8,314 results · Feed
-
High max 8.9ELSA-2026-28158 2 CVEs
Important: python-urllib3 security update (Oracle Linux 9)
[1.26.5-8] - Security fix for CVE-2026-44431 and CVE-2026-44432 Resolves: RHEL-184816, RHEL-185123 [1.26.5-7] - Security fix for CVE-2025-66471 - Security fix for CVE-2025-66418 - Security fix for CVE-2026-21441 Resolves: RHEL-142750, RHEL-139398, RHEL-142767
-
High max 7.7ELSA-2026-25925 3 CVEs
Important: valkey security update (Oracle Linux 9)
[8.0.9-1] - Rebase to 8.0.9 for CVE-2026-23479 CVE-2026-25243 CVE-2026-23631
-
High max 8.8ELSA-2026-28037 4 CVEs
Important: postgresql:15 security update (Oracle Linux 9)
pgaudit [1.7.0-1] - Initial import for postgresql 15 module - Update to 1.7.0 - Support postgresql 15 - Related: #2128410 pg_repack [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47350 [1.4.8-1] - Update to version 1.4.8 …
-
High max 8.8ELSA-2026-26203 4 CVEs
Important: postgresql:16 security update (Oracle Linux 9)
pgaudit [16.0-1] - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3635 pg_repack [1.5.1-1] - Update to v1.5.1 [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604 [1.4.8-1] - Res…
-
High max 7.7ELSA-2026-23229 1 CVE
Important: redis security update (Oracle Linux 9)
[6.2.22-1] - rebase to 6.2.22 for CVE-2026-25243
-
High max 7.5ELSA-2026-24370 2 CVEs
Important: frr10 security update (Oracle Linux 9)
[10.4.3-3] - Resolves: RHEL-174696 - denial of service via crafted BGP UPDATE message [10.4.3-2] - Resolves: RHEL-174678 - denial of service via crafted FlowSpec component
-
Medium max 6.5ELSA-2026-25052 19 CVEs
Moderate: mysql:8.4 security update (Oracle Linux 9)
mecab [0.996-3.4] - Bump version for package rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'CRB' repo - Resolves: #2182069 [0.996-3.3] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 [0.996-3.2] - Rebuilt…
-
High max 7.5ELSA-2026-26533 1 CVE
Important: dracut security update (Oracle Linux 9)
[057-115.git20260527.0.1] - Skip the default FIPS logic on special UEK kernels where the FIPS module is linked directly into the kernel. [Orabug: 38705580] - Ship Oracle IMA certificate [Orabug: 35992862] - Ship 98-integrity.conf, populating initramfs with Or…
-
Critical max 8.1ELSA-2026-19372 1 CVE
Critical: nginx:1.26 security update (Oracle Linux 9)
[1.26.3-9.0.1] - Require oracle-indexhtml [2:1.26.3-9] - Resolves: RHEL-176218 - nginx:1.26/nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) [2:1.26.3-8] - CVE-2026-32647 nginx:1.26/nginx: NGINX: Denial of Service or Code Execution via sp…
-
High max 8.2ELSA-2026-20612 13 CVEs
Important: gnutls security update (Oracle Linux 9)
[3.8.10-4] - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite) - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour) - Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread) - Fix CVE-2026-42010 (PSK authenti…
-
Medium max 7.5ELSA-2026-50345 1 CVE
Moderate: openssl security fix update (Oracle Linux 9)
[3.5.5-3.0.1] - Replace upstream references in fips man pages [Orabug: 35824276] - Update additional upstream references - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824276] …
-
High max 8.2ELSA-2026-50346 13 CVEs
Important: gnutls security fix update (Oracle Linux 9)
[3.8.10-4_fips] - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35925409] - Update FIPS module name for Oracle Linux [Orabug: 35925409] [3.8.10-4] - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite) - Fix C…
-
High max 8.3ELSA-2026-20596 2 CVEs
Important: ruby:4.0 security update (Oracle Linux 9)
