Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

  • High max 9.3
    ELSA-2026-19033 23 CVEs

    Important: freerdp security update (Oracle Linux 10)

    [2:3.10.3-12.2] - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 [2:3.10.3-12.1] - Rebuilt for errata Resolves: RHEL-155980 [2:3.10.3-12] - Fix u…

  • Medium max 8.7
    ELSA-2026-19034 2 CVEs

    Moderate: python-tornado security update (Oracle Linux 10)

    [6.5.5-1] - Update to 6.5.5 Resolves: RHEL-160935

  • High max 9.8
    ELSA-2026-19041 25 CVEs

    Important: firefox security update (Oracle Linux 10)

    [140.10.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

  • Low max 5.3
    ELSA-2026-19042 1 CVE

    Low: python-jwcrypto security update (Oracle Linux 10)

    [1.5.6-5] - Fix CVE-2026-39373: Memory exhaustion via crafted compressed JWE tokens

  • Medium max 8.2
    ELSA-2026-19043 2 CVEs

    Moderate: corosync security update (Oracle Linux 10)

    [3.1.10-1.1] - Resolves: RHEL-163802 - Resolves: RHEL-163823 - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091) - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092) [3.1.10-1] - Resolves: RHEL-122945 - New upstream re…

  • High max 7.5
    ELSA-2026-19049 2 CVEs

    Important: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

    [0.9.27-6] - rebuilt to fix CVE-2026-27137, CVE-2026-25679 - fixed rebuild problem with redundant condition check in quirks.empty()

  • Medium max 7.5
    ELSA-2026-19053 1 CVE

    Moderate: freeipmi security update (Oracle Linux 10)

    [1.6.17-1] - Update to 1.6.17

  • High max 7.4
    ELSA-2026-19054 1 CVE

    Important: tomcat security update (Oracle Linux 10)

    [1:10.1.36-3.el10_1.1] - Resolves: RHEL-150719 Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) [1:10.1.49-1] - Resolves: RHEL-150099 Rebase tomcat package to enable PQC features [1:10.1.36-4] - Resolves: RHEL-124493 tom…

  • Medium max 7.5
    ELSA-2026-19061 2 CVEs

    Moderate: glibc security update (Oracle Linux 10)

    [2.39-121.0.1] - Forward port Oracle changes to 2.39-121. - Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: April-2-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.39-113.0.1 - Reverted to version 2.39-113. - Reviewed-by: David Fau…

  • High max 9.1
    ELSA-2026-19064 12 CVEs

    Important: python3.12 security update (Oracle Linux 10)

    [3.12.13-2.0.1] - Remove upstream URL reference [3.12.13-2] - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 [3.12.13-1] - Update to 3.12.13 - Security fixes for C…

  • Medium max 7.5
    ELSA-2026-19066 1 CVE

    Moderate: openssl security update (Oracle Linux 10)

    [3.5.5-2.0.1] - Replace upstream references [Orabug: 34340177] - Update FIPS provider name [Orabug: 35824276] [1:3.5.5-2] - Fix CVE-2026-31790 Resolves: RHEL-161574 [1:3.5.5-1] - Rebase to OpenSSL 3.5.5 Resolves: RHEL-122599 Resolves: RHEL-141987 Resolves: RH…

  • High max 7.4
    ELSA-2026-19067 1 CVE

    Important: sudo security update (Oracle Linux 10)

    [1.9.17-4.p2] - Bump release number - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation due to failure in privilege drop calls [1.9.17-3.p2] - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation due to failure in priv…

  • Medium max 5.5
    ELSA-2026-19068 1 CVE

    Moderate: systemd security update (Oracle Linux 10)

    [257-23.0.1.el10_2.1] - Fix detection of Oracle Virtualization or BM envs [Orabug: 37531877] - Avoid udevadm warnings when using udev valid configs [Orabug: 37503197] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - set 'RemoveIPC=no' in l…

  • High max 7.5
    ELSA-2026-19069 5 CVEs

    Important: openssh security update (Oracle Linux 10)

    [9.9p1-23.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-23] - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164739 - CVE-2026-35388: Add connection multiplexing …

