Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

High max 10.0

ELSA-2026-33481 1 CVE

Important: mariadb:11.8 security, bug fix, and enhancement update (Oracle Linux 9)

galera [26.4.27-1.0.1] - Drop nmap-ncat requirement. [Orabug: 34116228] - Requirement to delete lp1184034 test case without using patches. [26.4.27-1] - Rebased to 26.4.27 [26.4.26-1] - Rebased to 26.4.26 mariadb [3:11.8.8-1] - Rebase to 11.8.8 [3:11.8.7-1] -…

Jul 2, 2026
High max 9.8

ELSA-2026-50372 822 CVEs 2 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-204.92.4.2] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug: 39673880] - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) {CVE-2026-46331} - net_sched: act_pedit: use RCU in tc…

Jul 2, 2026
Medium max 5.6

ELSA-2026-19566 1 CVE

Moderate: glib2 security update (Oracle Linux 7)

[2.56.1-9.0.5] - Fixes CVE-2025-14078 gvariant parser buffer underflow [Orabug: 39418716] [2.56.1-9.0.3] - Fixes CVE-2025-13601 g_escape_uri_string() overflow [Orabug: 38909821] [2.56.1-9.0.1] - Fix overflow of GDBusConnection serial [Orabug: 38666376]

Jul 1, 2026
Medium max 6.5

ELSA-2026-20546 8 CVEs

Moderate: freerdp security update (Oracle Linux 7)

[2.1.1-5.0.9] - Fixed CVE-2026-25952 CVE-2026-26986 CVE-2026-27951 CVE-2026-29775 CVE-2026-31883 CVE-2026-31884 CVE-2026-31885 CVE-2026-33985 [Orabug: 39440279] [2.1.1-5.0.7] - Fixed CVE-2026-22852 CVE-2026-22854 CVE-2026-22856 CVE-2026-23732 CVE-2026-23948 C…

Jul 1, 2026
High max 7.6

ELSA-2026-33515 3 CVEs

Important: ruby:3.3 security update (Oracle Linux 8)

ruby [3.3.10-7] - Fix DoS via crafted IMAP responses in net-imap. (CVE-2026-42245) Resolves: RHEL-181682 - Fix information disclosure via MITM attack bypassing TLS in net-imap. (CVE-2026-42246) Resolves: RHEL-181759 - Fix command injection via Symbol argument…

Jul 1, 2026
Medium max 7.8

ELSA-2026-34155 1 CVE

Moderate: rrdtool security update (Oracle Linux 8)

[1.7.0-17] - Fixed stack buffer overflow in rrdcached and added more security checks Resolves: RHEL-173259

Jul 1, 2026
High max 7.5

ELSA-2026-33722 5 CVEs

Important: container-tools:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

aardvark-dns [2:1.10.1-2] - build off the RHEL maintenance branch - Resolves: RHEL-59129 buildah [2:1.33.14-3] - rebuild for CVE-2025-68121 - Resolves: RHEL-149262 cockpit-podman [84.1-1] - update to https://github.com/cockpit-project/cockpit-podman/releases/…

Jul 1, 2026
High max 8.2

ELSA-2026-33501 1 CVE

Important: giflib security update (Oracle Linux 9)

[5.2.1-10.2] - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157133)

Jul 1, 2026
Medium max 7.8

ELSA-2026-34156 1 CVE

Moderate: rrdtool security update (Oracle Linux 9)

[1.7.2-22] - Fixed stack buffer overflow in rrdcached and added more security checks Resolves: RHEL-173257

Jul 1, 2026
High max 7.6

ELSA-2026-33577 3 CVEs

Important: ruby:4.0 security update (Oracle Linux 9)

ruby [4.0.3-33] - Fix Net::IMAP ResponseReader quadratic complexity vulnerability. (CVE-2026-42245) Resolves: RHEL-181690 - Fix Net::IMAP STARTTLS stripping vulnerability. (CVE-2026-42246) Resolves: RHEL-181771 - Fix Net::IMAP command injection vulnerability …

Jul 1, 2026
High max 9.1

ELSA-2026-30851 2 CVEs

Important: perl:5.32 security update (Oracle Linux 8)

perl [4:5.32.1-474] - Resolves: RHEL-153834 - Fix CVE-2025-40909 - Clone dirhandles without fchdir perl-Algorithm-Diff [1.1903-10] - Rebuild with enable hardening (bug #1636329) perl-Archive-Tar [2.38-4] - Fix CVE-2026-42496: validate symlink and hardlink tar…

Jun 30, 2026
High max 9.6

ELSA-2026-33445 29 CVEs

Important: thunderbird security update (Oracle Linux 8)

[140.12.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.12.0] - Add OpenELA debranding [140.12.0-1] - Update to 140.12.0 ESR

