Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

  • High max 10.0
    ELSA-2026-3984 38 CVEs

    Important: firefox security update (Oracle Linux 7)

    [140.8.0-2.0.1] - Update to 140.8.0 ESR [Orabug: 39361647][CVE-2026-2447][CVE-2026-2757] [CVE-2026-2758][CVE-2026-2759][CVE-2026-2760][CVE-2026-2761][CVE-2026-2762] [CVE-2026-2763][CVE-2026-2764][CVE-2026-2765][CVE-2026-2766][CVE-2026-2767] [CVE-2026-2768][CV…

  • High max 7.8
    ELSA-2026-24984 1 CVE

    Important: poppler security update (Oracle Linux 8)

    [20.11.0-14] - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Resolves: RHEL-180567

  • High max 7.5
    ELSA-2026-25030 1 CVE

    Important: postgresql-jdbc security update (Oracle Linux 8)

    [42.2.14-4] - Limit SCRAM PBKDF2 iterations to prevent DoS via malicious server - Resolves: CVE-2026-42198

  • High max 9.3
    ELSA-2026-11323 11 CVEs

    Important: freerdp security update (Oracle Linux 7)

    [2.1.1-5.0.7] - Fixed CVE-2026-22852 CVE-2026-22854 CVE-2026-22856 CVE-2026-23732 CVE-2026-23948 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24679 CVE-2026-24684 CVE-2026-31806 [Orabug: 39272429] [2.1.1-5.0.5] - Fixed CVE-2026-26955 CVE-2026-26956 […

  • High max 7.5
    ELSA-2026-9682 7 CVEs

    Important: java-1.8.0-openjdk security update (Oracle Linux 7)

    [1.8.0.492.b09-1.0.1] - Update to 8u492-b09 (GA) [Orabug: 39247147][CVE-2026-22007][CVE-2026-22013] [CVE-2026-22016][CVE-2026-22018][CVE-2026-22021][CVE-2026-23865][CVE-2026-34268] [1.8.0.482.b08-1.0.1] - Update to 8u482-b08 (GA). [Orabug: 38893614] - Update …

  • High max 7.5
    ELSA-2026-24545 1 CVE

    Important: libyang security update (Oracle Linux 8)

    [1.0.184-2] - DoS or arbitrary code execution via maliciously crafted LYB binary blob - Resolves: RHEL-177017 - CVE-2026-44673

  • High max 9.2
    ELSA-2026-7675 18 CVEs

    Important: nodejs24 security update (Oracle Linux 10)

    [1:24.14.1-2.0.2] - Rebuild to correct NVR [1:24.14.1-2.0.1] - Update upstream references

  • High max 7.5
    ELSA-2026-24339 2 CVEs

    Important: bind security update (Oracle Linux 8)

    [32:9.11.36-16.8] - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946)

  • High max 7.5
    ELSA-2026-24340 1 CVE

    Important: frr security update (Oracle Linux 8)

    [7.5.1-24.0.1] - Fix POSTIN scriptlet [Orabug: 34712485] [7.5.1-24] - Fix off-by-one error in FlowSpec operator array bounds checking (CVE-2026-37457) - Resolves: RHEL-174676

  • High max 8.7
    ELSA-2026-24365 2 CVEs

    Important: unbound security update (Oracle Linux 8)

    [1.16.2-5.11] - Fix CVE-2026-42944 (RHEL-177909) - Fix CVE-2026-42959 (RHEL-177809)

  • High max 9.1
    ELSA-2026-50306 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.356.4.2] - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland) [Orabug: 39017592] {CVE-2025-10263} - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland) [Orabug: 39017592] - ARM: uek: Disable CONFIG_QCOM_FALKOR_ERR…

  • High max 9.1
    ELSA-2026-50305 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-321.202.5.1] - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland) [Orabug: 39017590] {CVE-2025-10263} - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland) [Orabug: 39017590] - ARM: uek: Disable CONFIG_NVIDIA_CARMEL_CN…

  • High max 9.1
    ELSA-2026-50304 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-203.76.7.3] - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland) [Orabug: 39017589] {CVE-2025-10263} - arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland) [Orabug: 39017589] - arm64: tlb: allow XZR argument to TLBI ops…

  • Medium max 5.3
    ELSA-2026-17618 1 CVE

    Moderate: ImageMagick security update (Oracle Linux 7)

    [6.9.10.68-7.0.11] - Fix CVE-2026-32636 [Orabug: 39375225] [6.9.10.68-7.0.9] - Fix CVE-2026-28691 and CVE-2026-28693 [Orabug: 39174244] [6.9.10.68-7.0.7] - Fixes Local File Disclosure via Path Traversal (CVE-2026-25965) [Orabug: 39118995] - Fixes Memory alloc…

  • High max 7.1
    ELSA-2026-23258 1 CVE

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.129.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • Medium max 4.1
    ELSA-2026-22730 1 CVE

    Moderate: vim security update (Oracle Linux 8)

    [8.0.1763-23.0.1] - Remove upstream references [Orabug: 31197557] - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984] [2:8.0.1763-23] - RHEL-170126 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path tra…

  • High max 7.5
    ELSA-2026-23360 2 CVEs

    Important: bind9.16 security update (Oracle Linux 8)

    [32:9.16.23-0.22.6] - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946)

  • High max 7.3
    ELSA-2026-22305 4 CVEs

    Important: php:8.2 security update (Oracle Linux 8)

    libzip php [8.2.31-1] - rebase to 8.2.31 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip

  • High max 2.9
    ELSA-2026-22721 1 CVE

    Important: expat security update (Oracle Linux 8)