  • High max 8.2
    ELSA-2026-19073 1 CVE

    Important: vim security update (Oracle Linux 10)

    [9.1.083-9.0.1.el10_2.2] - Remove upstream references [Orabug: 31197557] [2:9.1.083-9.2] - Resolves: RHEL-164952 vim: arbitrary command execution via modeline sandbox bypass [2:9.1.083-9.1] - RHEL-159616 CVE-2026-33412 vim: Vim: Arbitrary code execution via c…

  • High max 8.8
    ELSA-2026-19074 4 CVEs 1 exploited

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-211.7.3.el10_2.OL10] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK…

  • High max 9.6
    ELSA-2026-35831 1 CVE

    Important: grafana-pcp security update (Oracle Linux 8)

    [5.1.1-16] - Resolves RHEL-183733: CVE-2026-39821 [5.1.1-15] - Resolves RHEL-183733: CVE-2026-39821

  • High max 8.8
    ELSA-2026-36215 1 CVE

    Important: compat-openssl10 security update (Oracle Linux 8)

    [1.1.0-2o-4.3] - Fix CVE-2026-45447: Fix double-free of caller-owned BIO in PKCS7_verify

  • Medium max 7.5
    ELSA-2026-36307 1 CVE

    Moderate: freeipmi security update (Oracle Linux 8)

    [1.6.18-1] - Update to 1.6.18, fixes CVE-2026-50031

  • High max 9.1
    ELSA-2026-35833 5 CVEs

    Important: container-tools:ol8 security update (Oracle Linux 8)

    aardvark-dns [2:1.10.1-2] - build off the RHEL maintenance branch - Resolves: RHEL-59129 [2:1.10.0-1] - update to https://github.com/containers/aardvark-dns/releases/tag/v1.10.0 - Related: Jira:RHEL-2110 [2:1.9.0-1] - update to https://github.com/containers/a…

  • High max 9.1
    ELSA-2026-36188 1 CVE

    Important: perl-HTTP-Daemon security update (Oracle Linux 8)

    [6.01-24] - Fix CVE-2026-8450: send_file() shell-magic injection via 2-arg open() - Resolves: RHEL-184825

  • High max 9.6
    ELSA-2026-35828 1 CVE

    Important: grafana security update (Oracle Linux 9)

    [10.2.6-23] - Resolves RHEL-183803: CVE-2026-39821 - Resolves RHEL-188280

  • High max 9.6
    ELSA-2026-35829 1 CVE

    Important: grafana-pcp security update (Oracle Linux 9)

    [5.1.1-17] - Resolves RHEL-183820: CVE-2026-39821 - Resolves RHEL-188285 [5.1.1-16] - Resolves RHEL-183820: CVE-2026-39821

  • High max 9.1
    ELSA-2026-36187 1 CVE

    Important: perl-HTTP-Daemon security update (Oracle Linux 9)

    [6.12-6.1] - Fix CVE-2026-8450: send_file() shell-magic injection via 2-arg open() - Resolves: RHEL-184829

  • High max 8.8
    ELSA-2026-36195 2 CVEs

    Important: 389-ds-base security update (Oracle Linux 9)

    [2.8.0-8] - Resolves: RHEL-182159 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-9.8.z] - Resolves: RHEL-183103 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length b…

  • Medium max 7.5
    ELSA-2026-36210 1 CVE

    Moderate: freeipmi security update (Oracle Linux 9)

    [1.6.18-1] - Update to 1.6.18, fixes CVE-2026-50031

  • High max 8.8
    ELSA-2026-26204 4 CVEs

    Important: postgresql:18 security update (Oracle Linux 9)

    pgaudit [18.0-1] - Update to 18.0 - Initial import for postgresql18 pg_repack [1.5.3-1] - Update to 1.5.3 - Initial import for postgresql18 [1.5.1-1] - Update to v1.5.1 [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604…

  • High max 9.8
    ELSA-2026-30848 8 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.19.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 4.1
    ELSA-2026-36315 1 CVE

    Important: python3.14-pip security update (Oracle Linux 9)