ruby [4.0.3-32] - Upgrade to Ruby 4.0.3. Resolves: RHEL-171933 - Fix ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) Resolves: RHEL-171258 - Fix JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-…
-
Medium max 6.5ELSA-2026-26180 19 CVEs
Moderate: mysql:8.4 security update (Oracle Linux 8)
mecab [0.996-2.12] - Bump version for 'mysql' module rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'AppStream' repo - Resolves: #2180411 [0.996-2] - Rebuild to fix the issue described in #2000986 - Resolves: #2000986 [0.996-1.9]…
-
High max 8.8ELSA-2026-28143 2 CVEs
Important: postgresql:16 security update (Oracle Linux 8)
pgaudit [16.0-1] - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3636 pg_repack [1.5.1-1] - Update to 1.5.1 postgres-decoderbufs [2.4.0-1.Final] - Initial import for postgresql 16 stream - Related: RHEL-3636 postgre…
-
High max 7.1ELSA-2026-27811 1 CVE
Important: kernel security update (Oracle Linux 8)
[4.18.0-553.137.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […
-
High max 8.2ELSA-2026-50337 2 CVEs
Important: virt:kvm_utils3 security update (Oracle Linux 8)
hivex [1.3.18-23] - Limit recursion in ri-records (CVE-2021-3622) resolves: rhbz#1976194 [1.3.18-22.el8] - Resolves: bz#2000225 (Rebase virt:rhel module:stream based on AV-8.6) [1.3.18-21] - Bounds check for block exceeding page length (CVE-2021-3504) resolve…
-
Medium max 6.5ELSA-2026-25919 22 CVEs
Moderate: mysql:8.0 security update (Oracle Linux 8)
mecab [0.996-2.12] - Bump version for 'mysql' module rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'AppStream' repo - Resolves: #2180411 [0.996-2] - Rebuild to fix the issue described in #2000986 - Resolves: #2000986 [0.996-1.9]…
-
High max 8.5ELSA-2026-19342 5 CVEs
Important: tigervnc security update (Oracle Linux 9)
[1.15.0-7.1] - Fix CVE-2026-33999, CVE-2026-34000, CVE-2026-34001, CVE-2026-34002, CVE-2026-34003 xorg-x11-server: various XKB and XSYNC vulnerabilities Resolves: RHEL-163213 Resolves: RHEL-163281 Resolves: RHEL-163267 - Fix CVE-2026-34352 Resolves: RHEL-1679…
-
High max 7.5ELSA-2026-19350 4 CVEs
Important: git-lfs security update (Oracle Linux 9)
[3.7.1-4] - Rebuild with new Golang - Resolves: RHEL-158765, RHEL-166675, RHEL-167677, RHEL-170838
-
High max 7.5ELSA-2026-19351 2 CVEs
Important: grafana-pcp security update (Oracle Linux 9)
[5.1.1-15] - Resolves RHEL-166679: CVE-2026-32282 - Resolves RHEL-167679: CVE-2026-32283
-
High max 7.5ELSA-2026-19352 3 CVEs
Important: grafana security update (Oracle Linux 9)
[10.2.6-22] - Resolves RHEL-161803: CVE-2026-27877 - Resolves RHEL-166678: CVE-2026-32282 - Resolves RHEL-167678: CVE-2026-32283
-
Medium max 5.9ELSA-2026-19356 1 CVE
Moderate: libsoup security update (Oracle Linux 9)
[2.72.0-16.1] - Backport patch for CVE-2026-5119 [2.72.0-16] - Backport patch for CVE-2026-1761 [2.72.0-15] - Backport patch for CVE-2026-0719 - Fix NTLM authentication test failures in FIPS mode [2.72.0-14] - Backport patch for CVE-2025-14523 [2.72.0-13] - B…
-
High max 7.8ELSA-2026-19362 6 CVEs
Important: gimp security update (Oracle Linux 9)
[2:3.0.4-4.4] - fix CVE-2026-4150 - align with Y-stream - fix CVE-2026-4151 - fix CVE-2026-4152 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887 [2:3.0.4-4.3] - fix CVE-2026-4150 - Resolves: RHEL-167738
-
High max 7.8ELSA-2026-19363 1 CVE
Important: libtiff security update (Oracle Linux 9)
[4.4.0-18] - rebuild [4.4.0-15.3] - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159331)
-
High max 8.2ELSA-2026-20568 2 CVEs
