Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

  • High max 9.2
    ELSA-2026-88693 1 CVE 1 exploited

    Important: php security update (Oracle Linux 7)

    [5.4.16-48.0.1] - Backport fix for CVE-2026-109619 [Orabug: 40200805]

  • High max 8.2
    ELSA-2026-92323 2 CVEs

    Important: expat security update (Oracle Linux 8)

    [2.5.0-6] - CVE-2026-102633 expat: expat: Denial of Service via integer overflow in expat_realloc - Resolves: RHEL-272828 [2.5.0-5] - CVE-2026-77214 expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer over-read in XML_ParseBuffer…

  • High max 9.8
    ELSA-2026-92368 5 CVEs

    Important: curl security, bug fix, and enhancement update (Oracle Linux 8)

    [7.61.1-34.el8_10.18] - fix incomplete mTLS config in connection reuse (CVE-2026-8932) [7.61.1-34.el8_10.17] - fix cookie injection via trailing dot super cookies (CVE-2026-8924) - fix digest auth state leak on origin or credential change (CVE-2026-11856) [7.…

  • High max 8.9
    ELSA-2026-92474 2 CVEs

    Important: python3.12-urllib3 security update (Oracle Linux 8)

    [1.26.19-5] - CVE-2026-97689 Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282256 [1.26.19-4] - CVE-2026-97687 Traffic interception via HTTPS proxy TLS configuration override Resolves: RHEL-282315

  • High max 5.9
    ELSA-2026-92615 1 CVE

    Important: aspell security update (Oracle Linux 8)

    [12:0.60.6.1-23] - Backport fix for CVE-2026-103658

  • High max 9.3
    ELSA-2026-92209 4 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-553.180.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 9.8
    ELSA-2026-92869 6 CVEs

    Important: tomcat security update (Oracle Linux 8)

    [1:9.0.121-1] - Resolves: RHEL-255793 tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) - Resolves: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183) - Resolves: RHEL-271822 tomcat: Imp…

  • Critical max 9.1
    ELSA-2026-92157 1 CVE

    Critical: mod_auth_openidc:2.3 security update (Oracle Linux 8)

    cjose [0.6.1-6] - CVE-2026-53939 mod_auth_openidc:2.3/cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption Resolves: RHEL-287898 mod_auth_openidc [2.4.9.4-9] - Resolves: RHEL-248080 CVE-2026-54789 Denial of Service via mal…

  • High max 6.8
    ELSA-2026-91719 1 CVE

    Important: ignition security update (Oracle Linux 9)

    [2.26.0-1.2] - Rebuild with updated golang [2.26.0-1.1] - Rebuild with updated golang - Resolves: RHEL-175424, RHEL-177307

  • High max 8.9
    ELSA-2026-91057 1 CVE

    Important: libXrender security update (Oracle Linux 9)

    [0.9.10-16.2] - CVE-2026-88807 libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats in RenderQueryPictFormats Resolves: https://redhat.atlassian.net/browse/RHEL-267120

  • Critical max 9.1
    ELSA-2026-92145 1 CVE

    Critical: cjose security update (Oracle Linux 9)

    [0.6.1-17.2] - CVE-2026-53939 cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption Encryption Key for AES-CBC-HMAC JWE encryption Resolves: RHEL-287912

  • High max 9.6
    ELSA-2026-91580 6 CVEs

    Important: webkit2gtk3 security update (Oracle Linux 9)

    [2.54.2-0.1] - Update to 2.54.2

  • Medium max 7.4
    ELSA-2026-91056 1 CVE

    Moderate: libXi security update (Oracle Linux 9)

    [1.7.10-8.1] - CVE fix for CVE-2026-93541, CVE-2026-93542, CVE-2026-93543 Resolves: RHEL-270061

  • High max 7.5
    ELSA-2026-91365 1 CVE

    Important: libX11 security update (Oracle Linux 9)