    [25.2-5] - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pip_install_upgrade to run pip-3.14 - fix bash completion + remove unused metadata file [25.2-4] - Security fix for CVE-2026-8643: path traversal in wheel ent…

  • High max 7.5
    ELSA-2026-36317 2 CVEs

    Important: skopeo security update (Oracle Linux 9)

    [1:1.22.2-7] - Rebuild for golang >= 1.26.4 to fix CVE-2026-27145 - Resolves: RHEL-189898

  • Medium max 6.2
    ELSA-2026-36318 1 CVE

    Moderate: aardvark-dns security update (Oracle Linux 9)

    [2:1.17.1-1] - update to https://github.com/containers/aardvark-dns/releases/tag/v1.17.1 - Resolves: RHEL-170152

  • Medium max 9.1
    ELSA-2026-50379 15 CVEs

    Moderate: openssl security update (Oracle Linux 9)

    [3.5.5-4.0.1_fips] - Replace upstream references in fips man pages [Orabug: 35824276] - Update additional upstream references - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824…

  • High max 7.7
    ELSA-2026-35891 15 CVEs

    Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 9)

    nodejs [1:24.18.0-1] - Update to version 24.18.0 nodejs-nodemon [3.0.3-3] - Keep BR on just npm [3.0.3-2] - Fix BR for nodejs-npm nodejs-packaging [2021.06-6] - Properly handle @group/package deps in nodejs-symlink-deps Resolves: RHEL-121569 [2021.06-5] - nod…

  • High max 9.8
    ELSA-2026-50374 8 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.357.3.1] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug: 39673892] - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson) [Orabug: 39673892] - KVM: x86/MMU: Recursivel…

  • High max 9.8
    ELSA-2026-50373 6 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-322.203.3.2] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Sean Christopherson) [Orabug: 39673886] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug: 39673886] - KVM: x86: Fi…

  • High max 7.6
    ELSA-2026-33514 2 CVEs

    Important: ruby:2.5 security update (Oracle Linux 8)

    ruby [2.5.9-114] - Fix integer overflow in search_in_range function in regexec.c (CVE-2019-19012). Resolves: RHEL-87505 rubygem-abrt [0.3.0-4] - Execute test suite unconditionally. - Upload correct sources. rubygem-bson [4.3.0-2] - Rebuilt for https://fedorap…

  • High max 9.5
    ELSA-2026-34354 6 CVEs

    Important: php:7.4 security update (Oracle Linux 8)

    libzip [1.6.1-1] - update to 1.6.1 - enable lzma support php [7.4.33-4] - Fix XSS within status endpoint CVE-2026-6735 - Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map CVE-2026-6722 - Fix Use-after-free after header parsing failure with SOAP_PERSISTEN…

  • High max 9.5
    ELSA-2026-33449 7 CVEs

    Important: php security update (Oracle Linux 9)

    [8.0.30-6] - Fix XSS within status endpoint CVE-2026-6735 - Fix Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() CVE-2026-7259 - Fix Stale SOAP_GLOBAL(ref_map) pointer with Apache Map CVE-2026-6722 - Fix Use-after-free after heade…

  • High max 10.0
    ELSA-2026-33482 1 CVE

    Important: mariadb:10.11 security, bug fix, and enhancement update (Oracle Linux 9)

    galera [26.4.20-1.0.1] - Drop nmap-ncat requirement. [Orabug: 34116228] - Requirement to delete garbd-wrapper script and lp1184034 test case without using patches. [Orabug: 34116228] [26.4.20-1] - Rebase to 26.4.20 [26.4.19-1] - Rebase to 26.4.19 [26.4.18-1] …

  • High max 7.6
    ELSA-2026-33576 3 CVEs

    Important: ruby:3.3 security update (Oracle Linux 9)

    ruby [3.3.10-7] - Fix DoS via crafted IMAP responses in net-imap. (CVE-2026-42245) Resolves: RHEL-181693 - Fix information disclosure via MITM attack bypassing TLS in net-imap. (CVE-2026-42246) Resolves: RHEL-181779 - Fix command injection via Symbol argument…