missing access control check in shadow copy code - CVE-2015-5252 Insufficient symlink verification in smbd - CVE-2015-5296 Samba client requesting encryption …

Jan 7, 2016
Medium

ELSA-2016-0009 2 CVEs

Moderate: libldb security update (Oracle Linux 7)

[1.1.13-3.1] - Resolves: rhbz#1290712 - CVE-2015-5330 libldb: samba: Remote memory read in Samba LDAP server [rhel-7.2.z] - Remove the patch from the previous commit, it doesn't fix a remotely eploitable issue. Add patches from upstream #11636 instead.

Jan 7, 2016
Medium

ELSA-2016-0007 1 CVE

Moderate: nss security update (Oracle Linux 7)

[3.19.1-8.0.1] - Added nss-vendor.patch to change vendor [3.19.1-8] - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol - Resolves: Bug 1289881

Jan 7, 2016
High

ELSA-2016-0001 5 CVEs

Important: thunderbird security update (Oracle Linux 7)

[38.5.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [38.5.0-1] - Update to 38.5.0

Jan 5, 2016
High

ELSA-2015-2655 1 CVE

Important: bind security update (Oracle Linux 7)

[32:9.8.2-0.44.rc1.5] - Fix CVE-2015-8000

Dec 16, 2015
Critical

ELSA-2015-2657 7 CVEs

Critical: firefox security update (Oracle Linux 7)

[38.5.0-2.0.1] - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files [38.5.0-2] - Update to 38.5.0 ESR

Dec 16, 2015
Medium max 7.4

ELSA-2015-2623 1 CVE

Moderate: grub2 security and bug fix update (Oracle Linux 7)

[2.02-0.33.0.1] - Fix comparison in patch for 18504756 - Remove symlink to grub environment file during uninstall on EFI platforms [bug 19231481] - update Oracle Linux certificates (Alexey Petrenko) - Put 'with' in menuentry instead of 'using' [bug 18504756] …

Dec 15, 2015
Medium

ELSA-2015-2619 4 CVEs

Moderate: libreoffice security update (Oracle Linux 7)

[4.2.8.2-11.0.1.1] - Replaced RedHat colors with Oracle colors, and the filename redhat.soc with oracle.soc in specfile (jingdong.lu@oracle.com) - Build with --with-vendor='Oracle America, Inc.' (jingdong.lu@oracle.com) [1:4.2.8.2-11.1] - Resolves: rhbz#12858…

Dec 14, 2015
Medium

ELSA-2015-2617 3 CVEs

Moderate: openssl security update (Oracle Linux 7)

[1.0.1e-51.1] - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak - fix CVE-2015-3196 - race condition when handling PSK identity hint [1.0.1e-51] - fix the CVE-2015-1791 fix (broken serve…

Dec 14, 2015
High max 10.0

ELSA-2015-3107 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.2.2] - KVM: svm: unconditionally intercept #DB (Paolo Bonzini) [Orabug: 22333698] {CVE-2015-8104} - KVM: x86: work around infinite loop in microcode when #AC is delivered (Eric Northup) [Orabug: 22333689] {CVE-2015-5307} {CVE-2015-5307}…

Dec 10, 2015
Medium

ELSA-2015-2595 3 CVEs

Moderate: libpng12 security update (Oracle Linux 7)

[1.2.50-7] - Security fix for CVE-2015-7981 and CVE-2015-8126 - Resolves: #1283576

Dec 9, 2015
Medium

ELSA-2015-2596 2 CVEs

Moderate: libpng security update (Oracle Linux 7)

[2:1.5.13-7] - Security fix for CVE-2015-8126 - Changing png_ptr to info_ptf based on upstream - Related: #1283576 [2:1.5.13-6] - Security fix for CVE-2015-8126 - Resolves: #1283576

Dec 9, 2015
Medium

ELSA-2015-2561 1 CVE

Moderate: git security update (Oracle Linux 7)

[1.8.3.1-6] - fix arbitrary code execution via crafted URLs Resolves: #1274737

Dec 8, 2015
High max 10.0

ELSA-2015-2552 2 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-327.3.1.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327.3.1] - rebuild [3.10.0-327.2.1] - [netdrv] macvtap: unbreak receiving of gro skb with frag list (Jason Wang) [1279794 1273737] - [net] ipv6: drop frames with attached skb->sk in fo…

Dec 8, 2015
Medium

ELSA-2015-2550 11 CVEs

Moderate: libxml2 security update (Oracle Linux 7)

[2.9.1-6.0.1.el7_1.2] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [2.9.1-6.2] - Fix a series of CVEs (rhbz#1286496) - CVE-2015-7941 Stop parsing on entities boundaries errors - CVE-2015-7941 Cleanup con…

Dec 7, 2015
High max 9.8

ELSA-2015-2522 1 CVE 1 exploited

Important: apache-commons-collections security update (Oracle Linux 7)

[3.2.1-22] - Fix Java object de-serialization vulnerability - Resolves: CVE-2015-7501

Nov 30, 2015
High

ELSA-2015-3101 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-118.2.1] - ipc/sem.c: fully initialize sem_array before making it visible (Manfred Spraul) [Orabug: 22277382] {CVE-2015-7613} - ipc: fix msg newqueue add (Guru Anbalagane) [Orabug: 22277382] {CVE-2015-7613} [3.8.13-118.1.1] - sctp: fix race…

