Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

  • High max 8.4
    ELSA-2026-20589 5 CVEs

    Important: dnsmasq security update (Oracle Linux 8)

    [2.79-36] - Prevent overflow in extract_name function (CVE-2026-2291) - Prevent DoS in DNSSEC validation (CVE-2026-4890) - Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891) - Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892) - Prevent…

  • High max 9.8
    ELSA-2026-20566 3 CVEs

    Important: firefox security update (Oracle Linux 8)

    [140.10.2-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.10.2] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.10.2-1] - …

  • Medium max 7.5
    ELSA-2026-20587 1 CVE

    Moderate: glibc security update (Oracle Linux 8)

    [2.28-251.0.4.37] - Forward port of Oracle patches Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: May-7-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.4.34 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi <…

  • High max 8.1
    ELSA-2026-20614 1 CVE

    Important: ruby:3.3 security update (Oracle Linux 8)

    ruby [3.3.10-6] - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316) Resolves: RHEL-171247 rubygem-abrt [0.4.0-1] - Update to abrt 0.4.0. Resolves: rhbz#1842476 rubygem-mysql2 [0.5.5-1] - Upgrade to mysql2 0.5.5. Related: RHEL-17…

  • High max 7.8
    ELSA-2026-50288 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel security update: Fragnesia (Oracle Linux 7)

    [5.4.17-2136.355.3.4] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug: 39420568] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39420568]

  • High max 7.8
    ELSA-2026-50287 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel security update: Fragnesia (Oracle Linux 8)

    [5.15.0-320.202.8.5] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug: 39420565] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39420565]

  • High max 7.8
    ELSA-2026-50286 1 CVE 1 exploited

    Important: Unbreakable Enterprise kernel security update: Fragnesia (Oracle Linux 9)

    [6.12.0-202.76.4.4] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug: 39420559] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39420559]

  • High max 9.6
    ELSA-2026-19588 4 CVEs

    Important: firefox security update (Oracle Linux 8)

    [140.10.1-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.10.1] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.10.1-1] - …

  • High max 7.5
    ELSA-2026-12114 1 CVE

    Important: gdk-pixbuf2 security update (Oracle Linux 7)

    [2.36.12-3.0.3] - Backport fixes for CVE-2026-5201 [Orabug: 39288631] [2.36.12-3.0.1] - jpeg: Be more careful with chunked icc data [Orabug: 38359772][CVE-2025-7345]

  • High max 7.5
    ELSA-2026-19559 1 CVE

    Important: libsndfile security update (Oracle Linux 8)

    [1.0.28-17] - apply patch for CVE-2026-37555 Resolves: ?RHEL-174533

  • High max 7.8
    ELSA-2026-19666 2 CVEs 1 exploited

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.125.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High
    ELSA-2026-65763 0 CVEs

    Important: oci-utils security update (Oracle Linux 8)

    [-- 0.14.0-22] - Rework systemd service file creation. [Orabug: 39316494]

  • High max 7.1
    ELSA-2026-50281 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.355.3.3] - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) [Orabug: 39391459] {CVE-2026-46333} [5.4.17-2136.355.3.2] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 3936877…

  • High max 7.1
    ELSA-2026-50280 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-320.202.8.4] - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) [Orabug: 39391447] {CVE-2026-46333} [5.15.0-320.202.8.3] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton) [Orabug: 39362036] {CVE-2026-31402} - net/sched…

  • High max 7.1
    ELSA-2026-50279 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-202.76.4.3] - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) [Orabug: 39391434] {CVE-2026-46333}

  • High max 9.2
    ELSA-2026-8880 2 CVEs

    Important: squid security update (Oracle Linux 7)

    [7:3.5.20-17.0.11.13] - Security update for CVE-2026-32748 CVE-2026-33526 [Orabug: 39230173] [7:3.5.20-17.0.9.13] - Fixes CVE-2025-62168, squid: Squid vulnerable to information disclosure via - authentication credential leakage in error handling [Orabug: 3858…

  • Critical max 8.1
    ELSA-2026-18041 1 CVE

    Critical: nginx:1.24 security update (Oracle Linux 8)

    [1.24.0-3.0.1.1] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-3.1] - Resolves: RHEL-176224 - nginx:1.24/nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) [1:1.24.0-3] - Resolves: RHEL-157877 CVE-2026-32647 nginx:1.24/nginx: NGI…

  • High max 8.1
    ELSA-2026-18030 1 CVE

    Important: ruby:3.3 security update (Oracle Linux 9)

    ruby [3.3.10-6] - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316) Resolves: RHEL-171255 [3.3.10-5] - Upgrade to Ruby 3.3.10. Resolves: RHEL-127912 - Fix possible denial of service in resolv gem (CVE-2025-24294) - Fix URI Crede…

  • High max 8.1
    ELSA-2026-18039 1 CVE

    Important: ruby security update (Oracle Linux 9)

    [3.0.7-166] - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316) Resolves: RHEL-171254

  • Critical max 8.1
    ELSA-2026-18029 1 CVE

    Critical: nginx security update (Oracle Linux 9)

    [2:1.20.1-24.0.1.el9_7.3] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] - Update upstream references [Orabug: 36579090] [2:1.20.1-24.3] - Resolves: RHEL-176230 - nginx: NGINX: Arbitrary Code Exe…

