Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

  • Medium max 5.9
    ELSA-2026-18957 1 CVE

    Moderate: python3.11 security update (Oracle Linux 9)

    [3.11.13-10.0.1] - Remove upstream URL reference [Orabug: 36073032] [3.11.13-10] - Depend on sqlite-libs with (de)serialize API Resolves: RHEL-178519

  • Medium max 5.9
    ELSA-2026-18958 1 CVE

    Moderate: python3.12 security update (Oracle Linux 9)

    [3.12.13-3.0.1] - Remove upstream URL reference [3.12.13-3] - Depend on sqlite-libs with (de)serialize API Resolves: RHEL-180474

  • High max 9.8
    ELSA-2026-19568 17 CVEs 1 exploited

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-687.17.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 9.8
    ELSA-2026-21556 20 CVEs

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-687.17.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 8.8
    ELSA-2026-27741 4 CVEs

    Important: postgresql security update (Oracle Linux 9)

    [13.23-3] - Backport fix for CVE-2026-6478 from PostgreSQL 14.23 - Backport fixes for CVE-2026-6637, CVE-2026-6477, CVE-2026-6475, CVE-2026-6473 - Resolves: RHEL-179799 - Resolves: RHEL-181866 - Resolves: RHEL-181950 - Resolves: RHEL-181964

  • High max 8.1
    ELSA-2026-28973 1 CVE

    Important: nginx security update (Oracle Linux 9)

    [2:1.20.1-28.0.1.el9_8.3] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] - Update upstream references [Orabug: 36579090] [2:1.20.1-28.3] - Resolves: RHEL-178684 - nginx: code execution and denial…

  • High max 7.8
    ELSA-2026-50353 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.356.4.3] - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug: 39639989] {CVE-2026-52943} Credit Statement: The following people reported security vulnerabilities addressed by this ELSA to Oracle: Minh Nguyen …

  • High max 7.8
    ELSA-2026-50352 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-321.202.5.3] - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug: 39639981] {CVE-2026-52943} Credit Statement: The following people reported security vulnerabilities addressed by this ELSA to Oracle: Minh Nguyen <…

  • High max 7.8
    ELSA-2026-50351 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-203.76.7.6] - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug: 39639984] {CVE-2026-52943} Credit Statement: The following people reported security vulnerabilities addressed by this ELSA to Oracle: Minh Nguyen <m…

  • Medium max 5.4
    ELSA-2026-28922 1 CVE

    Moderate: libreoffice security update (Oracle Linux 8)

    [1:6.4.7.2-20.0.1] - Replace colors with Oracle colors [Orabug: 32120093] - Build with --with-vendor='Oracle America, Inc.' - Added the --with-hamcrest option to configure. [1:6.4.7.2-20] - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.1…

  • Medium max 5.3
    ELSA-2026-29981 1 CVE

    Moderate: golang security, bug fix, and enhancement update (Oracle Linux 9)

    [1.26.4-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.4-1] - Update to Go 1.26.4 (fips-1) - Resolves: RHEL-183349

  • High max 8.1
    ELSA-2026-18722 1 CVE

    Important: podman security update (Oracle Linux 9)

    [5.8.2-3.0.1] - Rework CNI/Netavark detection logic [JIRA: EVG-3769] - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.8.2-3] - Rebuild for CVE-2026-3…

  • High max 7.8
    ELSA-2026-19343 3 CVEs

    Important: xorg-x11-server security update (Oracle Linux 9)

    [1.20.11-34.2] - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184288 [1.20.11-34.1] - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-5026…

  • High max 7.8
    ELSA-2026-19344 3 CVEs

    Important: xorg-x11-server-Xwayland security update (Oracle Linux 9)

    [24.1.9-4.2] - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184292 [24.1.9-4.1] - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263 Re…

  • High max 9.8
    ELSA-2026-19348 29 CVEs

    Important: thunderbird security update (Oracle Linux 9)

