Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

  • Medium max 3.7
    ELSA-2015-1185 1 CVE

    Moderate: nss security update (Oracle Linux 7)

    nss [3.19.1-3.0.1] - Added nss-vendor.patch to change vendor [3.19.1-3] - Additional NULL initialization. [3.19.1-2] - Updated the patch to keep old cipher suite order - Resolves: Bug 1224449 [3.19.1-1] - Rebase to nss-3.19.1 - Resolves: Bug 1224449 nss-util …

  • High
    ELSA-2015-3045 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-68.3.3] - x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Andy Lutomirski) [Orabug: 21308309] {CVE-2015-2830} - x86, mm/ASLR: Fix stack randomization on 64-bit systems (Hector Marco-Gisbert) [Orabug: 21307919] {CVE-2015-1593}…

  • High
    ELSA-2015-1135 31 CVEs

    Important: php security and bug fix update (Oracle Linux 7)

    [5.4.16-36] - fix more functions accept paths with NUL character #1213407 [5.4.16-35] - core: fix multipart/form-data request can use excessive amount of CPU usage CVE-2015-4024 - fix various functions accept paths with NUL character CVE-2015-4025, CVE-2015-4…

  • Medium
    ELSA-2015-1154 1 CVE

    Moderate: libreswan security, bug fix and enhancement update (Oracle Linux 7)

    [3.12-10.1.0.1] - add libreswan-oracle.patch to detect Oracle Linux distro [3.12-10.1] - Resolves: rhbz#1226407 CVE-2015-3204 libreswan: crafted IKE packet causes daemon restart [3.12-10] - Resolves: rhbz#1213652 Support CAVS [updated another prf() free symke…

  • Medium
    ELSA-2015-1153 1 CVE

    Moderate: mailman security and bug fix update (Oracle Linux 7)

    [3:2.1.15-21] - fix CVE-2015-2775 - directory traversal in MTA transports [3:2.1.15-20] - fix #1107652 - do not install patch backup files in documentation [3:2.1.15-19] - fix #1188043 - set 2775 permission only for /etc/mailman [3:2.1.15-18] - fix #1107652 -…

  • High
    ELSA-2015-1137 7 CVEs

    Important: kernel security and bug fix update (Oracle Linux 7)

    [3.10.0-229.7.2] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-229.7.2] - [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Seth Jennings) [1202861 1198843] {CVE-2015-1805} [3.10.0-229.7.1] - [scsi] storvsc: get rid of overly verbose w…

  • High
    ELSA-2015-1123 3 CVEs

    Important: cups security update (Oracle Linux 7)

    [1:1.4.2-67.1] - CVE-2015-1158, CVE-2015-1159, CVE-2014-9679 (bug #1229982).

  • Medium
    ELSA-2015-1115 6 CVEs

    Moderate: openssl security update (Oracle Linux 7)

    [1.0.1e-42.8] - improved fix for CVE-2015-1791 - add missing parts of CVE-2015-0209 fix for corectness although unexploitable [1.0.1e-42.7] - fix CVE-2014-8176 - invalid free in DTLS buffering code - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time - f…

  • High
    ELSA-2015-1090 2 CVEs

    Important: wpa_supplicant security and enhancement update (Oracle Linux 7)

    [1:2.0-17] - AP WMM: Fix integer underflow in WMM Action frame parser (rh #1221178) (rh #1222015) [1:2.0-16] - P2P: Validate SSID element length before copying it (CVE-2015-1863) [1:2.0-15] - Add domain_match config option from upstream (rh #1178263) - Includ…

  • High
    ELSA-2015-3041 3 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-68.3.2] - x86_64, vdso: Fix the vdso address randomization algorithm (Andy Lutomirski) [Orabug: 21226729] {CVE-2014-9585} - isofs: Fix infinite looping over CE entries (Jan Kara) [Orabug: 21225975] {CVE-2014-9420} - x86_64, switch_to(): Loa…

  • High
    ELSA-2015-1083 8 CVEs

    Important: abrt security update (Oracle Linux 7)

    abrt [2.1.11-22.0.1] - Drop libreport-rhel and libreport-plugin-rhtsupport requires [2.1.11-22] - do not open the build_ids file as the user abrt - do not unlink failed and big user core files - Related: #1212819, #1216973 [2.1.11-21] - validate all D-Bus met…

  • Medium max 3.7
    ELSA-2015-1072 1 CVE

    Moderate: openssl security update (Oracle Linux 7)

    [1.0.1e-30.9] - fix CVE-2015-4000 - prevent the logjam attack on client - restrict the DH key size to at least 768 bits (limit will be increased in future)

  • High max 8.4
    ELSA-2015-3037 3 CVEs

    Important: docker security update (Oracle Linux 7)

    [1.6.1-1.0.1] - Update source to 1.6.1 from https://github.com/docker/docker/releases/tag/v1.6.1 Symlink traversal on container respawn allows local privilege escalation (CVE-2015-3629) Insecure opening of file-descriptor 1 leading to privilege escalation (CV…

