Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

Medium max 4.0

ELSA-2026-22553 2 CVEs

Moderate: libexif security update (Oracle Linux 9)

[0.6.22-6.1] - Fix integer underflow in MakerNote decoding (CVE-2026-40386) - Fix integer overflow in Nikon MakerNote handling (CVE-2026-40385) Resolves: RHEL-170253, RHEL-170234

Jun 23, 2026
High max 7.5

ELSA-2026-24368 2 CVEs

Important: bind9.18 security update (Oracle Linux 9)

[32:9.18.29-14.2] - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946)

Jun 23, 2026
High max 9.1

ELSA-2026-24369 3 CVEs

Important: unbound security update (Oracle Linux 9)

[1.24.2-3.1] - Fix CVE-2026-33278 (RHEL-177822) Fix CVE-2026-42944 (RHEL-177936) Fix CVE-2026-42959 (RHEL-177797) [1.24.2-3] - Install correct trust anchor source in Image Mode (RHEL-127540)

Jun 23, 2026
Critical max 8.1

ELSA-2026-19371 1 CVE

Critical: nginx:1.24 security update (Oracle Linux 9)

[1.24.0-7.1.0.1] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-7.1] - Resolves: RHEL-176234 - nginx:1.24/nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) [1:1.24.0…

Jun 23, 2026
High max 7.5

ELSA-2026-22121 11 CVEs

Important: golang security update (Oracle Linux 9)

[1.26.3-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.3-1] - Update to Go 1.26.3 (fips-1) - Resolves: RHEL-175607

Jun 23, 2026
High max 7.3

ELSA-2026-22143 4 CVEs

Important: php:8.2 security update (Oracle Linux 9)

php [8.2.31-1] - rebase to 8.2.31 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd [2.0.3-4] - build for PHP 8.1 #2070040 [2.0.3-3] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 [2.0.3-2] - Rebuilt for …

Jun 23, 2026
High max 2.9

ELSA-2026-23230 1 CVE

Important: expat security update (Oracle Linux 9)

[2.5.0-6.1] - Fix CVE-2026-45186 - Resolves: RHEL-177988

Jun 23, 2026
Critical max 9.0

ELSA-2026-25049 6 CVEs

Critical: samba security update (Oracle Linux 9)

[0:4.23.5-10] - Bump build number [0:4.23.5-9] - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHE…

Jun 23, 2026
High max 7.5

ELSA-2026-25057 1 CVE

Important: mod_http2 security update (Oracle Linux 9)

[2.0.26-6.1] - Resolves: RHEL-182417 - mod_http2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) [2.0.26-6] - Resolves: RHEL-166293 - httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)

Jun 23, 2026
High max 7.8

ELSA-2026-25058 1 CVE

Important: poppler security update (Oracle Linux 9)

[21.01.0-24.el9_8.1] - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Resolves: RHEL-180580

Jun 23, 2026
High max 7.7

ELSA-2026-25219 3 CVEs

Important: redis:7 security update (Oracle Linux 9)

[7.2.14-1.0.1] - Build with 64k pages to support redis on UEK on aarch64 [7.2.14-1] - rebase to 7.2.14 for CVE-2026-23479 CVE-2026-25243 CVE-2026-23631

Jun 23, 2026
High max 7.5

ELSA-2026-25220 2 CVEs

Important: .NET 8.0 security update (Oracle Linux 9)

[8.0.128-1.0.1] - Add support for Oracle Linux [8.0.128-1] - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181055 [8.0.127-1] - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173923

Jun 23, 2026
High max 7.5

ELSA-2026-25221 2 CVEs

Important: .NET 9.0 security update (Oracle Linux 9)

[9.0.118-1.0.1] - Add support for Oracle Linux [9.0.118-1] - Update to .NET SDK 9.0.118 and Runtime 9.0.17 - Resolves: RHEL-181553 [9.0.117-1] - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173918

Jun 23, 2026
High max 7.5

ELSA-2026-25222 2 CVEs

Important: .NET 10.0 security update (Oracle Linux 9)

[10.0.109-1.0.1] - Add support for Oracle Linux [10.0.109-1] - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181558 [10.0.108-1] - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173910