    [1.8.12-1.1] - CVE-2026-88806 libX11: libX11: Heap-based buffer overflow via malicious X server X server

  • High max 7.1
    ELSA-2026-91223 1 CVE

    Important: libXtst security update (Oracle Linux 9)

    [1.2.3-16.1] - CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser read in RECORD reply parser Resolves: RHEL-271689

  • Medium max 7.5
    ELSA-2026-92907 1 CVE

    Moderate: curl security update (Oracle Linux 9)

    [7.76.1-40.el9_8.9] - fix incomplete mTLS config in connection reuse (CVE-2026-8932)

  • High max 6.8
    ELSA-2026-91720 1 CVE

    Important: ignition security update (Oracle Linux 10)

    [2.26.0-3.0.1.4] - Drop RHCK specific module inclusion [Orabug: 39718726] - Remove sgdisk requirement and create symbolic link to sgdisk [Orabug: 37470782] [2.26.0-4] - Rebuild ignition against updated golang [2.26.0-3] - Rebuild ignition against updated gola…

  • High max 8.1
    ELSA-2026-92419 4 CVEs

    Important: bind security update (Oracle Linux 10)

    [9.18.33-15.0.1.el10_2.14] - Hard require needed openssl-libs [Orabug: 38742109] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.18.33-15.14] - Prevent arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300) - Fi…

  • High max 7.5
    ELSA-2026-92408 3 CVEs

    Important: dogtag-pki security update (Oracle Linux 10)

    [11.9.0-6.0.1.el10_2.1] - Treat Oracle Linux the same as RHEL when selecting the Tomcat app server version. [11.9.0-6.1] - Update jackson-core, jackson-databind and resteasy - Fix CVE-2026-89059: RESTEasy IIOImageProvider Unbounded Image Decode - Fix CVE-2026…

  • High max 9.8
    ELSA-2026-90913 43 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [140.17.0-1.0.1] - Add Oracle prefs file [140.17.0] - Add OpenELA debranding [140.17.0-1] - Update to 140.17.0 ESR

  • Medium max 7.0
    ELSA-2026-90915 1 CVE

    Moderate: gcc-toolset-15-gcc security update (Oracle Linux 8)

    [15.2.1-7.2] - fix CVE-2026-102010, PR libstdc++/127656 (RHEL-272113)

  • High max 9.6
    ELSA-2026-91636 6 CVEs

    Important: webkit2gtk3 security update (Oracle Linux 8)

    [2.54.2-1] - Update to 2.54.2

  • High max 8.2
    ELSA-2026-90812 1 CVE

    Important: cjose security update (Oracle Linux 9)

    [0.6.1-17.1] - CVE-2026-53938 cjose: heap buffer overflow in AES key unwrap Resolves: RHEL-256972

  • High max 7.1
    ELSA-2026-91612 1 CVE

    Important: libXtst security update (Oracle Linux 10)

    [1.2.4-8.1] - CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser out-of-bounds read in RECORD reply parser Resolves: RHEL-271682

  • High max 7.5
    ELSA-2026-91138 3 CVEs

    Important: yggdrasil security update (Oracle Linux 10)

    [0.4.9.2-4] - Rebuild yggdrasil against updated golang [0.4.9.2-3] - Rebuild yggdrasil against updated golang [0.4.9.2-2] - Rebuild yggdrasil against updated golang

  • High max 9.8
    ELSA-2026-91565 16 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.69.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 7.5
    ELSA-2026-90492 3 CVEs

    Important: libreswan security update (Oracle Linux 8)

    [4.12-2.0.1.el8_10.7] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.12-7] - Backport fixes for CVE-2026-94453, CVE-2026-77206 and CVE-2026-77207 (RHEL-281879, RHEL-282682, RHEL-282477) [4.12-2.6] - Backport fix for CVE-2026-14957 (RHEL-212498)…