  • High
    ELSA-2015-1012 4 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [31.7.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [31.7.0-1] - Update to 31.7.0

  • Critical
    ELSA-2015-0988 5 CVEs

    Critical: firefox security update (Oracle Linux 7)

    [38.0-3.0.1.el7_1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [38.0-3] - Enabled system nss - Removed unused patches [38.0-2] - Update to 38.0 ESR [38.0b8-0.11] - Update to 38.0 Beta 8 [38.0b6-0.10] - Added patch for mozbz…

  • High
    ELSA-2015-0999 1 CVE

    Important: qemu-kvm security update (Oracle Linux 7)

    [1.5.3-86.el7_1.2] - kvm-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch [bz#1219269] - Resolves: bz#1219269 (EMBARGOED CVE-2015-3456 qemu-kvm: qemu: floppy disk controller flaw [rhel-7.1.z])

  • High
    ELSA-2015-3035 2 CVEs

    Important: Unbreakable Enterprise kernel security and bugfix update (Oracle Linux 7)

    kernel-uek [3.8.13-68.2.2] - crypto: aesni - fix memory usage in GCM decryption (Stephan Mueller) [Orabug: 21077385] {CVE-2015-3331} [3.8.13-68.2.1] - xen/pciback: Don't disable PCI_COMMAND on PCI device reset. (Konrad Rzeszutek Wilk) [Orabug: 20807438] {CVE-…

  • High
    ELSA-2015-0987 1 CVE

    Important: kernel security and bug fix update (Oracle Linux 7)

    [3.10.0-229.4.2] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-229.4.2] - [x86] crypto: aesni - fix memory usage in GCM decryption (Kurt Stutsman) [1213331 1212178] {CVE-2015-3331} [3.10.0-229.4.1] - [crypto] x86: sha256_ssse3 - also test for BMI2 (He…

  • Medium
    ELSA-2015-0983 1 CVE

    Moderate: tomcat security update (Oracle Linux 7)

    [0:7.0.54-2] - Resovles: CVE-2014-0227

  • Medium
    ELSA-2015-0986 1 CVE

    Moderate: kexec-tools security, bug fix, and enhancement update (Oracle Linux 7)

    [2.0.7-19.0.1.el7_1.2] - kdumpctl: exclude default_hugepagesz setting from kdump kernel cmdline (Sriharsha Yadagudde) [Orabug: 19134999] - kdumpctl: verify if kernel support securelevel interface (Sriharsha Yadagudde) [Orabug: 18905671] [2.0.7-19.2] - dracut-…

  • High
    ELSA-2015-0895 1 CVE

    Important: 389-ds-base security update (Oracle Linux 7)

    [1.3.3.1-16] - release 1.3.3.1-16 - Resolves: bug 1212894 - CVE-2015-1854 389ds-base: access control bypass with modrdn

  • High
    ELSA-2015-3032 4 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-68.1.3] - isofs: Fix unchecked printing of ER records (Jan Kara) [Orabug: 20930551] {CVE-2014-9584} - KEYS: close race between key lookup and freeing (Sasha Levin) [Orabug: 20930548] {CVE-2014-9529} {CVE-2014-9529} - mm: memcg: do not allow…

  • High
    ELSA-2015-0808 7 CVEs

    Important: java-1.6.0-openjdk security update (Oracle Linux 7)

    [1:1.6.0.35-1.13.7.1] - Repackaged source files - Resolves: rhbz#1209067 [1:1.6.0.35-1.13.7.0] - Update to IcedTea 1.13.7 - Regenerate add-final-location-rpaths patch so as to be less disruptive. - Resolves: rhbz#1209067

  • High
    ELSA-2015-0809 8 CVEs

    Important: java-1.8.0-openjdk security update (Oracle Linux 7)

    [1:1.8.0.45-30.b13] - repacked sources - Resolves: RHBZ#1209076 [1:1.8.0.45-7.b13] - Re-add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions. - Remove ppc64le test case now fix has been verified. - Resolves: rhbz#1194378 [1:1.8.0.45-27.b13…

  • Critical
    ELSA-2015-0806 7 CVEs

    Critical: java-1.7.0-openjdk security update (Oracle Linux 7)

    [1:1.7.0.75-2.5.5.1.0.1.el7_1] - Update DISTRO_NAME in specfile [1:1.7.0.75-2.5.5.1] - repacked sources - Resolves: rhbz#1209072 [1:1.7.0.75-2.5.5.0] - Bump to 2.5.5 using OpenJDK 7u79 b14. - Update OpenJDK tarball creation comments - Remove test case for RH1…

  • Medium
    ELSA-2015-0797 1 CVE

    Moderate: xorg-x11-server security update (Oracle Linux 7)