Jun 23, 2026
High max 8.8

ELSA-2026-25927 16 CVEs

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.52.4-1] - Update to 2.52.4

Jun 23, 2026
High max 3.7

ELSA-2026-26205 1 CVE

Important: postfix security update (Oracle Linux 9)

[2:3.5.25-3] - Fix for CVE-2026-43964: buffer over-read via malformed enhanced status code. Resolves: RHEL-176550

Jun 23, 2026
High max 7.4

ELSA-2026-26206 1 CVE

Important: fence-agents security update (Oracle Linux 9)

[4.10.0-110.3] - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182313 [4.10.0-110.2] - bundled pyasn1: fix CVE-2026-30922 Resolves: RHEL-157202 [4.10.0-110.1] - bundled cryptography: replace with dependency to fix CVE-2026-26007 - bun…

Jun 23, 2026
High max 5.1

ELSA-2026-19367 1 CVE

Important: giflib update (Oracle Linux 9)

[5.2.1-10.1] - rebuild [5.2.1-10] - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154864)

Jun 23, 2026
High max 7.5

ELSA-2026-22304 1 CVE

Important: postgresql-jdbc security update (Oracle Linux 9)

[42.2.28-2.2] - Add tests for CVE-2026-42198 [42.2.28-2.1] - Fix CVE-2026-42198: limit SCRAM PBKDF2 iterations to prevent DoS - Resolves: RHEL-173489

Jun 23, 2026
High max 9.3

ELSA-2026-26297 2 CVEs

Important: hplip security update (Oracle Linux 9)

[3.21.2-6.4] - Fix more leaks in hpcups [3.21.2-6.3] - OSH fixes after CVE-2026-8631 [3.21.2-6.2] - CVE-2026-8631 hplip: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups [3.21.2-6.1] - CVE-2026-8632 hplip: Privilege esca…

Jun 23, 2026
High max 7.4

ELSA-2026-26323 1 CVE

Important: tomcat security update (Oracle Linux 9)

[1:9.0.117-1] - Resolves: RHEL-150714 Certificate revocation bypass due to improper OCSP response validation - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVE-2026-34500) - Resolves: Tomcat: Cloud membership for…

Jun 23, 2026
High max 8.1

ELSA-2026-26410 2 CVEs

Important: rsync security update (Oracle Linux 9)

[3.2.5-7.2] - Fix integer overflow in compressed-token decoding (CVE-2026-43618) - Resolves: RHEL-174932 [3.2.5-7.1] - Fix TOCTOU symlink race in daemon no-chroot mode (CVE-2026-29518) - Resolves: RHEL-174952 [3.2.5-4] - Resolves: RHEL-104404 - Do not clear D…

Jun 23, 2026
High max 7.5

ELSA-2026-26447 3 CVEs

Important: podman security update (Oracle Linux 9)

[5.8.2-3.0.1] - Rework CNI/Netavark detection logic [JIRA: EVG-3769] - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.8.2-3] - Rebuild for CVE-2026-3…

Jun 23, 2026
High max 7.5

ELSA-2026-26455 1 CVE

Important: 389-ds-base security, bug fix, and enhancement update (Oracle Linux 9)

[2.8.0-7] - Resolves: RHEL-152356 - Getting 'build_candidate_list - Database error 11' messages after migrating to LMDB. [rhel-9.8.z] - Resolves: RHEL-168967 - Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. [rhel-9.8.z] - Resol…

Jun 23, 2026
High max 7.8

ELSA-2026-26590 9 CVEs

Important: xorg-x11-server-Xwayland security, bug fix, and enhancement update (Oracle Linux 9)

[24.1.9-4.2] - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184292 [24.1.9-4.1] - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263 Re…

Jun 23, 2026
High max 7.8

ELSA-2026-26610 9 CVEs

Important: xorg-x11-server security, bug fix, and enhancement update (Oracle Linux 9)

[1.20.11-34.2] - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184288 [1.20.11-34.1] - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-5026…

Jun 23, 2026
High max 9.6

ELSA-2026-27734 29 CVEs

Important: firefox security update (Oracle Linux 9)

[140.12.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.12.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

Jun 23, 2026
High max 8.4

ELSA-2026-27819 1 CVE

Important: evince security update (Oracle Linux 9)

