Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

  • High max 7.3
    ELSA-2026-38509 4 CVEs

    Important: vim security update (Oracle Linux 10)

    [9.1.083-9.0.1.el10_2.7] - Remove upstream references [Orabug: 31197557] [2:9.1.083-9.7] - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave() - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete [2:9.1.083-9…

  • High max 7.5
    ELSA-2026-38513 1 CVE

    Important: perl-DBI security update (Oracle Linux 10)

    [1.643-26.1] - Fix CVE-2026-9698: stack overflow and buffer overflow in DBI.xs - Resolves: RHEL-184980

  • High max 8.8
    ELSA-2026-38514 1 CVE

    Important: plexus-utils security update (Oracle Linux 10)

    [3.5.1-9] - Fix CVE-2025-67030: Directory Traversal in Expand.extractFile Resolves: RHEL-165336

  • High max 8.7
    ELSA-2026-39183 1 CVE

    Important: python3.12 security update (Oracle Linux 10)

    [3.12.13-2.0.1.el10_2.1] - Remove upstream URL reference [3.12.13-2.1] - Security fix for CVE-2026-15308 Resolves: RHEL-193771

  • High max 7.5
    ELSA-2026-39272 1 CVE

    Important: git-lfs security update (Oracle Linux 10)

    [3.7.1-6] - Rebuild with new Golang [3.7.1-5] - Fix CVE-2026-39821 in vendored golang.org/x/net idna package [3.7.1-4] - Rebuild with new Golang

  • Medium max 7.4
    ELSA-2026-39296 1 CVE

    Moderate: libinput security update (Oracle Linux 10)

    [1.30.1-2] - CVE-2026-50292: sanitize phys before printing it in libinput-device-group Resolves: RHEL-182371

  • Medium max 6.1
    ELSA-2026-39302 1 CVE

    Moderate: cups security update (Oracle Linux 10)

    [1:2.4.10-18] - RHEL-177945 CVE-2026-34980 cups: control character injection in option values

  • Low max 2.5
    ELSA-2026-39304 1 CVE

    Low: libxml2 security update (Oracle Linux 10)

    [2.12.5-10.2] - Fix CVE-2025-6170 (RHEL-182007) [2.12.5-10.1] - Fix CVE-2024-34459 (RHEL-177890)

  • High max 7.5
    ELSA-2026-39547 1 CVE

    Important: perl-XML-LibXML security update (Oracle Linux 10)

    [1:2.0210-4.1] - Fix out-of-bounds heap read on truncated UTF-8 sequences (CVE-2026-8177) - Resolves: RHEL-186521

  • High max 9.6
    ELSA-2026-39573 3 CVEs

    Important: yggdrasil security update (Oracle Linux 10)

    [0.4.9.2-1] - Update yggdrasil to 0.4.9.2 [0.4.9.1-1] - Update yggdrasil to 0.4.9.1 [0.4.9-5] - Bump release for rebuild [0.4.9-4] - Bump release for rebuild [0.4.9-3] - Bump release for rebuild

  • High max 9.8
    ELSA-2026-39976 1 CVE

    Important: hplip security update (Oracle Linux 10)

    [3.23.12-10.5] - RHEL-192007 CVE-2026-14544 hplip: Incomplete Fix for CVE-2026-8631 [3.23.12-10.4] - Fix more leaks in hpcups [3.23.12-10.3] - OSH fixes after CVE-2026-8631 [3.23.12-10.2] - CVE-2026-8631 hplip: Arbitrary code execution and privilege escalatio…

  • Medium max 7.5
    ELSA-2026-39297 2 CVEs

    Moderate: edk2 security, bug fix, and enhancement update (Oracle Linux 10)

    [20251114-5.0.1.el10_2.2] - Replace upstream references [Orabug:36569119] [20251114-5.el10_2.2] - edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421] - edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699] - Resolves: RHEL-182421 (edk2/…

  • High max 7.8
    ELSA-2026-39494 2 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • Medium max 6.5
    ELSA-2026-20693 19 CVEs

    Moderate: mysql8.4 security update (Oracle Linux 10)

