Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

  • High max 9.8
    ELSA-2026-50270 3 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-202.76.4.2] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira) [Orabug: 39361451] {CVE-2026-23270} - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [Orabug: 39361449]…

  • Medium max 6.5
    ELSA-2026-16482 8 CVEs

    Moderate: freerdp security update (Oracle Linux 9)

    [2:2.11.7-1.7] - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix growth of preallocated buffers (CVE-2026-27951) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array b…

  • High max 8.8
    ELSA-2026-16062 1 CVE

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-124.56.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • Medium max 6.5
    ELSA-2026-15953 2 CVEs

    Moderate: glib2 security update (Oracle Linux 8)

    [2.68.4-169] - Add patch for CVE-2025-14087 and CVE-2025-14512

  • Medium max 6.5
    ELSA-2026-16019 8 CVEs

    Moderate: freerdp security update (Oracle Linux 8)

    [2:2.11.7-9] - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159850 [2:2.11.7-8] - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix growth of preallocated buffers (CVE-2026-27951) - Fix heap-buffer-ov…

  • High max 7.8
    ELSA-2026-16055 1 CVE

    Important: libtiff security update (Oracle Linux 8)

    [4.0.9-37] - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159316)

  • Medium max 6.5
    ELSA-2026-15971 2 CVEs

    Moderate: glib2 security update (Oracle Linux 9)

    [2.68.4-18.2] - Add patch for CVE-2025-14087 and CVE-2025-14512

  • Medium max 8.2
    ELSA-2026-13673 2 CVEs

    Moderate: corosync security update (Oracle Linux 9)

    [3.1.9-2.1] - Resolves: RHEL-163815 - Resolves: RHEL-163836 - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091) - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)

  • High max 8.6
    ELSA-2026-15887 1 CVE

    Important: openexr security update (Oracle Linux 9)

    [3.1.1-3.2] - fix CVE-2026-34588

  • High max 9.8
    ELSA-2026-15892 26 CVEs 1 exploited

    Important: thunderbird security update (Oracle Linux 9)

    [140.10.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.10.0] - Add OpenELA debranding [140.10.0-1] - Update to 140.10.0 ESR

  • Medium max 5.9
    ELSA-2026-15968 2 CVEs

    Moderate: libsoup3 security update (Oracle Linux 10)

    [3.6.5-11] - Add patches for CVE-2026-4271 and CVE-2026-5119 [3.6.5-10] - Add patch for CVE-2026-1761 [3.6.5-9] - Fix CVE-2026-0719 [3.6.5-8] - Fix CVE-2025-14523 [3.6.5-7] - Add patch for CVE-2025-12105 [3.6.5-6] - Fix integer overflow in date/time parsing […

  • Medium max 7.1
    ELSA-2026-16014 10 CVEs

    Moderate: freerdp security update (Oracle Linux 10)

    [2:3.10.3-5.8] - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) -…

  • High max 8.6
    ELSA-2026-15888 1 CVE

    Important: openexr security update (Oracle Linux 10)

    [3.1.10-8.2] - fix CVE-2026-34588

  • Medium max 6.5
    ELSA-2026-15969 2 CVEs

    Moderate: glib2 security update (Oracle Linux 10)

    [2.80.4-13] - Fix CVE-2025-14087 and CVE-2025-14512 [2.80.4-12] - Fix NVR [2.80.4-11] - Add patch for CVE-2025-13601

  • High max 8.8
    ELSA-2026-50262 9 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.355.3.1] - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) [Orabug: 39344527] {CVE-2026-43284} - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia) [Orabug: 39344576] {CVE-2025-54518} [5.4.17-2136.355.3] - crypto: a…

  • High max 9.8
    ELSA-2026-50261 52 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-320.202.8.2] - xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman) [Orabug: 39344515] {CVE-2026-43284} - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) [Orabug: 39344515] {CVE-2026-43284} [5.15.0-320.202.8.1] - x86/CPU/A…

  • High max 9.8
    ELSA-2026-50260 15 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

  • High max 8.8
    ELSA-2026-50258 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.354.4.3] - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) [Orabug: 39342682] {CVE-2026-43284}

  • High max 8.8
    ELSA-2026-50257 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-319.201.4.6] - xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman) [Orabug: 39342679] {CVE-2026-43284} - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) [Orabug: 39342679] {CVE-2026-43284} [5.15.0-319.201.4.5] - iommu/arm…

