Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

  • High max 7.5
    ELSA-2026-93439 2 CVEs

    Important: libXi security update (Oracle Linux 9)

    [1.7.10-8.3] - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow Resolves: RHEL-293452 [1.7.10-8.2] - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply Resolves: RHEL…

  • High max 9.8
    ELSA-2026-93469 7 CVEs

    Important: tomcat security update (Oracle Linux 9)

    [1:9.0.121-1] - Resolves: RHEL-255800 tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) - Resolves: tomcat: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183) - Resolves: RHEL-271827 tom…

  • High max 7.8
    ELSA-2026-92432 1 CVE

    Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [10.0.114-1.0.1] - Add support for Oracle Linux [10.0.114-1] - Update to .NET SDK 10.0.114 and Runtime 10.0.14 - Resolves: RHEL-291744

  • Medium max 6.6
    ELSA-2026-79281 6 CVEs

    Moderate: glibc security, bug fix, and enhancement update (Oracle Linux 9)

    [2.34-283.0.1] - Forward-port Oracle patches for ol9-u8 Reviewed-by: Kris Van Hees <kris.van.hees@oracle.com> Oracle history: August-03-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-275.0.1 - Forward-port Oracle patches for ol9-u8 Reviewed-by: …

  • High max 9.6
    ELSA-2026-93443 62 CVEs

    Important: thunderbird security, bug fix, and enhancement update (Oracle Linux 9)

    [153.5.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [153.5.0-1] - Update to 153.5.0 ESR [140.16.0-1] - Update to 140.16.0 ESR [140.15.0-1] - Update to 140.15.0 ESR [140.14.0-1] - Update to 140.14.0 ESR [140.13.0-1] - Update to 140.13…

  • High max 7.0
    ELSA-2026-90500 36 CVEs

    Important: java-17-openjdk security update for RHEL 9 (Oracle Linux 9)

    [1:17.0.21.0.9-2.2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:17.0.21.0.9-2.2] - Set rpmrelease to 2 for PQC signing [1:17.0.21.0.9-2.1] - Set portablerelease to 2 for new final portable - Set rpmrelease to 1 - Update sources to new final tarball …

  • High max 7.4
    ELSA-2026-93592 3 CVEs

    Important: freerdp security update (Oracle Linux 9)

    [2:2.11.7-7.9] - Backport several CVE fixes (CVE-2026-109242, CVE-2026-110837, CVE-2026-111880) Resolves: RHEL-282296, RHEL-283722, RHEL-286609

  • High max 9.8
    ELSA-2026-93412 18 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.64.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • Medium max 7.5
    ELSA-2026-90811 2 CVEs

    Moderate: grafana security update (Oracle Linux 9)

    [10.2.6-23.7] - CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting - Resolves RHEL-290771 [10.2.6-23.6] - Rebuild against updated golang - Resolves RHEL-287510 - Resolves RHEL-279380 - Resolves RHEL-279012 - Resolves RHE…

  • High max 9.8
    ELSA-2026-500574 289 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-326.222.4] - rtnetlink: advertise allmulti counter (Nicolas Dichtel) [Orabug: 40234417] [5.15.0-326.222.3] - vhost-scsi: fix page reference leak in misaligned I/O fallback (Jia Jia) [Orabug: 40193939] - vhost-scsi: zero misaligned I/O bounce pages (Sh…

  • High max 8.1
    ELSA-2026-93610 4 CVEs

    Important: bind security update (Oracle Linux 9)

    [9.16.23-40.0.1.el9_8.13] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-40.13] - Fix CVE-2026-94300: Arbitrary code execution via GSS-TSIG UDP message replay. - Fix CVE-2026-97313: Denial of Service via assertion failure i…

  • High max 9.2
    ELSA-2026-90495 1 CVE 1 exploited

    Important: brotli security update (Oracle Linux 9)

    [1.0.9-10.0.1] - Fix out-of-bounds write in the Brotli decoder [CVE-2026-111497]

  • High max 9.8
    ELSA-2026-93413 16 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.72.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 8.0
    ELSA-2026-93461 9 CVEs