    [140.11.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.11.0] - Add OpenELA debranding [140.11.0-1] - Update to 140.11.0 ESR [140.10.1-1] - Update to 140.10.1 ESR

  • High max 7.5
    ELSA-2026-19349 2 CVEs

    Important: freerdp security update (Oracle Linux 9)

    [2:2.11.7-7.3] - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159860 [2:2.11.7-7.2] - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix growth of preallocated buffers (CVE-2026-27951) - Fix heap-buffe…

  • High max 8.2
    ELSA-2026-19355 3 CVEs

    Important: fence-agents security update (Oracle Linux 9)

    [4.10.0-110.3] - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182313 [4.10.0-110.2] - bundled pyasn1: fix CVE-2026-30922 Resolves: RHEL-157202 [4.10.0-110.1] - bundled cryptography: replace with dependency to fix CVE-2026-26007 - bun…

  • High max 7.5
    ELSA-2026-21293 2 CVEs

    Important: .NET 8.0 security update (Oracle Linux 9)

    [8.0.128-1.0.1] - Add support for Oracle Linux [8.0.128-1] - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181055 [8.0.127-1] - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173923

  • High max 7.5
    ELSA-2026-21296 1 CVE

    Important: .NET 9.0 security update (Oracle Linux 9)

    [9.0.118-1.0.1] - Add support for Oracle Linux [9.0.118-1] - Update to .NET SDK 9.0.118 and Runtime 9.0.17 - Resolves: RHEL-181553 [9.0.117-1] - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173918

  • High max 7.5
    ELSA-2026-21297 1 CVE

    Important: .NET 10.0 security update (Oracle Linux 9)

    [10.0.109-1.0.1] - Add support for Oracle Linux [10.0.109-1] - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181558 [10.0.108-1] - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173910

  • Medium max 7.5
    ELSA-2026-22551 1 CVE

    Moderate: mod_http2 security update (Oracle Linux 9)

    [2.0.26-6.1] - Resolves: RHEL-182417 - mod_http2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) [2.0.26-6] - Resolves: RHEL-166293 - httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)

  • High max 7.5
    ELSA-2026-26445 1 CVE

    Important: podman security update (Oracle Linux 9)

    [5.8.2-3.0.1] - Rework CNI/Netavark detection logic [JIRA: EVG-3769] - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.8.2-3] - Rebuild for CVE-2026-3…

  • High max 9.6
    ELSA-2026-29940 29 CVEs

    Important: thunderbird security update (Oracle Linux 9)

    [140.12.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.12.0] - Add OpenELA debranding [140.12.0-1] - Update to 140.12.0 ESR

  • Medium max 6.5
    ELSA-2026-23332 22 CVEs

    Moderate: mysql security update (Oracle Linux 9)

    [8.0.46-1] - Rebase to 8.0.46 [8.0.45-2] - Revert to soft static allocation of MariaDB and MySQL sysusers.d files

  • High max 7.5
    ELSA-2026-50325 1 CVE

    Important: openssh security update (Oracle Linux 7)

    [7.4p1-23.0.5_fips] - Fix privilege escalation via scp legacy protocol when not in preserving file mode [CVE-2026-35385][Orabug: 39480251] [7.4p1-23.0.3_fips] - Change Epoch from 1 to 10 - Enable fips KDF POST [Orabug: 32461750] - Disable diffie-hellman-group…

  • High max 8.8
    ELSA-2026-28999 2 CVEs

    Important: postgresql:12 security update (Oracle Linux 8)

    [12.22-6.0.1] - Add backport of CVE-2025-8714 [Orabug: 38667546] [12.22-6] - Fix CVE-2026-2004 CVE-2026-2005 CVE-2026-2006 [12.22-5] - Fix previous Backport [12.22-4] - Backport CVE-2025-8715 [12.22-3] - Fix backport for CVE-2025-1094 [12.22-2] - Backport fix…

  • Medium max 7.5
    ELSA-2026-29898 1 CVE

    Moderate: libpng security update (Oracle Linux 8)

    [2:1.6.37-11] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161344)