Nov 27, 2015
High

ELSA-2015-2519 7 CVEs

Important: thunderbird security update (Oracle Linux 7)

[38.4.0-1.0.1.el6_7] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [38.4.0-1] - Update to 38.4.0

Nov 27, 2015
Medium max 7.8

ELSA-2015-2505 3 CVEs 1 exploited

Moderate: abrt and libreport security update (Oracle Linux 7)

abrt [2.1.11-35.0.1] - Drop libreport-rhel and libreport-plugin-rhtsupport requires [2.1.11-35] - make /var/spool/abrt owned by root - remove 'r' from /var/spool/abrt for other users - abrt-action-install-debug-info: use secure temporary directory - stop savi…

Nov 25, 2015
High

ELSA-2015-2172 1 CVE

Important: glibc security update (Oracle Linux 7)

[2.17-106.0.1.1] - Remove strstr and strcasestr implementations using sse4.2 instructions. - Upstream commits 584b18eb4df61ccd447db2dfe8c8a7901f8c8598 and 1818483b15d22016b0eae41d37ee91cc87b37510 backported. [2.17-106.1] - Rebuild with corrected release. [2.1…

Nov 25, 2015
Medium

ELSA-2015-2199 4 CVEs

Moderate: glibc security, bug fix, and enhancement update (Oracle Linux 7)

[2.17-105.0.1] - Remove strstr and strcasestr implementations using sse4.2 instructions. - Upstream commits 584b18eb4df61ccd447db2dfe8c8a7901f8c8598 and 1818483b15d22016b0eae41d37ee91cc87b37510 backported. [2.17-105] - Fix up test case for initial-exec fix (#…

Nov 24, 2015
Low

ELSA-2015-2355 1 CVE

Low: sssd security, bug fix, and enhancement update (Oracle Linux 7)

[1.13.0-40] - Resolves: rhbz#1270827 - local overrides: don't contact server with overridden name/id [1.13.0-39] - Resolves: rhbz#1267837 - sssd_be crashed in ipa_srv_ad_acct_lookup_step [1.13.0-38] - Resolves: rhbz#1267176 - Memory leak / possible DoS with k…

Nov 24, 2015
High

ELSA-2015-2152 15 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

[3.10.0-327.OL7] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-327] - [mm] free compound page with correct order (Andrea Arcangeli) [1274867] - [netdrv] revert 'ixgbe: Refactor busy poll socket code to address multiple issues' (John Greene) [1261275] …

Nov 24, 2015
Medium

ELSA-2015-2184 1 CVE

Moderate: realmd security, bug fix, and enhancement update (Oracle Linux 7)

[0.16.1-5] - Revert 0.16.1-4 - Use samba by default - Resolves: rhbz#1271618 [0.16.1-4] - Fix regressions in 0.16.x releases - Resolves: rhbz#1258745 - Resolves: rhbz#1258488 [0.16.1-3] - Fix regression accepting DNS domain names - Resolves: rhbz#1243771 [0.1…

Nov 24, 2015
Medium

ELSA-2015-2233 2 CVEs

Moderate: tigervnc security, bug fix, and enhancement update (Oracle Linux 7)

[1.3.1-3] - Do not mention that display number is required in the file name Resolves: bz#1195266 [1.3.1-2] - Resolves: bz#1248422 CVE-2014-8240 CVE-2014-8241 tigervnc: various flaws [1.3.1-1] - Drop unecessary patches - Re-base to 1.3.1 (bug #1199453) - Re-bu…

Nov 24, 2015
Medium

ELSA-2015-2315 2 CVEs

Moderate: NetworkManager security, bug fix, and enhancement update (Oracle Linux 7)

ModemManager [1.1.0-8.git20130913] - rfcomm: don't open the ttys until NetworkManager connects them (rh #1251954) [1.1.0-7.git20130913] - iface-modem: fix MODEM_STATE_IS_INTERMEDIATE macro (rh #1200958) NetworkManager [1.0.6-27.0.1] - fix build error on i386 …

Nov 24, 2015
Medium max 5.9

ELSA-2015-2101 5 CVEs

Moderate: python security, bug fix, and enhancement update (Oracle Linux 7)

[2.7.5-34.0.1] - Add Oracle Linux distribution in platform.py [orabug 20812544] [2.7.5-34] - Revert fix for rhbz#1117751 as it leads to regressions Resolves: rhbz#1117751 [2.7.5-33] - Only restore SIG_PIPE when Popen called with restore_sigpipe Resolves: rhbz…

Nov 23, 2015
Medium

ELSA-2015-2360 2 CVEs

Moderate: cups-filters security, bug fix, and enhancement update (Oracle Linux 7)

[1.0.35-21] - Fix heap-based buffer overflow in texttopdf filter (bug #1241242, CVE-2015-3258, CVE-2015-3279). [1.0.35-20] - Improvements to cups-browsed efficiency patch (bug #1191691). [1.0.35-18] - Fix segfault in texttopdf filter (bug #1194263). - Improve…

Nov 23, 2015