[40.5-4.el9_8.1] - Sanitize arguments (CVE-2026-46529) - Resolves: RHEL-184047

Jun 23, 2026
High max 8.1

ELSA-2026-27862 1 CVE

Important: memcached security update (Oracle Linux 9)

[0:1.6.9-7.1] - Fix timing side-channel in SASL password database authentication (CVE-2026-47783) - Resolves: RHEL-179093

Jun 23, 2026
High max 7.5

ELSA-2026-28074 3 CVEs

Important: skopeo security update (Oracle Linux 9)

[1:1.22.2-6] - Rebuild for CVE-2026-32283 - Resolves: RHEL-167688 [1:1.22.2-5] - Rebuild for CVE-2026-25679 - Re-add test file installation to fix tier0 tests - Resolves: RHEL-158789

Jun 23, 2026
High max 8.9

ELSA-2026-28159 2 CVEs

Important: python3.12-urllib3 security update (Oracle Linux 9)

[1.26.19-3] - Security fix for CVE-2026-44431 - Security fix for CVE-2026-44432 Resolves: RHEL-184901, RHEL-185126 [1.26.19-2] - Security fix for CVE-2025-66471 - Security fix for CVE-2025-66418 - Security fix for CVE-2026-21441 Resolves: RHEL-142909, RHEL-13…

Jun 23, 2026
Medium max 6.6

ELSA-2026-28209 1 CVE

Moderate: vim security update (Oracle Linux 9)

[8.2.2637-26.0.1.el9_8.6] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-26.6] - CVE-2026-41411 vim: Command injection via backticks in tag files [2:8.2.2637-26.5] - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via…

Jun 23, 2026
Medium max 5.9

ELSA-2026-18693 1 CVE

Moderate: python3.9 security update (Oracle Linux 9)

[3.9.25-7.0.1] - Remove upstream URL reference [3.9.25-7] - Security fixes for CVE-2026-4786 and CVE-2026-6100 Resolves: RHEL-167919, RHEL-168161 [3.9.25-6] - Security fix for CVE-2026-4519 Resolves: RHEL-158117 [3.9.25-5] - Rebuilding previous fixes for diff…

Jun 23, 2026
High max 6.7

ELSA-2026-19346 1 CVE

Important: libcap security update (Oracle Linux 9)

[2.48-10.1] - Fix TOCTOU race condition in cap_set_file() (CVE-2026-4878) Resolves: RHEL-169312

Jun 23, 2026
High max 8.9

ELSA-2026-28157 2 CVEs

Important: python3.14-urllib3 security update (Oracle Linux 9)

[2.6.3-2] - Security fix for CVE-2026-44431 and CVE-2026-44432 - Resolves: RHEL-184902 - Resolves: RHEL-185127

Jun 23, 2026
Medium max 5.5

ELSA-2026-28243 1 CVE

Moderate: libxslt security update (Oracle Linux 9)

[1.1.34-14.0.1.el9_8.1] - Fix memory leak in exclPrefixPush [Orabug: 37871881] - Added libxslt-oracle-enterprise.patch and replaced doc/redhat.gif in tarball [1.1.34-14.1] - Fix CVE-2025-10911 (RHEL-171991) [1.1.34-14.1] - Fix upgrade path for CVE-2023-40403 …

Jun 23, 2026
Medium max 7.5

ELSA-2026-28244 1 CVE

Moderate: libpng15 security update (Oracle Linux 9)

[1.5.30-15.1] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161449) [1.5.30-15] - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148412)

Jun 23, 2026
High max 5.9

ELSA-2026-19357 2 CVEs

Important: krb5 security update (Oracle Linux 9)

[1.21.1-10.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767] [1.21.1-10] - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356) Resolves: RHEL-171590 RHEL-171596

Jun 23, 2026
Low max 7.5

ELSA-2026-28253 1 CVE

Low: libtasn1 security update (Oracle Linux 9)

[4.16.0-10] - Backport the fix for CVE-2025-13151 (RHEL-139568)

Jun 23, 2026
Low max 7.5

ELSA-2026-28254 1 CVE

Low: libxml2 security update (Oracle Linux 9)

[2.9.13-14.1] - Fix CVE-2024-34459 (RHEL-177882)

Jun 23, 2026