Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

  • High max 7.5
    ELSA-2026-39319 1 CVE

    Important: git-lfs security update (Oracle Linux 9)

    [3.7.1-4.2] - Rebuild with new Golang - Resolves: RHEL-187329

  • High max 8.8
    ELSA-2026-36645 3 CVEs 1 exploited

    Important: kernel update (Oracle Linux 9)

    [5.14.0-687.23.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • Low max 6.7
    ELSA-2026-39311 1 CVE

    Low: qemu-kvm security update (Oracle Linux 9)

    [10.1.0-17.el9_8.4] - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184527] - Resolves: RHEL-184527 (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z])

  • Medium max 7.8
    ELSA-2026-39315 1 CVE

    Moderate: libsolv security update (Oracle Linux 9)

    [0.7.24-6] - Fix a buffer overflow when decompressing solv pages (CVE-2026-48864) (RHEL-178982)

  • Medium max 6.1
    ELSA-2026-39316 1 CVE

    Moderate: cups security update (Oracle Linux 9)

    [1:2.3.3op2-39] - RHEL-177957 CVE-2026-34980 cups: control character injection in option values

  • Low max 2.5
    ELSA-2026-39317 1 CVE

    Low: libxml2 security update (Oracle Linux 9)

    [2.9.13-14.2] - Fix CVE-2025-6170 (RHEL-182016)

  • High max 7.5
    ELSA-2026-39553 1 CVE

    Important: perl-XML-LibXML security update (Oracle Linux 9)

    [1:2.0206-5.1] - Fix out-of-bounds UTF-8 heap read in node name validation (CVE-2026-8177) - Resolves: RHEL-186532

  • High max 9.8
    ELSA-2026-19345 2 CVEs

    Important: LibRaw security update (Oracle Linux 9)

    [0.21.1-2] - Fix CVE-2026-21413 and CVE-2026-24450 Resolves: RHEL-165374, RHEL-165461

  • High max 7.8
    ELSA-2026-38497 1 CVE

    Important: gegl04 security update (Oracle Linux 9)

    [0.4.62-1.1] - Fix CVE-2026-2050: buffer overflow in rgbe_read_new_rle - Resolves: RHEL-188264

  • High max 7.8
    ELSA-2026-33743 3 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-553.141.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 8.5
    ELSA-2026-38488 1 CVE

    Important: xorg-x11-server-Xwayland security update (Oracle Linux 8)

    [21.1.3-20.3] - CVE fix for: CVE-2026-55999 Resolves: https://redhat.atlassian.net/browse/RHEL-191516

  • High max 7.7
    ELSA-2026-38501 1 CVE

    Important: freerdp security update (Oracle Linux 8)

    [2:2.11.7-10] - Fix incorrect bounds checks in planar codec (CVE-2026-45700) Resolves: RHEL-186983

  • Medium max 7.5
    ELSA-2026-38503 1 CVE

    Moderate: openssl security update (Oracle Linux 8)

    [1:1.1.1k-17] - Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing Resolves: RHEL-165783

  • High max 7.3
    ELSA-2026-38510 4 CVEs

    Important: vim security update (Oracle Linux 8)

    [8.0.1763-27.0.1] - Remove upstream references [Orabug: 31197557] - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984] [2:8.0.1763-27] - RHEL-186656 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186648 …

  • High max 9.8
    ELSA-2026-36349 6 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-553.141.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 7.8
    ELSA-2026-38485 1 CVE

    Important: gegl security update (Oracle Linux 8)

    [0.2.0-40] - Fix buffer overflow in rgbe_read_new_rle() (CVE-2026-2050) Resolves: RHEL-188260

  • High max 8.5
    ELSA-2026-38486 1 CVE

    Important: xorg-x11-server security update (Oracle Linux 9)

    [1.20.11-34.3] - CVE fix for CVE-2026-55999 Resolves: https://redhat.atlassian.net/browse/RHEL-191493

  • High max 7.3
    ELSA-2026-38496 1 CVE

    Important: gimp security update (Oracle Linux 9)

    [2:3.0.4-4.5] - fix CVE-2026-58379 - Resolves: RHEL-192170

  • High max 8.8
    ELSA-2026-38498 2 CVEs

    Important: openexr security update (Oracle Linux 9)

    [3.1.1-3.3] - fix CVE-2026-41142 - fix CVE-2026-42216

  • High max 7.5
    ELSA-2026-38512 1 CVE

    Important: perl-DBI security update (Oracle Linux 9)

    [1.643-9.1] - Fix possible stack overflow and buffer overflow in DBI.xs (CVE-2026-9698) - Resolves: RHEL-184984

  • High max 8.1
    ELSA-2026-36331 1 CVE

    Important: nginx security, bug fix, and enhancement update (Oracle Linux 9)

    [1.20.1-28.0.1.el9_8.4] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] - Update upstream references [Orabug: 36579090] [2:1.20.1-28.4] - Resolves: RHEL-190800 - nginx: 'HTTP/2 bomb' nginx fix bre…

  • Medium max 4.0
    ELSA-2026-26567 2 CVEs

    Moderate: libexif security update (Oracle Linux 7)

    [0.6.22-2.0.1] - Backport fix for CVE-2026-40386 [Orabug: 39574457] - Backport fix for CVE-2026-40385 [Orabug: 39574457]

