Oracle Linux Security Advisories (ELSA)

8,326 results · Feed

• High
  ELSA-2014-1172 1 CVE

  Important: procmail security update (Oracle Linux 7)

  [3.22-34.1] - Fixed buffer overflow in formail Resolves: CVE-2014-3618

  Sep 10, 2014
• High
  ELSA-2014-3072 1 CVE

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

  [3.8.13-44.1.1] - auditsc: audit_krule mask accesses need bounds checking (Andy Lutomirski) [Orabug: 19590596] {CVE-2014-3917}

  Sep 10, 2014
• High
  ELSA-2014-1166 1 CVE

  Important: jakarta-commons-httpclient security update (Oracle Linux 7)

  [1:3.1-16] - Fix MITM security vulnerability - Resolves: CVE-2014-3577

  Sep 8, 2014
• High
  ELSA-2014-1146 1 CVE

  Important: httpcomponents-client security update (Oracle Linux 7)

  [4.2.5-5] - Fix MITM security vulnerability - Resolves: CVE-2014-3577

  Sep 3, 2014
• High
  ELSA-2014-1147 1 CVE

  Important: squid security update (Oracle Linux 7)

  [7:3.3.8-12] - Resolves: #1134933 - CVE-2014-3609 assertion failure in header processing

  Sep 3, 2014
• Critical
  ELSA-2014-1144 2 CVEs

  Critical: firefox security update (Oracle Linux 7)

  firefox [24.8.0-1.0.1.el7_0] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one [24.8.0-1] - Update to 24.8.0 ESR xulrunner [24.8.0-1.0.1.el7_0] - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js - …

  Sep 3, 2014
• High
  ELSA-2014-1110 2 CVEs

  Important: glibc security update (Oracle Linux 7)

  [2.12-1.132.4] - Remove gconv transliteration loadable modules support (CVE-2014-5119, - _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,

  Aug 29, 2014
• High
  ELSA-2014-1091 1 CVE

  Important: mod_wsgi security update (Oracle Linux 7)

  [3.4-12] - fix possible privilege escalation in setuid() (CVE-2014-0240)

  Aug 25, 2014
• High
  ELSA-2014-3070 3 CVEs

  Important: Unbreakable Enterprise kernel security and bug fix update (Oracle Linux 7)

  kernel-uek [3.8.13-44] - net: Use netlink_ns_capable to verify the permisions of netlink messages (Eric W. Biederman) [Orabug: 19404229] {CVE-2014-0181} - net: Add variants of capable for use on netlink messages (Eric W. Biederman) [Orabug: 19404229] - net: A…

  Aug 22, 2014
• Low
  ELSA-2014-1073 1 CVE

  Low: nss, nss-util, nss-softokn security, bug fix, and enhancement update (Oracle Linux 7)

  nss [3.16.2-2.0.1.el7_0] - Added nss-vendor.patch to change vendor [3.16.2-2] - Restore missing options descriptions fix for certutil manpage - Document certutil options --dump-ext-val, --extGeneric, and --extSAN - Related: Bug 1124659 - Rebase RHEL 7 to at l…

  Aug 18, 2014
• Medium
  ELSA-2014-1052 7 CVEs

  Moderate: openssl security update (Oracle Linux 7)

  [1.0.1e-34.4] - fix CVE-2014-3505 - doublefree in DTLS packet processing - fix CVE-2014-3506 - avoid memory exhaustion in DTLS - fix CVE-2014-3507 - avoid memory leak in DTLS - fix CVE-2014-3508 - fix OID handling to avoid information leak - fix CVE-2014-3509…

  Aug 13, 2014
• High
  ELSA-2014-3067 2 CVEs

  Important: unbreakable enterprise kernel security update (Oracle Linux 7)

  kernel-uek [3.8.13-35.3.5.el7uek] - net: Use netlink_ns_capable to verify the permisions of netlink messages (Eric W. Biederman) [Orabug: 19404231] {CVE-2014-0181} - net: Add variants of capable for use on netlink messages (Eric W. Biederman) [Orabug: 1940423…

