Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,326 results · Feed

High

ELSA-2014-1971 18 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-123.13.1] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-123.13.1] - [powerpc] mm: Make sure a local_irq_disable prevent a parallel THP split (Don Zickus) [1151057 1083296] - [powerpc] Implement __get_user_pages_fast() (Don Zickus) [1151057 108…

Dec 9, 2014
High

ELSA-2014-1976 2 CVEs

Important: rpm security update (Oracle Linux 7)

[4.11.1-18] - Add check against malicious CPIO file name size (#1163060) - Fixes CVE-2014-8118 [4.11.1-17] - Fix race condidition where unchecked data is exposed in the file system (#1163060) - Fixes CVE-2013-6435

Dec 9, 2014
High max 7.3

ELSA-2014-3095 2 CVEs

Important: docker security and bug fix update (Oracle Linux 7)

[1.3.2-1.0.1] - Rename requirement of docker-io-pkg-devel in %package devel as docker-pkg-devel - Restore SysV init scripts for Oracle Linux 6 - Require Oracle Unbreakable Enterprise Kernel Release 3 or higher - Rename as docker. - Re-enable btrfs graphdriver…

Dec 5, 2014
High

ELSA-2014-3096 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-55] - freezer: set PF_SUSPEND_TASK flag on tasks that call freeze_processes (Colin Cross) [Orabug: 20082843] [3.8.13-54] - netfilter: nf_nat: fix oops on netns removal (Florian Westphal) [Orabug: 19988779] - tcp: tsq: restore minimal amount…

Dec 4, 2014
Critical

ELSA-2014-1919 5 CVEs

Critical: firefox security update (Oracle Linux 7)

[31.3.0-4.0.1] - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat ones [31.3.0-4] - Update to 31.3.0 ESR Build 2 - Fix for geolocation API (rhbz#1063739) [31.2.0-5] - splice workaround (rhbz#11…

Dec 3, 2014
Medium

ELSA-2014-1956 1 CVE

Moderate: wpa_supplicant security update (Oracle Linux 7)

[1:2.0-13] - Use os_exec() for action script execution (CVE-2014-3686)

Dec 3, 2014
High

ELSA-2014-1948 0 CVEs

Important: nss, nss-util, and nss-softokn security, bug fix, and enhancement update (Oracle Linux 7)

nss [3.16.2.3-2.0.1.el7_0] - Added nss-vendor.patch to change vendor [3.16.2.3-2] - Restore patch for certutil man page - supply missing options descriptions - Resolves: Bug 1165525 - Upgrade to NSS 3.16.2.3 for Firefox 31.3 [3.16.2.3-1] - Resolves: Bug 11655…

Dec 2, 2014
Medium

ELSA-2014-1912 3 CVEs

Moderate: ruby security update (Oracle Linux 7)

[2.0.0.353-22] - Fix REXML billion laughs attack via parameter entity expansion (CVE-2014-8080). Resolves: rhbz#1163998 - REXML incomplete fix for CVE-2014-8080 (CVE-2014-8090). Resolves: rhbz#1163998 [2.0.0.353-21] - Fix off-by-one stack-based buffer overflo…

Nov 26, 2014
High max 8.8

ELSA-2014-3092 2 CVEs 1 exploited

Important: bash security update (Oracle Linux 7)

[4.2.45-5.4.0.1] - Fix segfaults from CVE-2014-6277 and CVE-2014-6278 completely. [orabug 19905256]

Nov 20, 2014
High

ELSA-2014-1870 3 CVEs

Important: libXfont security update (Oracle Linux 7)

[1.4.5-4] - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601) - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601) - CVE-2014-0211: integer overflows calc…

Nov 18, 2014
High

ELSA-2014-1861 18 CVEs

Important: mariadb security update (Oracle Linux 7)

[1:5.5.40-1] - Rebase to 5.5.40 Also fixes: CVE-2014-4274 CVE-2014-4287 CVE-2014-6463 CVE-2014-6464 CVE-2014-6469 CVE-2014-6484 CVE-2014-6505 CVE-2014-6507 CVE-2014-6520 CVE-2014-6530 CVE-2014-6551 CVE-2014-6555 CVE-2014-6559 CVE-2014-6564 Resolves: #1160548 …

Nov 17, 2014
High

ELSA-2014-3087 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-44.1.5.el6uek] - net: sctp: fix panic on duplicate ASCONF chunks (Daniel Borkmann) [Orabug: 20010590] {CVE-2014-3687} - net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks (Daniel Borkmann) [Orabug: 20010577] {CVE-2014-3673}

Nov 13, 2014
Medium

ELSA-2014-1846 1 CVE

Moderate: gnutls security update (Oracle Linux 7)

[3.1.18-10] - Applied fix for CVE-2014-8564 (#1161472)

Nov 12, 2014
Medium

ELSA-2014-1826 5 CVEs

Moderate: libvncserver security update (Oracle Linux 7)