  • High max 9.2
    ELSA-2026-90501 1 CVE 1 exploited

    Important: brotli security update (Oracle Linux 8)

    [1.0.6-5] - Resolves: RHEL-290271 - CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder

  • High max 7.8
    ELSA-2026-90800 1 CVE

    Important: emacs security update (Oracle Linux 8)

    [1:26.1-15.4] - Add missing untrusted-content variable definition (fixes CVE-2026-96442) - Related: RHEL-265099 [1:26.1-15.3] - Generalize trusted-content-p check to all Flymake backends (CVE-2026-96442) - Resolves: RHEL-265099

  • High max 8.9
    ELSA-2026-90759 1 CVE

    Important: python-urllib3 security update (Oracle Linux 8)

    [1.24.2-11] - CVE-2026-97689 python-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser memory allocation in chunk parser Resolves: RHEL-282251

  • High max 8.9
    ELSA-2026-91267 1 CVE

    Important: libXrender security update (Oracle Linux 8)

    [0.9.10-8] - CVE-2026-88807 libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats in RenderQueryPictFormats

  • Medium max 7.4
    ELSA-2026-91268 1 CVE

    Moderate: libXi security update (Oracle Linux 8)

    [1.7.10-2] - CVE fix for CVE-2026-93541, CVE-2026-93542, CVE-2026-93543 Resolves: RHEL-270049

  • High max 7.1
    ELSA-2026-91294 1 CVE

    Important: libXtst security update (Oracle Linux 8)

    [1.2.3-8] - CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser in RECORD reply parser

  • High max 8.5
    ELSA-2026-88164 4 CVEs

    Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update (Oracle Linux 8)

    flute [1.3.0-19.OOo31] - OpenJDK 8 won't be supported anymore on RHEL 8 starting from November 2026, move to OpenJDK 21 - Resolves: RHEL-275416 libbase [1.1.3-21] - Remove commons logging dependency - Related: RHEL-286491 [1.1.3-20] - OpenJDK 8 won't be suppo…

  • High max 7.5
    ELSA-2026-89760 2 CVEs

    Important: container-tools:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

    aardvark-dns [2:1.10.1-2] - build off the RHEL maintenance branch - Resolves: RHEL-59129 buildah [2:1.33.15-2] - Rebuild for CVE-2026-78667 and CVE-2026-111943 - Resolves: RHEL-278949 RHEL-287628 RHEL-272014 [2:1.33.15-1] - fix Version to match the upstream r…

  • High max 7.5
    ELSA-2026-90362 3 CVEs

    Important: podman security update (Oracle Linux 9)

    [5.8.2-8.0.1] - Rework CNI/Netavark detection logic [JIRA: EVG-3769] - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.8.2-8] - Rebuild for CVE-2026-7…

  • High max 7.5
    ELSA-2026-90424 4 CVEs

    Important: buildah security update (Oracle Linux 9)

    [1.43.4-2.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.43.4-2] - Rebuild for CVE-2026-78667 and CVE-2026-111943 - Resolves: RHEL-279009 - Resolves: RHEL-287507 [2:1.43.4-1] - Update to buildah 1.43.4 (c7061d00) - …

  • High max 9.8
    ELSA-2026-90365 15 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.61.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 9.2
    ELSA-2026-90449 1 CVE 1 exploited

    Important: brotli security update (Oracle Linux 10)

    [1.1.0-8.0.1] - Fix out-of-bounds write in the Brotli decoder [CVE-2026-111497]

  • High max 7.5
    ELSA-2026-90887 1 CVE

    Important: emacs security update (Oracle Linux 10)

    [1:29.4-17] - Fix arbitrary code execution upon opening file (CVE-2026-96269) [1:29.4-16] - Generalize trusted-content-p check to all Flymake backends (CVE-2026-96442) [1:29.4-15] - tramp: restrict user name to prevent shell injection (CVE-2026-79992)