Important: jmc security update (Oracle Linux 9)
[8.2.0-5] - Remove the websocket plugin. Related: RHEL-168615 [8.2.0-4] - Bump LZ4 Version to 1.10.2. Related: RHEL-135478
-
High max 8.4ELSA-2026-19373 5 CVEs
Important: dnsmasq security update (Oracle Linux 9)
[2.85-18.1] - Prevent overflow in extract_name function (CVE-2026-2291) - Prevent DoS in DNSSEC validation (CVE-2026-4890) - Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891) - Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892) - Preve…
-
Critical max 8.1ELSA-2026-19374 1 CVE
Critical: nginx security update (Oracle Linux 9)
[1.20.1-28.0.1.el9_8.2] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] - Update upstream references [Orabug: 36579090] [2:1.20.1-28.2] - Resolves: RHEL-176232 - nginx: NGINX: Arbitrary Code Execu…
-
High max 7.5ELSA-2026-19610 1 CVE
Important: libsndfile security update (Oracle Linux 9)
[1.0.32-9.1] - apply patch for CVE-2026-37555 Resolves: ?RHEL-174543
-
High max 8.1ELSA-2026-19167 1 CVE
Important: pcs security update (Oracle Linux 9)
[0.11.11-2.el9_8.1] - Fixed CVE-2026-4800 by updating pcs-web-ui to 0.1.24.3 Resolves: RHEL-164206
-
Medium max 6.5ELSA-2026-19358 8 CVEs
Moderate: freerdp security update (Oracle Linux 9)
[2:2.11.7-7.3] - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159860 [2:2.11.7-7.2] - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix growth of preallocated buffers (CVE-2026-27951) - Fix heap-buffe…
-
High max 8.6ELSA-2026-19359 1 CVE
Important: openexr security update (Oracle Linux 9)
[3.1.1-3.2] - fix CVE-2026-34588
-
High max 7.5ELSA-2026-19364 3 CVEs
Important: dovecot security update (Oracle Linux 9)
[1:2.3.16-18] - rebuild [1:2.3.16-17] - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161640) - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162288) …
-
High max 7.5ELSA-2026-19365 2 CVEs
Important: jq security update (Oracle Linux 9)
[1.6-19.2] - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions - Resolves: RHEL-168185 [1.6-19.1] - Fix CVE-2026-39979 out-of-bounds read in jv_parse_sized() - Resolves: RHEL-168202
-
High max 7.5ELSA-2026-19366 1 CVE
Important: python-markdown security update (Oracle Linux 9)
[3.3.4-4.2] - Fix CVE-2025-69534 (RHEL-153747)
-
High max 9.8ELSA-2026-21381 19 CVEs
Important: thunderbird security update (Oracle Linux 9)
[140.11.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.11.0] - Add OpenELA debranding [140.11.0-1] - Update to 140.11.0 ESR [140.10.1-1] - Update to 140.10.1 ESR
-
High max 9.8ELSA-2026-21391 5 CVEs
Important: httpd security update (Oracle Linux 9)
[2.4.62-13.0.1.el9_8.1] - Replace index.html with Oracle's index page oracle_index.html. [2.4.62-13.1] - Resolves: RHEL-173555 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) - Resolves: RHEL…
-
High max 8.0ELSA-2026-21468 1 CVE
Important: cockpit security update (Oracle Linux 9)
[356.2-1.0.1] - Apply the patch for duplicate reference [Orabug: 39250109] - Storage: Enable btrfs support [Orabug: 37464632] - Replaced upstream urls in documentation with oracle links [Orabug: 36528753] - Drop subscription-manager-cockpit requirement for ol…
-
High max 9.3ELSA-2026-21755 2 CVEs
Important: flatpak security update (Oracle Linux 9)
[1.12.9-4.1] - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165643 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170171
-
Medium max 7.5ELSA-2026-22313 1 CVE
Moderate: compat-openssl11 security update (Oracle Linux 9)
[1:1.1.1k-5.3] - Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing Resolves: RHEL-165863