Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

Medium max 6.8

ELSA-2026-28256 1 CVE

Moderate: opencryptoki security update (Oracle Linux 9)

[3.26.0-2.2] - Resolves: RHEL-171562, Fix CVE-2026-40253, possible out-of-bounds access in BER decode functions [3.26.0-2.1] - Resolves: RHEL-169586, Fix syslog message printing about different CPs

Jun 23, 2026
Medium max 6.5

ELSA-2026-19361 2 CVEs

Moderate: glib2 security update (Oracle Linux 9)

[2.68.4-19.1] - Add patch for CVE-2025-14087 and CVE-2025-14512

Jun 23, 2026
Medium max 4.1

ELSA-2026-22717 1 CVE

Moderate: vim security update (Oracle Linux 9)

[8.2.2637-26.0.1.el9_8.5] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-26.5] - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass [2:8.2.2637-26.4] - Resolves: RHEL-164966 vim: arbitrary comma…

Jun 23, 2026
High max 7.5

ELSA-2026-24367 2 CVEs

Important: bind security update (Oracle Linux 9)

[9.16.23-40.0.1.el9_8.2] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-40.2] - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946) [32:9.16.23-40.1] - Prevent Denial of Service via m…

Jun 23, 2026
High max 7.5

ELSA-2026-24371 1 CVE

Important: frr security update (Oracle Linux 9)

[8.5.3-13] - Resolves: RHEL-174677 - denial of service via crafted FlowSpec component

Jun 23, 2026
High max 9.1

ELSA-2026-25239 15 CVEs

Important: openssl security update (Oracle Linux 9)

[3.5.5-4.0.1] - Replace upstream references [Orabug: 34340177] [3.5.5.openela.0.1] - Add OpenELA specific changes [1:3.5.5-4] - Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, C…

Jun 23, 2026
Medium max 7.6

ELSA-2026-28255 2 CVEs

Moderate: libpng security update (Oracle Linux 9)

[2:1.6.37-15.2] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161448) [2:1.6.37-15.1] - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon (RHEL-161299)

Jun 23, 2026
Medium max 7.5

ELSA-2026-20597 3 CVEs

Moderate: glibc security update (Oracle Linux 9)

[2.34-270.0.1] - Forward-port Oracle patches for ol9-u8 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Oracle history: May-20-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-266.0.1 - Forward-port Oracle patches for ol9-u8 Reviewed-by: …

Jun 23, 2026
High max 7.3

ELSA-2026-22142 4 CVEs

Important: php:8.3 security update (Oracle Linux 9)

php [8.3.31-2] - drop capstone dependency on i686 [8.3.31-1] - rebase to 8.3.31 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 [5.1.21-1] - update to 5.1.21 for PHP 8.1 #2070040 php-pecl-redis6 [6.1.0-2] - ignore 1 ONLINE test [6.1.0-1] - …

Jun 23, 2026
High max 9.8

ELSA-2026-27789 17 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.17.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Jun 23, 2026
High max 7.5

ELSA-2026-25051 1 CVE

Important: libyang security update (Oracle Linux 9)

[2.1.148-1.1] - Fix integer overflow and OOM in LYB parser string/value reading - Resolves: RHEL-177019

Jun 23, 2026
High max 9.6

ELSA-2026-27717 29 CVEs

Important: firefox security update (Oracle Linux 8)

[140.12.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.12.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.12.0-1] - …

Jun 22, 2026
High max 9.8

ELSA-2026-27353 8 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.136.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Jun 22, 2026
High max 8.8

ELSA-2026-27738 4 CVEs

Important: libpq security update (Oracle Linux 8)

[13.23-2] - Backport fixes for CVE-2026-6478, CVE-2026-6637, CVE-2026-6477, CVE-2026-6475, CVE-2026-6473 from PostgreSQL 14.23 - Resolves: RHEL-179806

Jun 22, 2026
High max 7.7

ELSA-2026-26008 1 CVE

Important: redis:6 security update (Oracle Linux 8)

[6.2.22-1.0.1] - Build with 64k pages to support redis on both UEK6 and UEK7 on aarch64 [6.2.22-1] - rebase to 6.2.22 for CVE-2026-25243