  • Critical max 8.1
    ELSA-2026-18063 1 CVE

    Critical: nginx security update (Oracle Linux 10)

    [2:1.26.3-2.0.1.el10_1.2] - Reference oracle-indexhtml within Requires [Orabug: 33802044] [2:1.26.3-8] - Fix release number [2:1.26.3-7] - Resolves: RHEL-176217 - nginx: NGINX: Arbitrary Code [2:1.26.3-6] - Resolves: RHEL-157874 CVE-2026-32647 nginx: NGINX: D…

  • Medium max 7.5
    ELSA-2026-18028 1 CVE

    Moderate: libpng security update (Oracle Linux 9)

    [2:1.6.37-12.4] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161436)

  • High max 8.8
    ELSA-2026-50275 5 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-318.199.3.6] - xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman) [Orabug: 39368252] {CVE-2026-43284} - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) [Orabug: 39368252] {CVE-2026-43284} - x86/CPU/AMD: Add a fix for AMD…

  • Medium max 7.5
    ELSA-2026-18064 1 CVE

    Moderate: libpng security update (Oracle Linux 10)

    [2:1.6.40-8.4] - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161324)

  • High max 8.1
    ELSA-2026-18065 1 CVE

    Important: ruby security update (Oracle Linux 10)

    [3.3.10-12] - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316) Resolves: RHEL-171244

  • High max 6.6
    ELSA-2026-6617 4 CVEs

    Important: vim security update (Oracle Linux 7)

    [2:7.4.629-8.0.3] - Security update CVE-2026-25749 CVE-2026-28417 - CVE-2026-28421 CVE-2026-33412 [Orabug: 39170094]

  • High max 5.1
    ELSA-2026-8883 1 CVE

    Important: giflib security update (Oracle Linux 7)

    [4.1.6-9.0.3] - Security update for CVE-2026-23868 [Orabug: 39230174]

  • High max 7.5
    ELSA-2026-11371 1 CVE

    Important: bind security update (Oracle Linux 7)

    [32:9.11.4-26.0.7.P2.16] - Resolve CVE-2026-1519 [Orabug: 39275755] [32:9.11.4-26.0.5.P2.16] - Resolve CVE-2025-40778 [Orabug: 38699863] [32:9.11.4-26.0.3.P2.16] - Resolve CVE-2024-11187 [Orabug: 37616907]

  • High max 7.8
    ELSA-2026-17533 4 CVEs

    Important: gimp:2.8 security update (Oracle Linux 8)

    gimp [2:2.8.22-26.6] - fix CVE-2026-4150 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887 [2:2.8.22-26.5] - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2048 [2:2.8.22-26.4] - fix CVE-2025-14422 [2:2.8.22-26.3] - fix CVE…

  • High max 7.4
    ELSA-2026-17481 1 CVE

    Important: rsync security update (Oracle Linux 8)

    [3.1.3-25] - Resolves: RHEL-169141 - CVE-2026-41035 - Use-after-free vulnerability in extended attribute handling

  • High max 7.5
    ELSA-2026-16252 2 CVEs

    Important: jq security update (Oracle Linux 8)

    [1.6-12] - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions - Fix CVE-2026-39979 out-of-bounds read in jv_parse_sized() - Resolves: RHEL-168174 - Resolves: RHEL-168192

  • High max 7.5
    ELSA-2026-16875 4 CVEs

    Important: git-lfs security update (Oracle Linux 8)

    [3.4.1-10] - Rebuild with new Golang - Resolves: RHEL-167541, RHEL-167379, RHEL-166518 [3.4.1-9] - Rebuild with new Golang - Resolves: RHEL-156637

  • High max 5.9
    ELSA-2026-16799 2 CVEs

    Important: krb5 security update (Oracle Linux 8)

    [1.18.2-34.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767] [1.18.2-34] - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356) Resolves: RHEL-171589 RHEL-171594

  • High max 8.8
    ELSA-2026-16195 1 CVE

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.124.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 7.8
    ELSA-2026-16484 6 CVEs

    Important: gimp security update (Oracle Linux 9)

    [2:3.0.4-1.5] - fix CVE-2026-4150 - fix CVE-2026-4151 - fix CVE-2026-4152 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887

  • High max 7.5
    ELSA-2026-16693 2 CVEs

    Important: jq security update (Oracle Linux 9)

    [1.6-19.0.2] - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions - Resolves: RHEL-168184 [1.6-19.1] - Fix CVE-2026-39979 out-of-bounds read in jv_parse_sized() - Resolves: RHEL-168201 [1.6-19] - Fix CVE-2025-48060 - Resolv…

  • High max 8.8
    ELSA-2026-16206 1 CVE

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-611.55.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 9.8
    ELSA-2026-50271 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-320.202.8.3] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton) [Orabug: 39362036] {CVE-2026-31402} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira) [Orabug: 39362005] {CVE-2026-2327…

  • High max 7.5
    ELSA-2026-16692 2 CVEs

    Important: jq security update (Oracle Linux 10)

    [1.7.1-13] - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions [1.7.1-12] - Fix CVE-2026-39979 out-of-bounds read in jv_parse_sized()

  • High max 7.5
    ELSA-2026-17075 2 CVEs

    Important: yggdrasil security update (Oracle Linux 10)

    [0.4.8-5] - Bump release for rebuild