    Important: util-linux security update (Oracle Linux 10)

    [2.40.2-18.0.1.el10_2.20] - fix -d -t output regression [OLDIS-51984] [2.40.2-20] - libblkid: validate EBR data [CVE-2026-53615] [2.40.2-19] - libmount and blkid security fixes - libblkid: fix use-after-free in nested partition probing [CVE-2026-13595] - nsen…

  • Medium max 5.5
    ELSA-2026-93464 1 CVE

    Moderate: podman security update (Oracle Linux 10)

    [5.8.2-12.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-12] - update to the latest upstream commit aae8b839 - fixes CVE-2025-11395 - Resolves: RHEL-119569

  • High max 7.5
    ELSA-2026-89751 4 CVEs

    Important: grafana security update (Oracle Linux 10)

    [10.2.6-28.9] - Rebuild against updated golang - Resolves RHEL-290737 [10.2.6-28.9] - CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting in Unified Alerting - Resolves RHEL-290765 [10.2.6-28.8] - Rebuild against updated …

  • Medium max 5.5
    ELSA-2026-93442 1 CVE

    Moderate: pipewire security update (Oracle Linux 10)

    [1.4.11-1.2] - CVE-2026-14330 pipewire: Pulse Server alloca Stack Overflow Resolves: RHEL-296741

  • High max 7.5
    ELSA-2026-93441 2 CVEs

    Important: libXi security update (Oracle Linux 10)

    [1.8.1-7.3] - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow Resolves: RHEL-293447 [1.8.1-7.2] - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply Resolves: RHEL-2…

  • High max 9.8
    ELSA-2026-500572 308 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-208.112.5] - NFSD: Define actions for the new time_deleg FATTR4 attributes (Chuck Lever) [Orabug: 39004166] {CVE-2025-40326} - vhost-scsi: fix page reference leak in misaligned I/O fallback (Jia Jia) [Orabug: 40193938] - vhost-scsi: zero misaligned I/…

  • Medium max 5.9
    ELSA-2026-84753 4 CVEs

    Moderate: glibc security update (Oracle Linux 10)

    [2.39-145.0.1] - Forward port Oracle chnages to 2.39-145. Oracle history: Sep-01-2026 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.39-128.0.1 - Forward port Oracle changes to 2.39-128. - Reviewed-by: Elena Zannoni <elena.zannoni@oracle.com> Jul-15-2026 Cup…

  • High max 7.5
    ELSA-2026-93440 1 CVE

    Important: python-jwt security update (Oracle Linux 8)

    [1.6.1-2.1] - Fix CVE-2026-32597 Resolves: RHEL-271640

  • Medium max 6.8
    ELSA-2026-55774 3 CVEs

    Moderate: java-1.8.0-openjdk security update (Oracle Linux 7)

    [1.8.0.504.b01-1.0.1] - update to open-jdk 8u504-b01 (GA) [Orabug: 39966086] - Security update for CVE-2026-60589 CVE-2026-61308 and CVE-2026-70907

  • High max 7.5
    ELSA-2026-59240 1 CVE

    Important: python-pyasn1 security update (Oracle Linux 7)

    [0.1.9-7.0.3] - Fix CVE-2026-59886 Real float conversion [Orabug: 39925524] [0.1.9-7.0.1] - Fixes CVE-2026-23490 fixes potential memory exhaustion [Orabug: 39060516]

  • High max 7.8
    ELSA-2026-92427 1 CVE

    Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [9.0.123-1.0.1] - Add support for Oracle Linux [9.0.123-1] - Update to .NET SDK 9.0.123 and Runtime 9.0.22 - Resolves: RHEL-291723

  • High max 8.7
    ELSA-2026-92639 10 CVEs

    Important: python-pillow security update (Oracle Linux 8)

    [5.1.1-33] - CVE-2026-112892 python-pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder Resolves: RHEL-290437 [5.1.1-32] - CVE-2026-96640 python-pillow: pillow: Denial of Service via duplicate page references in PDF files Res…