Jun 19, 2026
High max 8.8

ELSA-2026-26181 2 CVEs

Important: postgresql:15 security update (Oracle Linux 8)

pgaudit [1.7.0-1] - Update to 1.7.0 - Support postgresql 15 - Related: #2128241 [1.5.0-1] - Update to version 1.5.0 Related: #1855776 [1.4.0-4] - Bump release for rebuild against libpq-12.1-3 [1.4.0-3] - BuildRequires libpq-devel [1.4.0-2] - BuildRequires pos…

Jun 19, 2026
High max 7.5

ELSA-2026-22468 1 CVE

Important: openssh security update (Oracle Linux 7)

[7.4p1-23.0.5] - Fix privilege escalation via scp legacy protocol when not in preserving file mode [CVE-2026-35385][Orabug: 39480251]

Jun 18, 2026
High max 7.5

ELSA-2026-26459 1 CVE

Important: 389-ds:1.4 security update (Oracle Linux 8)

[1.4.3.39-24] - Bump version to 1.4.3.39-24 - Resolves: RHEL-170278 - Memory leaks in syncrepl plugin during persistent search operations [rhel-8.10.z] - Resolves: RHEL-163375 - WARN - keys2idl - received NULL idl from index_read_ext_allids - Resolves: RHEL-1…

Jun 18, 2026
High max 7.5

ELSA-2026-25090 1 CVE

Important: httpd:2.4 security update (Oracle Linux 8)

httpd [2.4.37-65.0.1.8] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-65.8] - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) - Resol…

Jun 17, 2026
High max 7.8

ELSA-2026-26562 9 CVEs

Important: xorg-x11-server-Xwayland security, bug fix, and enhancement update (Oracle Linux 8)

[21.1.3-20.2] - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184293 [21.1.3-20.1] - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263 …

Jun 17, 2026
High max 7.8

ELSA-2026-26709 9 CVEs

Important: xorg-x11-server security, bug fix, and enhancement update (Oracle Linux 8)

[1.20.11-28.2] - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184289 [1.20.11-28.1] - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-5026…

Jun 17, 2026
High max 9.8

ELSA-2026-26427 8 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.134.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Jun 17, 2026
High max 7.5

ELSA-2026-26534 1 CVE

Important: dracut security update (Oracle Linux 8)

[049-244.git20260529.0.1] - Refactor get_ucode_file [Orabug: 36989953] - Revert the fixes for bugs 33676753 and 33888951 due to regressions [Orabug: 35656614] - Fix typo in orabug33888951-dracut-Enable-the-code-to-create-ifcfg-file.patch [Orabug: 35268918] - …

Jun 17, 2026
High max 3.7

ELSA-2026-25932 1 CVE

Important: postfix security update (Oracle Linux 8)

[2:3.5.8-8] - Fix for CVE-2026-43964: buffer over-read via malformed enhanced status code. Resolves: RHEL-176548

Jun 16, 2026
High max 9.8

ELSA-2026-26275 2 CVEs

Important: openssl security update (Oracle Linux 8)

[1:1.1.1k-16] - Fix CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() Resolves: RHEL-180978 - Fix CVE-2024-4741: Use After Free with SSL_free_buffers Resolves: RHEL-180983

Jun 16, 2026
Medium max 7.5

ELSA-2026-26347 1 CVE

Moderate: libpng15 security update (Oracle Linux 8)

[1.5.30-9] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161346)

Jun 16, 2026
Medium max 7.5

ELSA-2026-26348 1 CVE

Moderate: libpng12 security update (Oracle Linux 8)

[1.2.57-7] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161345)

Jun 16, 2026
Medium max 6.8

ELSA-2026-26352 1 CVE

Moderate: opencryptoki security update (Oracle Linux 8)

[3.22.0-3.3] - Resolves: RHEL-171558, Fix possible out-of-bounds access in BER decode functions

Jun 16, 2026
Low max 7.5

ELSA-2026-26354 1 CVE

Low: libxml2 security update (Oracle Linux 8)

[2.9.7-21.5] - Fix CVE-2024-34459 (RHEL-36405)

Jun 16, 2026
Medium max 5.5

ELSA-2026-26355 1 CVE

Moderate: libxslt security update (Oracle Linux 8)