    [8.4.9-1] - Rebase to 8.4.9 [8.4.8-2] - Revert to soft static allocation of MariaDB and MySQL sysusers.d files

  • High max 7.7
    ELSA-2026-35841 15 CVEs

    Important: nodejs24 security, bug fix, and enhancement update (Oracle Linux 10)

    [1:24.18.0-1.0.1] - Update upstream references [1:24.18.0-1] - Update to version 24.18.0 [1:24.14.1-3] - De-bundle c-ares and libuv

  • High max 7.7
    ELSA-2026-35842 13 CVEs

    Important: nodejs22 security, bug fix, and enhancement update (Oracle Linux 10)

    [1:22.23.1-2] - CVE-2026-42338 ip-address HTML escaping fix. [1:22.23.1-1] - Update to version 22.23.1 [1:22.22.2-2] - De-bundle c-ares, libuv - we waited for c-ares for about 4 months, so added conditional flag in case it falls behind in future again, same f…

  • High max 7.8
    ELSA-2026-39575 1 CVE

    Important: cifs-utils security, bug fix, and enhancement update (Oracle Linux 8)

    [7.0-5] - resolves: RHEL-192933 - fix krb5 mount regression [7.0-4] - cifs.upcall: remove getpwuid dependency - cifs.upcall: fix compiler warning with -Wvla - Resolves: RHEL-185759 - Fix CVE-2026-12505 [7.0-3] - docs: update echo_interval description - Resolv…

  • High max 8.7
    ELSA-2026-39320 1 CVE

    Important: python3 security update (Oracle Linux 8)

    [3.6.8-77.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8.openela.0] - Add openela to supported dists [3.6.8-77] - Security fix for CVE-2026-15308 Resolves: RHEL-193772

  • High max 7.5
    ELSA-2026-39878 1 CVE

    Important: perl-XML-LibXML security update (Oracle Linux 8)

    [1:2.0132-3] - Fix out-of-bounds heap read via truncated UTF-8 in node name validation (CVE-2026-8177) - Resolves: RHEL-186519

  • High max 8.7
    ELSA-2026-39893 1 CVE

    Important: python3.12 security update (Oracle Linux 8)

    [3.12.13-3] - Security fix for CVE-2026-15308 Resolves: RHEL-193776

  • High max 7.8
    ELSA-2026-39179 2 CVEs

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.144.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 7.5
    ELSA-2026-38504 3 CVEs

    Important: container-tools:ol8 security update (Oracle Linux 8)

    aardvark-dns [2:1.10.1-2] - build off the RHEL maintenance branch - Resolves: RHEL-59129 buildah [2:1.33.14-4] - switch source URL from GitHub to the internal GitLab sustaining-engineering repo - update to the latest content of release-1.33 (commit 2cbee78) -…

  • High max 7.5
    ELSA-2026-38901 1 CVE

    Important: perl-DBI:1.641 security update (Oracle Linux 8)

    perl-DBI [1.641-5] - Fix stack overflow and buffer overflow in DBI.xs (CVE-2026-9698) Resolves: RHEL-184974 [1.641-4] - BR: perl(blib), perl(FileHandle) for tests [1.641-3] - Rebuild with enable hardening (bug #1636329) [1.641-2] - Rebuilding for multicontext…

  • High max 8.6
    ELSA-2026-39322 1 CVE

    Important: pacemaker security update (Oracle Linux 8)

    [2.1.7-5.6.0.1] - Upstream reference in pacemaker crm_report binary [Orabug: 32825154] - Replace bug url [Orabug: 34202300] [2.1.7-5.6] - Fix integer overflows in remote message decompression code (CVE-2026-10649) - Resolves: RHEL-181157

  • High max 7.8
    ELSA-2026-39576 1 CVE

    Important: cifs-utils security, bug fix, and enhancement update (Oracle Linux 9)

    [7.6-2] - resolves: RHEL-192982 - fix krb5 mount regression [7.6-1] - Update to version 7.6 - resolves: RHEL-185761 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego

  • High max 7.8
    ELSA-2026-38491 5 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.25.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 8.8
    ELSA-2026-38500 1 CVE