  • High max 9.2
    ELSA-2026-92420 2 CVEs 1 exploited

    Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [8.0.133-1.0.1] - Add support for Oracle Linux [8.0.133-1] - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: -RHEL-291714

  • High max 9.2
    ELSA-2026-92376 13 CVEs 1 exploited

    Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 8)

    nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

  • High max 7.5
    ELSA-2026-90909 3 CVEs

    Important: pki-deps:10.6 security update (Oracle Linux 8)

    apache-commons-collections apache-commons-lang [2.6-21] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild apache-commons-net bea-stax [1.2.0-16] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild glassfish-fastinfoset [1.2.1…

  • High max 9.8
    ELSA-2026-92616 12 CVEs

    Important: httpd:2.4 security, bug fix, and enhancement update (Oracle Linux 8)

    httpd [2.4.37-65.0.1.8] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-65.8] - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) - Resol…

  • Medium max 7.7
    ELSA-2026-89830 2 CVEs

    Moderate: gcc security update (Oracle Linux 8)

    [8.5.0-30.0.1] - Merge Oracle patches to 8.5.0-30. Oracle history: August-26-2025 Qing Zhao <qing.zhao@oracle.com> 8.5.0-28.0.1 - Merge Oracle patches to 8.5.0-28. March-31-2025 Jose E. Marchesi <jose.marchesi@oracle.com> 8.5.0-26.0.1 - Merge Oracle patches t…

  • High max 5.9
    ELSA-2026-92458 1 CVE

    Important: aspell security update (Oracle Linux 9)

    [12:0.60.8-9] - Backport fix for CVE-2026-103658

  • High max 9.2
    ELSA-2026-92378 13 CVEs 1 exploited

    Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 9)

    nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

  • High max 9.2
    ELSA-2026-92492 2 CVEs 1 exploited

    Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [8.0.133-1.0.1] - Add support for Oracle Linux [8.0.133-1] - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: RHEL-291717

  • High max 7.8
    ELSA-2026-92429 1 CVE

    Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [9.0.123-1.0.1] - Add support for Oracle Linux [9.0.123-1] - Update to .NET SDK 9.0.123 and Runtime 9.0.22 - Resolves: RHEL-291727

  • High max 8.1
    ELSA-2026-93072 4 CVEs

    Important: bind9.18 security update (Oracle Linux 9)

    [32:9.18.29-14.12] - Prevent arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300) - Fix Denial of service via assertion failure in RPZ query processing (CVE-2026-97313) - Prevent Denial of Service via assertion failure during redirect pro…

  • High max 9.8
    ELSA-2026-92862 6 CVEs

    Important: tomcat security, bug fix, and enhancement update (Oracle Linux 10)

    [1:10.1.49-5] - Resolves: RHEL-264918 tomcat: Stalled TLS handshake when the server's first flight is too large - Resolves: RHEL-255786 tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) - Resolves: RHEL-271888 tomcat: Authenti…

  • High max 9.2
    ELSA-2026-92428 2 CVEs 1 exploited

    Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [8.0.133-1.0.1] - Add support for Oracle Linux [8.0.133-1] - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: RHEL-291718

  • High max 7.8
    ELSA-2026-92438 1 CVE

    Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [10.0.114-1.0.1] - Add support for Oracle Linux [10.0.114-1] - Update to .NET SDK 10.0.114 and Runtime 10.0.14 - Resolves: RHEL-291745

  • High max 7.0
    ELSA-2026-90504 38 CVEs

    Important: java-21-openjdk security update for RHEL 10 (Oracle Linux 10)

    [1:21.0.13.0.9-1.2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:21.0.13.0.9-1.2] - Bump release for PQC build [1:21.0.13.0.9-1.1] - Update to jdk-21.0.13+9 (GA) - ** This tarball is embargoed until 2026-10-20 @ 1pm PT. ** - Update release notes to O…

  • High max 7.8
    ELSA-2026-92430 1 CVE

    Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [9.0.123-1.0.1] - Add support for Oracle Linux [9.0.123-1] - Update to .NET SDK 9.0.123 and Runtime 9.0.22 - Resolves: RHEL-291728