    [1.15.0-26] - CVE fixes for: CVE-2015-0255

  • Critical
    ELSA-2015-0766 5 CVEs

    Critical: firefox security update (Oracle Linux 7)

    [31.6.0-2.0.1.el5_11] - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files [31.6.0-1] - Update to 31.6.0 ESR Build 2 [31.6.0-1] - Update to 31.6.0 ESR

  • High
    ELSA-2015-0771 5 CVEs

    Important: thunderbird security update (Oracle Linux 7)

    [31.6.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [31.6.0-1] - Update to 31.6.0

  • High
    ELSA-2015-3019 3 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    kernel-uek [3.8.13-68.1.2] - IB/core: Prevent integer overflow in ib_umem_get address arithmetic (Shachar Raindel) [Orabug: 20799875] {CVE-2014-8159} {CVE-2014-8159} [3.8.13-68.1.1] - xen-pciback: limit guest control of command register (Jan Beulich) [Orabug:…

  • High
    ELSA-2015-0767 2 CVEs

    Important: flac security update (Oracle Linux 7)

    [1.3.0-5] - fix buffer overflow when processing ID3v2 metadata (CVE-2014-8962) - fix buffer overflow with invalid blocksize (CVE-2014-9028)

  • Medium
    ELSA-2015-0749 1 CVE

    Moderate: libxml2 security update (Oracle Linux 7)

    [2.9.1-5.0.1.el7_1.2] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [2.9.1-5.2] - Fix missing entities after CVE-2014-3660 fix - CVE-2014-0191 Do not fetch external parameter entities (rhbz#1195649) - Fix…

  • Medium
    ELSA-2015-0750 4 CVEs

    Moderate: postgresql security update (Oracle Linux 7)

    [8.4.20-2] - fix for CVE-2015-0241 CVE-2015-0243 CVE-2015-0244 CVE-2014-8161 (rhbz#1198651 & rhbz#1198652)

  • High
    ELSA-2015-0729 1 CVE

    Important: setroubleshoot security update (Oracle Linux 7)

    [3.2.17-4.1.0.1] - Add setroubleshoot-oracle-enterprise.patch to change bug reporting URL to linux.oracle.com [3.2.17-4.1] - Fix get_rpm_nvr_*_temporary functions Resolves:#1203352

  • High
    ELSA-2015-0726 2 CVEs

    Important: kernel security and bug fix update (Oracle Linux 7)

    [3.10.0-229.1.2] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-229.1.2] - [infiniband] core: Prevent integer overflow in ib_umem_get address arithmetic (Doug Ledford) [1181177 1179347] {CVE-2014-8159} [3.10.0-229.1.1] - [crypto] testmgr: mark rfc4106(…

  • Medium
    ELSA-2015-0728 2 CVEs

    Moderate: ipa and slapi-nis security and bug fix update (Oracle Linux 7)

    ipa [4.1.0-18.0.1.el7_1.3] - Replace login-screen-logo.png [20362818] - Drop subscription-manager requires for OL7 - Drop redhat-access-plugin-ipa requires for OL7 - Blank out header-logo.png product-name.png [4.1.0-18.3] - [ipa-python] ipalib.errors.LDAPErro…

  • Critical
    ELSA-2015-0718 2 CVEs

    Critical: firefox security update (Oracle Linux 7)

    [31.5.3-1.0.1.el5_11] - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files [31.5.3-1] - Update to 31.5.3 ESR [31.5.2-1] - Update to 31.5.2 ESR [31.5.1-1] - Update to 31.5.1 ESR

  • Medium
    ELSA-2015-0716 7 CVEs

    Moderate: openssl security and bug fix update (Oracle Linux 7)

    [1.0.1e-42.4] - update fix for CVE-2015-0287 to what was released upstream [1.0.1e-42.3] - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey() - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison - fix CVE-2015-0287 - ASN.1 struc…

  • High
    ELSA-2015-3012 6 CVEs

    Important: Unbreakable Enterprise kernel security and bugfix update (Oracle Linux 7)

    kernel-uek [3.8.13-68] - ttusb-dec: buffer overflow in ioctl (Dan Carpenter) [Orabug: 20673373] {CVE-2014-8884} - mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support (Kirill A. Shutemov) [Orabug: 20673279] {CVE-2014-8173} - netfilter: conntrack…

  • Medium
    ELSA-2015-0700 4 CVEs

    Moderate: unzip security update (Oracle Linux 7)

    [6.0-2] - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141 Resolves: #1196132 #1196120 #1196124 #1196128

  • High
    ELSA-2015-0696 13 CVEs

    Important: freetype security update (Oracle Linux 7)

    [2.3.11-15.el6_6.1] - Fixes CVE-2014-9657 - Check minimum size of record_size. - Fixes CVE-2014-9658 - Use correct value for minimum table length test. - Fixes CVE-2014-9675 - New macro that checks one character more than strncmp. - Fixes CVE-2014-9660 - Chec…