[1.1.32-6.4.0.1] - Added libxslt-oracle-enterprise.patch and replaced doc/redhat.gif in tarball [1.1.32-6.4] - Fix CVE-2025-10911 (RHEL-171739)

Jun 16, 2026
High max 8.1

ELSA-2026-26408 2 CVEs

Important: rsync security update (Oracle Linux 8)

[3.1.3-27] - Integer overflow in compressed-token decoding (CVE-2026-43618) - Resolves: RHEL-174951 [3.1.3-26] - Resolves: RHEL-174950 - CVE-2026-29518 - TOCTOU symlink race in non-chrooted daemon modules

Jun 16, 2026
High max 9.3

ELSA-2026-26335 2 CVEs

Important: hplip security update (Oracle Linux 8)

[3.18.4-13] - Fix more leaks in hpcups [3.18.4-12] - OSH fixes after CVE-2026-8631 [3.18.4-11] - CVE-2026-8631 hplip: Arbitrary code execution and privilege escalation via integer overflow in hpcups [3.18.4-10] - CVE-2026-8632 hplip: Privilege escalation and …

Jun 16, 2026
High max 9.8

ELSA-2026-50319 10 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-203.76.7.5] - uek-rpm: avoid final module link in early FIPS symvers pass (Sherry Yang) [Orabug: 39563330] - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Pablo Neira Ayuso) [Orabug: 39562729] {CVE-2026-23272} [6.12.0-203.76…

Jun 16, 2026
High max 9.6

ELSA-2026-22708 4 CVEs

Important: firefox security update (Oracle Linux 7)

[140.10.1-1.0.1] - Update to 140.10.1 ESR [Orabug: 39481850][CVE-2026-7320][CVE-2026-7321] [CVE-2026-7322][CVE-2026-7323] [140.10.0-1.0.1] - Update to 140.10.0 ESR [Orabug: 39499844][CVE-2026-6746][CVE-2026-6747] [CVE-2026-6748][CVE-2026-6749][CVE-2026-6750][…

Jun 15, 2026
High max 8.8

ELSA-2026-7850 3 CVEs

Important: gstreamer-plugins-base and gstreamer-plugins-good security update (Oracle Linux 7)

gstreamer-plugins-base [0.10.36-10.0.1] - Security update CVE-2026-2921 [Orabug: 39201593] gstreamer-plugins-good [0.10.31-13.0.1] - Security update for CVE-2026-3083 CVE-2026-3085 [Orabug: 39199326]

Jun 15, 2026
High max 9.8

ELSA-2026-19704 26 CVEs 1 exploited

Important: firefox security update (Oracle Linux 7)

[140.10.0-1.0.1] - Update to 140.10.0 ESR [Orabug: 39499844][CVE-2026-6746][CVE-2026-6747] [CVE-2026-6748][CVE-2026-6749][CVE-2026-6750][CVE-2026-6751][CVE-2026-6752] [CVE-2026-6753][CVE-2026-6754][CVE-2026-6757][CVE-2026-6759][CVE-2026-6761] [CVE-2026-6762][…

Jun 15, 2026
High max 8.8

ELSA-2026-25918 16 CVEs

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.52.4-1] - Update to 2.52.4

Jun 15, 2026
Critical max 9.8

ELSA-2026-25121 13 CVEs

Critical: kernel security update (Oracle Linux 8)

[4.18.0-553.132.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Jun 15, 2026
High max 9.8

ELSA-2026-50318 5 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-321.202.5.2] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Muhammad Alifa Ramdhan) [Orabug: 39543209] {CVE-2026-31533} - net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich) [Orabug: 39543208] {CVE-2…

Jun 15, 2026
Medium max 8.6

ELSA-2026-19182 1 CVE

Moderate: mariadb:11.8 security update (Oracle Linux 9)

galera [26.4.25-1.0.1] - Drop nmap-ncat requirement. [Orabug: 34116228] - Requirement to delete lp1184034 test case without using patches. [26.4.25-1] - Rebased to 26.4.25 [26.4.24-1] - Rebase to 26.4.24 [26.4.23-1] - Rebase to 26.4.23 mariadb [3:11.8.6-2] - …

Jun 15, 2026