  • High max 7.8
    ELSA-2026-50388 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.357.3.2] - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso) [Orabug: 39706958] - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39706958] {CVE-2026-43499} [5.4.17-2136.357…

  • High max 9.6
    ELSA-2026-35830 1 CVE

    Important: grafana security update (Oracle Linux 8)

    [9.2.10-31.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-31] - Resolves RHEL-183728: CVE-2026-39821

  • High max 8.8
    ELSA-2026-36366 1 CVE

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.141.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 5.4
    ELSA-2026-35839 1 CVE

    Important: libreoffice security update (Oracle Linux 8)

    [6.4.7.2-21.0.1] - Replace colors with Oracle colors [Orabug: 32120093] - Build with --with-vendor='Oracle America, Inc.' - Added the --with-hamcrest option to configure. - Remove Red Hat branding - Change vendor to RESF [1:6.4.7.2-21] - Fix CVE-2026-8357 buf…

  • High max 9.1
    ELSA-2026-37123 7 CVEs

    Important: podman security, bug fix, and enhancement update (Oracle Linux 9)

    [5.8.2-4.0.1] - Rework CNI/Netavark detection logic [JIRA: EVG-3769] - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.8.2-4] - bump to upstream commi…

  • High max 9.1
    ELSA-2026-37410 2 CVEs

    Important: buildah security update (Oracle Linux 9)

    [1.43.1-3.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.43.1-3] - bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-39832 and CVE-2026-39835 - Resolves: RHEL-188733 RHEL-190066

  • High max 7.8
    ELSA-2026-50387 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-322.203.3.3] - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso) [Orabug: 39706512] - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39706512] {CVE-2026-43499} [5.15.0-322.203.3…

  • High max 7.7
    ELSA-2026-37207 1 CVE

    Important: freerdp security update (Oracle Linux 9)

    [2:2.11.7-7.4] - Fix incorrect bounds checks in planar codec (CVE-2026-45700) Resolves: RHEL-186991

  • High max 9.6
    ELSA-2026-37435 2 CVEs

    Important: golang security, bug fix, and enhancement update (Oracle Linux 9)

    [1.26.5-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.5-1] - Update to Go 1.26.5 (fips-1) - Resolves: RHEL-193476 [1.25.7-1] - Update to Go 1.25.7 (fips-1) - Resolves: RHEL-146452 [1.25.5-1] - Update to Go 1.25.5 (fips-1) - Resolves: RHE…

  • High max 8.8
    ELSA-2026-36957 3 CVEs

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-687.24.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 5.4
    ELSA-2026-36832 1 CVE

    Important: libreoffice security update (Oracle Linux 9)

    [1:7.1.8.1-15.0.1.el9_8.2] - Added the --with-hamcrest option to configure. - Replace colors with Oracle colors [Orabug: 32120093] [1:7.1.8.1-15.el9_8.2] - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: …

  • High max 8.5
    ELSA-2026-22456 6 CVEs

    Important: tigervnc security update (Oracle Linux 7)

    [1.8.0-33.0.11] - Fix CVE-2026-33999, CVE-2026-34000, CVE-2026-34001, CVE-2026-34002, CVE-2026-34003 and CVE-2026-34352 [Orabug: 39478221] [1.8.0-33.0.9] - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation [Orabug: 3869…

  • High max 8.8
    ELSA-2026-37130 2 CVEs

    Important: gstreamer1-plugins-bad-free security update (Oracle Linux 8)

    [1.16.1-8.0.1] - Update origin URL [Orabug: 36209826] [1.16.1-8] - Fix for CVE-2026-52720: librfb framebuffer update rectangle validation Resolves: RHEL-184455 [1.16.1-7] - Fix integer overflow in vmncdec (CVE-2026-52722) Resolves: RHEL-184414

  • High max 7.5
    ELSA-2026-37137 2 CVEs 1 exploited

    Important: tomcat security, bug fix, and enhancement update (Oracle Linux 8)

    [1:9.0.87-2] - Resolves: RHEL-183993 Remove tomcat clustering JAR from RPM builds

  • High max 6.9
    ELSA-2026-37282 4 CVEs

    Important: unbound security update (Oracle Linux 8)

    [1.16.2-5.12] - Fix CVE-2026-40622 (RHEL-184832) - Fix CVE-2026-44390 (RHEL-186680) - Fix CVE-2026-41292 (RHEL-187346) - Fix CVE-2026-42534 (RHEL-187081)

  • High max 8.1
    ELSA-2026-36618 1 CVE

    Important: nginx:1.24 security, bug fix, and enhancement update (Oracle Linux 9)

    [1.24.0-7.0.1.3] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-7.3] - Resolves: RHEL-191773 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes - Resolves: RHEL-188413 -…

  • High max 8.1
    ELSA-2026-36639 1 CVE

    Important: nginx:1.26 security, bug fix, and enhancement update (Oracle Linux 9)

    [1.26.3-9.0.1.2] - Require oracle-indexhtml [2:1.26.3-12] - Resolves: RHEL-191774 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes [2:1.26.3-11] - nginx:1.26/nginx: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style at…

  • High max 6.9
    ELSA-2026-36777 4 CVEs

    Important: unbound security update (Oracle Linux 9)

    [1.24.2-3.2] - Fix CVE-2026-40622 (RHEL-184840) Fix CVE-2026-44390 (RHEL-186688) Fix CVE-2026-41292 (RHEL-187352) Fix CVE-2026-42534 (RHEL-187095)