[0.9.7-7.1] - Fix CVE-2014-6051 (integer overflow in screen size handling) (bug #1157668) - Fix CVE-2014-6052 (NULL pointer dereference in framebuffer setup) (bug #1157668) - Fix CVE-2014-6053 (NULL pointer dereference in ClientCutText message handling) (bug …

Nov 11, 2014
Medium

ELSA-2014-1827 3 CVEs

Moderate: kdenetwork security update (Oracle Linux 7)

[7:4.10.5-8] - Resolves: CVE-2014-6055

Nov 11, 2014
Medium

ELSA-2014-1801 3 CVEs

Moderate: shim security update (Oracle Linux 7)

shim [0.7-8.0.1] - update Oracle Linux certificates (Alexey Petrenko) - replace securebootca.cer (Alexey Petrenko) [0.7-8] - out-of-bounds memory read flaw in DHCPv6 packet processing Resolves: CVE-2014-3675 - heap-based buffer overflow flaw in IPv6 address p…

Nov 5, 2014
Medium

ELSA-2014-1795 2 CVEs

Moderate: cups-filters security update (Oracle Linux 7)

[1.0.35-15:.1] - Applied upstream patch to fix BrowseAllow parsing issue (CVE-2014-4338, bug #1091568). - Applied upstream patch for cups-browsed DoS via process_browse_data() out-of-bounds read (CVE-2014-4337, bug #1111510).

Nov 3, 2014
Medium

ELSA-2014-1764 1 CVE

Moderate: wget security update (Oracle Linux 7)

[1.14-10.1] - Fix CVE-2014-4877 wget: FTP symlink arbitrary filesystem access (#1156135)

Oct 30, 2014
High

ELSA-2014-1767 4 CVEs

Important: php security update (Oracle Linux 7)

[5.4.16-23.3] - fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710 [5.4.16-23.2] - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668 - core: fix integer overflow in unserialize() CVE-2014-3669 - exif: fix heap corruption issue i…

Oct 30, 2014
High

ELSA-2014-3084 5 CVEs

Important: Unbreakable Enterprise kernel Security update (Oracle Linux 7)

kernel-uek [3.8.13-44.1.4.el7uek] - USB: whiteheat: Added bounds checking for bulk command response (James Forshaw) [Orabug: 19849334] {CVE-2014-3185} - HID: fix a couple of off-by-ones (Jiri Kosina) [Orabug: 19849317] {CVE-2014-3181} - kvm: vmx: handle invvp…

Oct 30, 2014
High

ELSA-2014-1724 5 CVEs

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-123.9.2] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-123.9.2] - [virt] kvm: fix PIT timer race condition (Petr Matousek) [1144879 1144880] {CVE-2014-3611} - [virt] kvm/vmx: handle invept and invvpid vm exits gracefully (Petr Matousek) [11454…

Oct 28, 2014
Medium

ELSA-2014-1676 12 CVEs

Moderate: wireshark security update (Oracle Linux 7)

[1.10.3-12.0.1.el7] - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect [1.10.3-12] - security patches - Related: #1148266 [1.10.3-11] - security patches - Resolves: CVE-2014-6421 CVE-2014-6423 CVE-2014-6424 CVE-2014-6425 CVE-2014-6426…

Oct 21, 2014
Low

ELSA-2014-1669 1 CVE

Low: qemu-kvm security and bug fix update (Oracle Linux 7)

[1.5.3-60.el7_0.10] - kvm-block-add-helper-function-to-determine-if-a-BDS-is-i.patch [bz#1122925] - kvm-block-extend-block-commit-to-accept-a-string-for-the.patch [bz#1122925] - kvm-block-add-backing-file-option-to-block-stream.patch [bz#1122925] - kvm-block-…

Oct 20, 2014
High

ELSA-2014-3081 6 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

kernel-uek [3.8.13-44.1.3.el7uek] - ALSA: control: Don't access controls outside of protected regions (Lars-Peter Clausen) [Orabug: 19817785] {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655} - ALSA: control: Fix replacing user controls (Lars-Peter Clausen) [Or…

Oct 17, 2014
High

ELSA-2014-1652 2 CVEs

Important: openssl security update (Oracle Linux 7)

[1.0.1e-30.2] - fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV to partially mitigate CVE-2014-3566 (padding attack on SSL3) [1.0.1e-30] - add ECC TLS extensions t…

Oct 16, 2014
Medium

ELSA-2014-1655 1 CVE

Moderate: libxml2 security update (Oracle Linux 7)

[2.9.1-5.0.1.el7_0.1] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [2.9.1-5.1] - CVE-2014-3660 denial of service via recursive entity expansion (rhbz#1149087)

Oct 16, 2014
High

ELSA-2014-1620 10 CVEs

Important: java-1.7.0-openjdk security and bug fix update (Oracle Linux 7)