Jun 30, 2026
High max 10.0

ELSA-2026-33464 1 CVE

Important: mariadb:10.11 security, bug fix, and enhancement update (Oracle Linux 8)

galera [26.4.27-1] - Rebased to 26.4.27 [26.4.26-1] - Rebased to 26.4.26 [26.4.25-1] - Rebased to 26.4.25 [26.4.24-1] - Rebase to 26.4.24 Judy [1.0.5-18] - Remove README.Fedora; no longer needed since 1.0.5 version - Resolves: #1638717 [1.0.5-17] - ldconfig s…

Jun 30, 2026
High max 8.2

ELSA-2026-33503 1 CVE

Important: giflib security update (Oracle Linux 8)

[5.1.4-5] - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157097)

Jun 30, 2026
Medium max 5.5

ELSA-2026-18748 1 CVE

Moderate: libvirt security update (Oracle Linux 9)

[11.10.0-12.3.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] [11.10.0-12.3.el9_8] - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-178822) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-178822) - qemu: Move domain caps flags ha…

Jun 30, 2026
Medium max 5.4

ELSA-2026-28290 1 CVE

Moderate: libreoffice security update (Oracle Linux 9)

[1:7.1.8.1-15.0.1.el9_8.1] - Added the --with-hamcrest option to configure. - Replace colors with Oracle colors [Orabug: 32120093] [1:7.1.8.1-15.el9_8.1] - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL…

Jun 30, 2026
Medium max 9.8

ELSA-2026-33226 1 CVE

Moderate: glibc security, bug fix, and enhancement update (Oracle Linux 9)

[2.34-272.0.1] - Forward-port Oracle patches for ol9-u8 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: June-5-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-270.0.1 - Fo…

Jun 30, 2026
High max 7.0

ELSA-2026-19589 1 CVE

Important: python security update (Oracle Linux 7)

[2.7.5-94.0.9] - Fix for CVE-2026-4786 [Orabug: 39418723] [2.7.5-94.0.7] - Fix for CVE-2026-4519 [Orabug: 39243798] [2.7.5-94.0.5] - Fix for CVE-2025-15366 and CVE-2025-15367 [Orabug: 39114639] [2.7.5-94.0.3] - Fix for CVE-2025-12084 [Orabug: 38902314]

Jun 29, 2026
Medium max 6.2

ELSA-2026-22420 1 CVE

Moderate: libxml2 security update (Oracle Linux 7)

[2.9.1-6.0.13.6] - Backport fix for CVE-2025-9714 [Orabug: 39476695] [2.9.1-6.0.11.6] - Fix CVE-2025-32415: Fix heap buffer overflow [Orabug: 38310750] [2.9.1-6.0.9.6] - Fix CVE-2025-7425: heap-use-after-free in xmlFreeID [Orabug: 38290330] [2.9.1-6.0.7.6] - …

Jun 29, 2026
Medium max 5.9

ELSA-2026-24722 1 CVE

Moderate: libsoup security update (Oracle Linux 7)

[2.62.2-2.0.13] - Backport fix for CVE-2026-5119 [Orabug: 39527088] [2.62.2-2.0.11] - Fixes CVE-2026-0719 CVE-2026-1761 [Orabug: 38958074] [2.62.2-2.0.9] - Fix CVE-2025-14523 [Orabug: 38873507] [2.62.2-2.0.7] - Backport patch for CVE-2025-4945 and CVE-2025-11…

Jun 29, 2026
High max 9.8

ELSA-2026-24983 3 CVEs

Important: firefox security update (Oracle Linux 7)

[140.10.2-1.0.1] - Update to 140.10.2 ESR [Orabug: 39534787][CVE-2026-8090][CVE-2026-8092] [CVE-2026-8094] [140.10.1-1.0.1] - Update to 140.10.1 ESR [Orabug: 39481850][CVE-2026-7320][CVE-2026-7321] [CVE-2026-7322][CVE-2026-7323] [140.10.0-1.0.1] - Update to 1…

Jun 29, 2026
High max 9.8

ELSA-2026-26551 18 CVEs

Important: firefox security update (Oracle Linux 7)

[140.11.0-1.0.1] - Update to 140.11.0 ESR [Orabug: 39573358] [140.10.2-1.0.1] - Update to 140.10.2 ESR [Orabug: 39534787][CVE-2026-8090][CVE-2026-8092] [CVE-2026-8094] [140.10.1-1.0.1] - Update to 140.10.1 ESR [Orabug: 39481850][CVE-2026-7320][CVE-2026-7321] …

Jun 29, 2026
High max 9.1

ELSA-2026-30852 1 CVE

Important: perl-Archive-Tar security update (Oracle Linux 8)