  Aug 11, 2014
• High
  ELSA-2014-1031 1 CVE

  Important: 389-ds-base security update (Oracle Linux 7)

  [1.2.11.15-34] - Release 1.2.11.15-34 - Resolves: #1123861 EMBARGOED CVE-2014-3562 unauthenticated information disclosure [rhel-6.5.z] (DS 616, BZ 1123477)

  Aug 7, 2014
• Low
  ELSA-2014-1034 1 CVE

  Low: tomcat security update (Oracle Linux 7)

  [0:7.0.42-8] - Resolves: CVE-2013-4590 - Resolves: CVE-2014-0119 [0:7.0.42-7] - Related: CVE-2014-0099 incrementing release so rpmdiff doesn't complain about - no new entries in the changelog [0:7.0.42-6] - Resolves: CVE-2014-0099 Fix possible overflow when p…

  Aug 7, 2014
• Medium max 6.5
  ELSA-2014-1013 10 CVEs

  Moderate: php security update (Oracle Linux 7)

  [5.4.16-23] - fileinfo: cdf_unpack_summary_info() excessive looping DoS. CVE-2014-0237 - fileinfo: CDF property info parsing nelements infinite loop. CVE-2014-0238 - fileinfo: cdf_check_stream_offset insufficient boundary check. CVE-2014-3479 - fileinfo: cdf_…

  Aug 6, 2014
• High
  ELSA-2014-1023 6 CVEs

  Important: kernel security and bug fix update (Oracle Linux 7)

  [3.10.0-123.6.3] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-123.6.3] - [net] l2tp_ppp: fail when socket option level is not SOL_PPPOL2TP (Petr Matousek) [1119465 1119466] {CVE-2014-4943} [3.10.0-123.6.2.el7] - [s390] ptrace: correct insufficient sa…

  Aug 6, 2014
• High
  ELSA-2014-1008 1 CVE

  Important: samba security and bug fix update (Oracle Linux 7)

  [4.1.1-37] - resolves: #1126013 - CVE-2014-3560: remote code execution in nmbd. [4.1.1-36] - resolves: #1115490 - Fix potential Samba file corruption.

  Aug 5, 2014
• Medium
  ELSA-2014-1011 1 CVE

  Moderate: resteasy-base security update (Oracle Linux 7)

  [2.3.5-3] - Resolves: rhbz1121917 - CVE-2014-3490: XXE via parameter entities

  Aug 5, 2014
• High
  ELSA-2014-3052 3 CVEs

  Important: unbreakable enterprise kernel security update (Oracle Linux 7)

  kernel-uek [3.8.13-35.3.3.el7uek] - filter: prevent nla extensions to peek beyond the end of the message (Mathias Krause) [Orabug: 19315781] {CVE-2014-3144} {CVE-2014-3145} - mac80211: fix AP powersave TX vs. wakeup race (Emmanuel Grumbach) [Orabug: 19316457]…

  Jul 29, 2014
• High
  ELSA-2014-0921 5 CVEs

  Important: httpd security update (Oracle Linux 7)

  [2.4.6-18.0.1.el7_0] - replace index.html with Oracle's index page oracle_index.html [2.4.6-18] - mod_cgid: add security fix for CVE-2014-0231 (#1120607) - mod_proxy: add security fix for CVE-2014-0117 (#1120607) - mod_deflate: add security fix for CVE-2014-0…

  Jul 23, 2014
• High
  ELSA-2014-0923 2 CVEs

  Important: kernel security update (Oracle Linux 7)

  [3.10.0-123.4.4] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-123.4.4] - [net] l2tp_ppp: fail when socket option level is not SOL_PPPOL2TP (Petr Matousek) [1119465 1119466] {CVE-2014-4943} [3.10.0-123.4.3] - [x86] ptrace: force IRET path after a ptra…