[1:1.7.0.65-2.5.3.1.0.1.el7_0] - Update DISTRO_NAME in specfile [1:1.7.0.65-2.5.3.1] - Bump to 2.5.3 for latest security fixes. - Remove obsolete patches. - Add hsbootstrap option to pre-build HotSpot when required. - Resolves: rhbz#1148893

Oct 15, 2014
Critical

ELSA-2014-1635 6 CVEs

Critical: firefox security update (Oracle Linux 7)

firefox [31.2.0-3.0.1.el7_0] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one [31.2.0-3] - Update to 31.2.0 ESR - Fix for mozbz#1042889 [31.1.0-7] - Enable WebM on all arches xulrunner [31.2.0-1.0.1] - Replaced xulrunner-redhat-d…

Oct 15, 2014
High

ELSA-2014-1634 10 CVEs

Important: java-1.6.0-openjdk security and bug fix update (Oracle Linux 7)

[1:1.6.0.33-1.13.5.0] - Update to IcedTea 1.13.5 - Remove upstreamed patches. - Regenerate add-final-location-rpaths patch against new release. - Change versioning to match java-1.7.0-openjdk so revisions work. - Use xz for tarballs to reduce file size. - No …

Oct 14, 2014
High

ELSA-2014-1397 1 CVE

Important: rsyslog security update (Oracle Linux 7)

[7.4.7-7.0.1] - use setsid() to get a controlling session and process group [Orabug: 17346261] (Todd Vierling) [7.4.7-7] - fix CVE-2014-3634 resolves: #1149152

Oct 13, 2014
High

ELSA-2014-1359 1 CVE

Important: polkit-qt security update (Oracle Linux 7)

[0.103.0-10] - Resolves: #1147368 (CVE-2014-5033)

Oct 6, 2014
Medium

ELSA-2014-1352 2 CVEs

Moderate: libvirt security and bug fix update (Oracle Linux 7)

[1.1.1-29.0.1.el7_0.3] - Replace docs/et.png in tarball with blank image [1.1.1-29.el7_0.3] - domain_conf: fix domain deadlock (CVE-2014-3657) [1.1.1-29.el7_0.2] - qemu: split out cpuset.mems setting (rhbz#1135871) - qemu: leave restricting cpuset.mems after …

Oct 1, 2014
Medium max 6.5

ELSA-2014-1327 8 CVEs

Moderate: php security update (Oracle Linux 7)

[5.4.16-23.1] - gd: fix NULL pointer dereference in gdImageCreateFromXpm(). CVE-2014-2497 - gd: fix NUL byte injection in file names. CVE-2014-5120 - fileinfo: fix extensive backtracking in regular expression (incomplete fix for CVE-2013-7345). CVE-2014-3538 …

Sep 30, 2014
Medium

ELSA-2014-1319 1 CVE

Moderate: xerces-j2 security update (Oracle Linux 7)

[2.11.0-17] - Fix XML parsing bug (JAXP, 8017298) - Resolves: CVE-2013-4002

Sep 29, 2014
High

ELSA-2014-1307 1 CVE

Important: nss security update (Oracle Linux 7)

nss [3.16.2-7.0.1.el7_0] - Added nss-vendor.patch to change vendor [3.16.2-7] - Resolves: Bug 1145433 - CVE-2014-1568 [3.16.2-6] - Rolling back to commit e5fb6e476c179665976e906604496cbbb24f22a7 - Related: Bug 1145433 nss-softokn [3.16.2-3] - Resolves: Bug 11…

Sep 26, 2014
High max 9.8

ELSA-2014-1306 3 CVEs 1 exploited

Important: bash security update (Oracle Linux 7)

[4.2.45-5.4] - CVE-2014-7169 Resolves: #1146324 [4.2.45-5.3] - amend patch to match upstream's Related: #1146324 [4.2.45-5.2] - Fix-up the patch Related: #1141647

Sep 25, 2014
Critical max 9.8

ELSA-2014-3076 1 CVE 1 exploited

Critical: bash security update (Oracle Linux 7)

[4.2.45-5.2.0.1] - Preliminary fix for CVE-2014-7169

Sep 25, 2014
Medium

ELSA-2014-1292 1 CVE

Moderate: haproxy security update (Oracle Linux 7)

[1.5.2-3] - Fix remote client denial of service vulnerability (#1138191)

Sep 24, 2014
Critical max 9.8

ELSA-2014-1293 1 CVE 1 exploited

Critical: bash security update (Oracle Linux 7)

[4.1.2-15.1] - Check for fishy environment Resolves: #1141645

Sep 24, 2014
Medium

ELSA-2014-1281 1 CVE

Moderate: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-123.8.1] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-123.8.1] - [scsi] fnic: fix broken FIP discovery by initializing multicast address (Chris Leech) [1119727 1100078] - [scsi] libfcoe: Make fcoe_sysfs optional / fix fnic NULL exception (Chr…

Sep 22, 2014