    [2.5.0-2] - Fix CVE-2026-45186 - Resolves: RHEL-177979

  • High max 9.8
    ELSA-2026-22643 19 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [140.11.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.11.0] - Add OpenELA debranding [140.11.0-1] - Update to 140.11.0 ESR

  • High max 9.8
    ELSA-2026-50299 8 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.356.4.1] - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada) [Orabug: 39463669] [5.4.17-2136.356.4] - tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi) [Orabug: 39429147] - tap: free page on error…

  • High max 9.0
    ELSA-2026-22644 3 CVEs

    Important: samba security update (Oracle Linux 8)

    [4.19.4-16.0.1] - s3: winbindd: winbindd_pam: fix leak in extract_pac_vrfy_sigs [Orabug: 36518285] - s3:passdb: Do not leak memory in pdb_tdb [Orabug: 36371377] - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs in OL8 [Orabug: 3020…

  • High max 9.8
    ELSA-2026-50294 7 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-321.202.5] - Revert 'ip6_tunnel: Fix usage of skb_vlan_inet_prepare()' (Harshit Mogalapalli) [Orabug: 39476647] - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada) [Orabug: 39463672] [5.15.0-321.202.4] - tun: free page…

  • Medium max 7.5
    ELSA-2026-22315 1 CVE

    Moderate: compat-openssl10 security update (Oracle Linux 8)

    [1.1.0.2o-4.2] - Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing Resolves: RHEL-165754

  • High max 7.5
    ELSA-2026-22112 11 CVEs

    Important: go-toolset:ol8 security update (Oracle Linux 8)

    delve [1.25.2-1.0.1] golang [1.25.9-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var - Backported from OL9u7 - Resolves: OLDIS-53586

  • High max 9.8
    ELSA-2026-50293 13 CVEs 2 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-203.76.7.1] - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada) [Orabug: 39474418] [6.12.0-203.76.7] - tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi) [Orabug: 39456024] - tap: free page on error pat…

  • High max 9.8
    ELSA-2026-22140 6 CVEs

    Important: httpd:2.4 security update (Oracle Linux 8)

    httpd [2.4.37-65.0.1.7] - Replace index.html with Oracle's index page oracle_index.html mod_http2 [1.15.7-10.5] - Resolves: RHEL-166277 - httpd:2.4/httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) mod_md [1:2.0.8-8.2] - Resolves: RHEL…

  • High max 8.8
    ELSA-2026-7292 2 CVEs

    Important: freerdp security update (Oracle Linux 7)

    [2.1.1-5.0.5] - Fixed CVE-2026-26955 CVE-2026-26956 [Orabug: 39189643] [2:2.2.0-5.0.3] - Fixed CVE-2026-22855 CVE-2026-22858 CVE-2026-22859 [Orabug: 39075086] [2:2.2.0-5.0.1] - fixed CVE-2026-23530 CVE-2026-23531 CVE-2026-23532 CVE-2026-23533 CVE-2026-23884 […

  • High max 7.5
    ELSA-2026-21291 2 CVEs

    Important: .NET 8.0 security update (Oracle Linux 8)

    [8.0.127-1.0.1] - Add support for Oracle Linux [8.0.127-1] - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173920

  • High max 9.8
    ELSA-2026-21382 18 CVEs

    Important: firefox security update (Oracle Linux 8)

    [140.11.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.11.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.11.0-1] - …

  • High max 8.0
    ELSA-2026-21700 1 CVE

    Important: cockpit security update (Oracle Linux 8)

    [310.8-1.0.1] - Fixed cockpit_ws_t selinux issue for tmpfs [Orabug: 36013589] - Move update-motd out of cockpit_ws_t context [Orabug: 36013589] - Update documentation links [Orabug: 34706402] - Drop subscription-manager-cockpit requirement for ol [Orabug: 346…

  • High max 9.3
    ELSA-2026-21756 2 CVEs

    Important: flatpak security update (Oracle Linux 8)

    [1.12.9-4] - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165633 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170160

  • High max 9.4
    ELSA-2026-21706 18 CVEs

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.126.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 9.6
    ELSA-2026-20586 4 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [140.10.1-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.10.1] - Add OpenELA debranding [140.10.1-1] - Update to 140.10.1 ESR

  • High max 7.5
    ELSA-2026-21294 1 CVE

    Important: .NET 9.0 security update (Oracle Linux 8)

    [9.0.117-1.0.1] - Add support for Oracle Linux [9.0.117-1] - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173915

  • High max 7.5
    ELSA-2026-21295 1 CVE

    Important: .NET 10.0 security update (Oracle Linux 8)

    [10.0.108-1.0.1] - Add support for Oracle Linux [10.0.108-1] - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173906

  • Medium max 4.0
    ELSA-2026-20929 2 CVEs

    Moderate: libexif security update (Oracle Linux 8)

    [0.6.22-6] - Fix integer underflow in MakerNote decoding (CVE-2026-40386) - Fix integer overflow in Nikon MakerNote handling (CVE-2026-40385) Resolves: RHEL-170243, RHEL-170220

  • High max 8.2
    ELSA-2026-20611 11 CVEs

    Important: gnutls security update (Oracle Linux 8)

    [3.6.16-8.6] - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite) - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour) - Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread) - Fix CVE-2026-42010 (PSK authen…

  • Medium max 7.5
    ELSA-2026-20579 1 CVE

    Moderate: freeipmi security update (Oracle Linux 8)

    [1.6.17-1] - Update to 1.6.17, fixes CVE-2026-33554

  • High max 7.8
    ELSA-2026-20585 1 CVE

    Important: compat-libtiff3 security update (Oracle Linux 8)

    [3.9.4-15] - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159315)