  Jul 23, 2014
• High
  ELSA-2014-3049 3 CVEs

  Important: unbreakable enterprise kernel security update (Oracle Linux 7)

  kernel-uek [3.8.13-35.3.2.el7uek] - l2tp: fix an unprivileged user to kernel privilege escalation (Sasha Levin) [Orabug: 19229497] {CVE-2014-4943} {CVE-2014-4943} - ptrace,x86: force IRET path after a ptrace_stop() (Tejun Heo) [Orabug: 19230689] {CVE-2014-469…

  Jul 23, 2014
• High max 7.8
  ELSA-2014-0786 8 CVEs 1 exploited

  Important: kernel security, bug fix, and enhancement update (Oracle Linux 7)

  [3.10.0-123.4.2] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-123.4.2] - [fs] aio: fix plug memory disclosure and fix reqs_active accounting backport (Jeff Moyer) [1094604 1094605] {CVE-2014-0206} - [fs] aio: plug memory disclosure and fix reqs_activ…

  Jul 23, 2014
• High
  ELSA-2014-0679 6 CVEs

  Important: openssl security update (Oracle Linux 7)

  [1.0.1e-34.3] - fix CVE-2010-5298 - possible use of memory after free - fix CVE-2014-0195 - buffer overflow via invalid DTLS fragment - fix CVE-2014-0198 - possible NULL pointer dereference - fix CVE-2014-0221 - DoS from invalid DTLS handshake packet - fix CV…

  Jul 23, 2014
• Medium
  ELSA-2014-0703 2 CVEs

  Moderate: json-c security update (Oracle Linux 7)

  [0.11-4] - fix has collision CVE-2013-6371 - fix buffer overflow CVE-2013-6370 - enable upstream test suite

  Jul 23, 2014
• Medium
  ELSA-2014-0867 3 CVEs

  Moderate: samba security update (Oracle Linux 7)

  [4.1.1-35] - resolves: #1105504 - CVE-2014-0244: DoS in nmbd. - resolves: #1108844 - CVE-2014-3493: DoS in smbd with unicode path names. - resolves: #1105573 - CVE-2014-0178: Uninitialized memory exposure. [4.1.1-33] - related: #717484 - Add missing configure…

  Jul 23, 2014
• High
  ELSA-2014-0684 2 CVEs

  Important: gnutls security update (Oracle Linux 7)

  [3.1.18-9] - fix session ID length check (#1102027) - fixes null pointer dereference (#1101727)

  Jul 23, 2014
• Medium
  ELSA-2014-0827 3 CVEs

  Moderate: tomcat security update (Oracle Linux 7)

  [0:7.0.42-6] - Resolves: CVE-2014-0099 Fix possible overflow when parsing - long values from byte array - Resolves: CVE-2014-0096 Information discloser process XSLT - files not subject to same constraint running under - java security manager - Resolves: CVE-2…

  Jul 23, 2014
• High
  ELSA-2014-0680 1 CVE

  Important: openssl098e security update (Oracle Linux 7)

  [0.9.8e-29.2] - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability

  Jul 23, 2014
• Medium
  ELSA-2014-0687 3 CVEs

  Moderate: libtasn1 security update (Oracle Linux 7)

  [3.3-5] - Added missing check for null pointer (#1102338) [3.3-4] - Fix multiple decoding issues (#1102338)

  Jul 23, 2014
• Medium
  ELSA-2014-0927 15 CVEs

  Moderate: qemu-kvm security and bug fix update (Oracle Linux 7)

  [1.5.3-60.el7_0.5] - kvm-Allow-mismatched-virtio-config-len.patch [bz#1095782] - Resolves: bz#1095782 (CVE-2014-0182 qemu-kvm: qemu: virtio: out-of-bounds buffer write on state load with invalid config_len [rhel-7.0.z]) [1.5.3-60.el7_0.4] - kvm-zero-initializ…

  Jul 23, 2014
• Medium
  ELSA-2014-0914 1 CVE

  Moderate: libvirt security and bug fix update (Oracle Linux 7)