[2.30-2] - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode - Resolves: RHEL-181654 [2.30-1] - 2.30 bump [2.28-1] - 2.28 bump - Fixes CVE-2018-12015 (directory traversal) (bug #1588761) [2.26-6] - Do not run optional test on RH…

Jun 29, 2026
High max 9.6

ELSA-2026-30853 1 CVE

Important: git-lfs security update (Oracle Linux 8)

[3.4.1-11] - Backport CVE-2026-39821 fix (vendored golang.org/x/net IDNA) - Resolves: RHEL-183731

Jun 29, 2026
High max 7.3

ELSA-2026-30858 1 CVE

Important: perl-IO-Compress security update (Oracle Linux 8)

[2.081-2] - Remove use of eval in File::GlobMapper for safer string interpolation - Resolves: RHEL-180411

Jun 29, 2026
High max 8.9

ELSA-2026-32992 2 CVEs

Important: python3.12-urllib3 security update (Oracle Linux 8)

[1.26.19-3] - Security fixes for CVE-2026-44431 and CVE-2026-44432 Resolves: RHEL-185125, RHEL-184900

Jun 29, 2026
High max 9.6

ELSA-2026-18916 3 CVEs

Important: tomcat security update (Oracle Linux 9)

[1:9.0.117-1] - Resolves: RHEL-150714 Certificate revocation bypass due to improper OCSP response validation - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVE-2026-34500) - Resolves: Tomcat: Cloud membership for…

Jun 29, 2026
Medium max 7.3

ELSA-2026-30844 1 CVE

Moderate: mod_md security update (Oracle Linux 9)

[1:2.4.26-2.1] - Resolves: RHEL-175644 - mod_md: OCSP response limits (CVE-2026-29168) [1:2.4.26-2] - Resolves: RHEL-134497 - httpd: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)

Jun 29, 2026
High max 7.4

ELSA-2026-19368 2 CVEs

Important: rsync security update (Oracle Linux 9)

[3.2.5-7.2] - Fix integer overflow in compressed-token decoding (CVE-2026-43618) - Resolves: RHEL-174932 [3.2.5-7.1] - Fix TOCTOU symlink race in daemon no-chroot mode (CVE-2026-29518) - Resolves: RHEL-174952 [3.2.5-4] - Resolves: RHEL-104404 - Do not clear D…

Jun 29, 2026
High max 9.6

ELSA-2026-19370 4 CVEs

Important: firefox security update (Oracle Linux 9)

[140.12.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.12.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

Jun 29, 2026
High max 9.8

ELSA-2026-20574 3 CVEs

Important: firefox security update (Oracle Linux 9)

[140.12.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.12.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

Jun 29, 2026
High max 9.8

ELSA-2026-21378 18 CVEs

Important: firefox security update (Oracle Linux 9)

[140.12.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.12.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

Jun 29, 2026
Medium max 7.5

ELSA-2026-22312 1 CVE

Moderate: openssl security update (Oracle Linux 9)

[3.5.5-4.0.1] - Replace upstream references [Orabug: 34340177] [3.5.5.openela.0.1] - Add OpenELA specific changes [1:3.5.5-4] - Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, C…

Jun 29, 2026
High max 8.1

ELSA-2026-24381 3 CVEs

Important: kernel security update (Oracle Linux 9)

[5.14.0-687.17.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Jun 29, 2026
High max 9.8

ELSA-2026-25217 11 CVEs

Important: kernel security update (Oracle Linux 9)

[5.14.0-687.17.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Jun 29, 2026
High max 8.1

ELSA-2026-28212 1 CVE

Important: nginx:1.24 security update (Oracle Linux 9)

[1.24.0-7.0.1.2] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-7.2] - Resolves: RHEL-178681 - nginx:1.24/nginx: code execution and denial of service (CVE-2026-9256) - Resolves: RHEL-18…

Jun 29, 2026
High max 9.6

ELSA-2026-30854 1 CVE

Important: git-lfs security update (Oracle Linux 9)

[3.7.1-4.1] - Fix CVE-2026-39821: vendored golang.org/x/net/idna ToUnicode incorrectly accepting all-ASCII xn-- labels - Resolves: RHEL-183797

Jun 29, 2026
High max 9.1

ELSA-2026-30856 1 CVE

Important: perl-Archive-Tar security update (Oracle Linux 9)

[2.38-6.1] - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode - Resolves: RHEL-181662

Jun 29, 2026
High max 7.3

ELSA-2026-30859 1 CVE

Important: perl-IO-Compress security update (Oracle Linux 9)

[2.102-4.1] - Fix CVE-2026-48962: remove use of eval in File::GlobMapper - Resolves: RHEL-180418

Jun 29, 2026
Medium max 7.8

ELSA-2026-18587 14 CVEs

Moderate: kernel security update (Oracle Linux 9)

[5.14.0-687.17.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Jun 29, 2026