  • Medium max 4.4
    ELSA-2026-28911 1 CVE

    Moderate: coreutils security update (Oracle Linux 9)

    [8.32-41.0.1] - clean up empty file if cp is failed [Orabug 15973168] [9.5-8] - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification (RHEL-180331)

  • High max 8.1
    ELSA-2026-29151 1 CVE

    Important: nginx:1.26 security update (Oracle Linux 9)

    [1.26.3-9.0.1.1] - Require oracle-indexhtml [2:1.26.3-11] - nginx:1.26/nginx: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack [2:1.26.3-10] - nginx: code execution and denial of service (CVE-2026-9256) [2:1.26.3-9] - Resolves:…

  • High max 9.1
    ELSA-2026-29455 6 CVEs

    Important: buildah security update (Oracle Linux 9)

    [1.43.1-2.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [102:1.43.1-2] - Rebuild for CVE-2026-25679 - Resolves: RHEL-158759

  • High max 7.5
    ELSA-2026-29702 3 CVEs

    Important: runc security update (Oracle Linux 9)

    [4:1.4.2-2] - Rebuild for CVE-2026-25679 - Resolves: RHEL-158787

  • High max 7.5
    ELSA-2026-29703 4 CVEs

    Important: containernetworking-plugins security update (Oracle Linux 9)

    [1:1.9.0-3] - Rebuild for CVE-2026-25679 - Resolves: RHEL-158763

  • High max 7.8
    ELSA-2026-29844 9 CVEs

    Important: tigervnc security update (Oracle Linux 9)

    [1.15.0-7.2] - Rebuild for updated xorg-x11-server Resolves: RHEL-184003

  • High max 7.0
    ELSA-2026-28247 2 CVEs

    Important: python3.14 security, bug fix, and enhancement update (Oracle Linux 9)

    [3.14.5-1] - Update to 3.14.5 Resolves: RHEL-180642 [3.14.5~rc1-1] - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-180642 [3.14.4-3] - Depend on sqlite-libs with (de)…

  • Medium max 6.6
    ELSA-2026-28553 1 CVE

    Moderate: vim security update (Oracle Linux 8)

    [8.0.1763-24.0.1] - Remove upstream references [Orabug: 31197557] - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984] [2:8.0.1763-24] - CVE-2026-41411 vim: Command injection via backticks in tag files

  • High max 8.1
    ELSA-2026-28921 1 CVE

    Important: nginx:1.24 security update (Oracle Linux 8)

    [1.24.0-3.0.1.2] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-3.2] - Resolves: RHEL-178676 - nginx:1.24/nginx: code execution and denial of service (CVE-2026-9256) - Resolves: RHEL-182543 - nginx: HTTP/2: Remote Denial of Service via compression b…

  • High max 7.8
    ELSA-2026-28923 9 CVEs

    Important: tigervnc security update (Oracle Linux 8)

    [1.15.0-10] - Rebuild for updated xorg-x11-server Resolves: RHEL-183998

  • High max 8.4
    ELSA-2026-28998 1 CVE

    Important: evince security update (Oracle Linux 8)

    [3.28.4-17] - Fix CVE-2026-46529: quote string arguments passed to ev_spawn - Resolves: RHEL-184039

  • High max 6.5
    ELSA-2026-28208 1 CVE

    Important: postgresql:13 security update (Oracle Linux 8)

    pgaudit [1.5.0-1] - Update to version 1.5.0 Related: #1855776 [1.4.0-4] - Bump release for rebuild against libpq-12.1-3 [1.4.0-3] - BuildRequires libpq-devel [1.4.0-2] - BuildRequires postgresql-server-devel [1.4.0-1] - Update to 1.4.0 [1.3.1-1] - Update to 1…

  • Medium max 1.7
    ELSA-2026-50324 1 CVE

    Moderate: pyOpenSSL security update (Oracle Linux 9)

    [19.0.0-1.0.3] - Backport CVE-2026-27448 [Orabug: 39565553]