  [1.1.1-29.0.1.el7_0.1] - Replace docs/et.png in tarball with blank image [1.1.1-29.el7_0.1] - LSN-2014-0003: Don't expand entities when parsing XML (CVE-2014-0179) - virNetClientSetTLSSession: Restore original signal mask (rhbz#1112689) - Don't use AI_ADDRCON…

  Jul 23, 2014
• Medium
  ELSA-2014-0702 8 CVEs

  Moderate: mariadb security update (Oracle Linux 7)

  [1:5.5.37-1] - Rebase to 5.5.37 https://kb.askmonty.org/en/mariadb-5537-changelog/ Also fixes: CVE-2014-2440 CVE-2014-0384 CVE-2014-2432 CVE-2014-2431 CVE-2014-2430 CVE-2014-2436 CVE-2014-2438 CVE-2014-2419 Resolves: #1101062

  Jul 23, 2014
• Medium
  ELSA-2014-0704 1 CVE

  Moderate: qemu-kvm security and bug fix update (Oracle Linux 7)

  [1.5.3-60.el7_0.2] - kvm-pc-add-hot_add_cpu-callback-to-all-machine-types.patch [bz#1094820] - Resolves: bz#1094820 (Hot plug CPU not working with RHEL6 machine types running on RHEL7 host.) [1.5.3-60.el7_0.1] - kvm-iscsi-fix-indentation.patch [bz#1090978] - …

  Jul 23, 2014
• Critical
  ELSA-2014-0916 1 CVE

  Critical: nss and nspr security update (Oracle Linux 7)

  nspr [4.10.2-4] - Rebase to nspr-4.10.6 - Resolves: Bug 1116199 [4.10.2-3] - Retagging - Resolves: rhbz#1032466 nss [3.15.3-7] - Remove an unused patch - Related: Bug 1116199 [3.15.3-6] - Fix race-condition in certificate validation - Resolves: Bug 1116199 [3…

  Jul 22, 2014
• Critical
  ELSA-2014-0919 4 CVEs

  Critical: firefox security update (Oracle Linux 7)

  [24.7.0-1.0.1.el6_5] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one [24.7.0-1] - Update to 24.7.0 ESR

  Jul 22, 2014
• High
  ELSA-2014-0907 10 CVEs

  Important: java-1.6.0-openjdk security and bug fix update (Oracle Linux 7)

  [1:1.6.0.1-6.1.13.4] - moved to icedteaver 1.13.4 - moved to openjdkver b32 and openjdkdate 15_jul_2014 - added upstreamed patch patch9 rh1115580-unsyncHashMap.patch - Resolves: rhbz#1115580 - Resolves: rhbz#1115867

  Jul 21, 2014
• Critical
  ELSA-2014-0675 24 CVEs

  Critical: java-1.7.0-openjdk security update (Oracle Linux 7)

  [1.7.0.55-2.4.7.2.0.1.el7_0] - Update DISTRO_NAME in specfile [1.7.0.55-2.4.7.2] - Remove NSS patches. Issues with PKCS11 provider mean it shouldn't be enabled. - Always setup nss.cfg and depend on nss-devel at build-time to do so. - This allows users who wis…

  Jul 20, 2014
• High max 5.5
  ELSA-2014-0678 1 CVE 1 exploited

  Important: kernel security update (Oracle Linux 7)

  [3.10.0-123.1.2] - Oracle Linux certificates (Alexey Petrenko) [3.10.0-123.1.2] - [tty] n_tty: Fix n_tty_write crash when echoing in raw mode (Aristeu Rozanski) [1094241 1094242] {CVE-2014-0196}

  Jul 20, 2014
• High
  ELSA-2014-0685 19 CVEs

  Important: java-1.6.0-openjdk security update (Oracle Linux 7)

  [1:1.6.0.1-6.1.13.3] - updated to icedtea 1.13.3 - updated to openjdk-6-src-b31-15_apr_2014 - renmoved upstreamed patch7, 1.13_fixes.patch - renmoved upstreamed patch9, 1051245.patch - Resolves: rhbz#1099563

  Jul 20, 2014