    Important: maven:3.9 security update (Oracle Linux 9)

    aopalliance [0:1.0-49] - Update javapackages test plan to f42 [0:1.0-40] - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild [0:1.0-39] - Rebuilt for java-21-openjdk as system jdk [0:1.0-38] - bump of release for for java-21-openjdk as system …

  • High max 9.3
    ELSA-2026-500004 3 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-204.92.4.3] - xfrm: hold dev ref until after transport_finish NF_HOOK (Qi Tang) [Orabug: 39727259] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Jianbo Liu) [Orabug: 39727259] - KVM: arm64: vgic-its: Drop the translation c…

  • High max 7.5
    ELSA-2026-26453 1 CVE

    Important: 389-ds-base security update (Oracle Linux 7)

    [1.3.11.1-5.0.9] - Security fix for CVE-2026-9064 [Orabug: 39570202] [1.3.11.1-5.0.7] - Security fix for CVE-2025-14905 [Orabug: 39146844] [1.3.11.1-5.0.5] - Allow Uniqueness plugin to search uniqueness attributes using custom matching rules [Orabug: 38388205]

  • High max 7.5
    ELSA-2026-16101 1 CVE

    Important: host-metering security update (Oracle Linux 7)

    [1.2.0-4.0.1] - Rebuild with new go-toolset-1.19-golang to fix CVE-2026-32283 [Orabug: 39352233]

  • High max 8.1
    ELSA-2026-38847 1 CVE

    Important: nginx:1.24 security, bug fix, and enhancement update (Oracle Linux 8)

    [1.24.0-3.0.1.3] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-3.3] - Resolves: RHEL-191779 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes - Resolves: RHEL-188406 - nginx: NGINX: Arbitrary code execution or. Denial of Service vi…

  • Medium max 9.8
    ELSA-2026-33126 1 CVE

    Moderate: glibc security update (Oracle Linux 8)

    [2.28-251.0.4.38] - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Oracle history: May-26-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.4.37 - Forward port of Oracle patches Reviewed-by: David Faus…

  • High max 8.8
    ELSA-2026-39083 8 CVEs 1 exploited

    Important: kernel update (Oracle Linux 8)

    [4.18.0-553.143.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 7.5
    ELSA-2026-39127 4 CVEs

    Important: python-pillow security update (Oracle Linux 8)

    [5.1.1-22] - Security fix for CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380 Resolves: RHEL-192830, RHEL-192770, RHEL-192684, RHEL-192731

  • High max 9.6
    ELSA-2026-38995 3 CVEs

    Important: go-toolset:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

    delve [1.26.1-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.26.1-1] - Update to Delve 1.26.1 - Related: RHEL-183712 golang [1.26.5-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var - Backported from OL9u7 - Resolves: OLDI…

  • High max 7.5
    ELSA-2026-39266 1 CVE

    Important: git-lfs security update (Oracle Linux 8)

    [3.4.1-12] - Rebuild with new Golang - Resolves: RHEL-187191

  • High max 7.8
    ELSA-2026-38493 1 CVE

    Important: buildah security update (Oracle Linux 9)

    [1.43.1-4.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.43.1-4] - rebuild for CVE-2026-39822 - Resolves: RHEL-193645

  • High max 7.3
    ELSA-2026-38511 4 CVEs

    Important: vim security update (Oracle Linux 9)

    [8.2.2637-26.0.1.el9_8.10] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-26.10] - RHEL-186659 CVE-2026-47162 vim: code injection via NetrwBookHistSave() [2:8.2.2637-26.9] - RHEL-186646 CVE-2026-52858 vim: possible code execution with python3comp…

  • High max 7.8
    ELSA-2026-38878 1 CVE

    Important: podman security update (Oracle Linux 9)

    [5.8.2-5.0.1] - Rework CNI/Netavark detection logic [JIRA: EVG-3769] - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.8.2-5] - rebuild for CVE-2026-3…

  • High max 8.8
    ELSA-2026-19354 1 CVE

    Important: PackageKit security update (Oracle Linux 9)

    [1.2.6-2.0.1] - remove RHEL vendor patch PackageKit-0.3.8-RHEL-Vendor.conf.patch