  • High max 8.8
    ELSA-2026-50259 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-201.74.2.3] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim) [Orabug: 39342689] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells) [Orabug: 39342689] - rxrpc: only…

  • High max 7.8
    ELSA-2026-14929 1 CVE

    Important: mingw-libtiff security update (Oracle Linux 8)

    [4.0.9-4] - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile Resolves: RHEL-159337

  • Medium max 8.2
    ELSA-2026-13657 2 CVEs

    Moderate: corosync security update (Oracle Linux 8)

    [3.1.8-1.1] - Resolves: RHEL-163805 - Resolves: RHEL-163826 - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091) - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)

  • High max 7.5
    ELSA-2026-13902 1 CVE

    Important: resource-agents security update (Oracle Linux 8)

    [4.9.0-54.33] - bundled pyasn1: fix CVE-2026-30922 Resolves: RHEL-157190 [4.9.0-54.32] - db2: do not use db2stop to avoid divergence in the log Resolves: RHEL-166181 [4.9.0-54.31] - db2: set reintegration when promotion is successful Resolves: RHEL-153157

  • Medium max 7.6
    ELSA-2026-14791 1 CVE

    Moderate: libpng security update (Oracle Linux 9)

    [2:1.6.37-12.3] - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon (RHEL-161291)

  • Medium max 7.5
    ELSA-2026-14819 1 CVE

    Moderate: freeipmi security update (Oracle Linux 9)

    [1.6.17-1] - Update to 1.6.17, fixes CVE-2026-33554

  • Medium max 7.6
    ELSA-2026-14790 1 CVE

    Moderate: libpng security update (Oracle Linux 10)

    [2:1.6.40-8.3] - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon (RHEL-161208)

  • High max 8.8
    ELSA-2026-7673 4 CVEs

    Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good security update (Oracle Linux 7)

    gstreamer1-plugins-bad-free [1.10.4-4.0.1] - Security update for CVE-2026-3082 [Orabug: 39199326] gstreamer1-plugins-base [1.10.4-2.0.3] - Security update for CVE-2026-2921 [Orabug: 39199326] [1.10.4-2.0.1] - Fixed CVE-2024-47607,CVE-2024-47538 and CVE-2024-4…

  • High max 7.5
    ELSA-2026-13830 3 CVEs

    Important: dovecot security update (Oracle Linux 8)

    [1:2.3.16-7] - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161630) - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162282) - fix CVE-2026-27857: den…

  • Medium max 5.9
    ELSA-2026-14087 1 CVE

    Moderate: libsoup security update (Oracle Linux 8)

    [2.62.3-14] - Backport patch for CVE-2026-5119 - Run testsuite during RPM check phase

  • High max 7.5
    ELSA-2026-13857 3 CVEs

    Important: dovecot security update (Oracle Linux 9)

    [1:2.3.16-15.1] - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161639) - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162287) - fix CVE-2026-27857: …

  • High max 7.5
    ELSA-2026-13917 1 CVE

    Important: fence-agents security update (Oracle Linux 9)

    [4.10.0-98.13] - bundled pyasn1: fix CVE-2026-30922 Resolves: RHEL-157201 [4.10.0-98.12] - bundled cryptography: replace with dependency to fix CVE-2026-26007 - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597 Resolves: RHEL-148436, RHEL-155675

  • High max 7.5
    ELSA-2026-13671 1 CVE

    Important: image-builder security update (Oracle Linux 9)

    [45-1.0.4] - Rebuilt to fix CVE-2026-25679, CVE-2026-27137

  • Medium max 5.9
    ELSA-2026-13978 1 CVE

    Moderate: libsoup security update (Oracle Linux 9)

    [2.72.0-12.6] - Backport patch for CVE-2026-5119

  • High max 7.5
    ELSA-2026-14200 3 CVEs

    Important: git-lfs security update (Oracle Linux 9)

    [3.6.1-8.1] - Rebuild with new Golang - Resolves: RHEL-167659, RHEL-170836, RHEL-166651

  • High max 8.2
    ELSA-2026-13672 2 CVEs

    Important: fence-agents security update (Oracle Linux 9)

    [4.10.0-98.12] - bundled cryptography: replace with dependency to fix CVE-2026-26007 - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597 Resolves: RHEL-148436, RHEL-155675

  • High max 7.5
    ELSA-2026-13916 2 CVEs

    Important: fence-agents security update (Oracle Linux 10)

    [4.16.0-13.4] - bundled pyasn1: replace with dependency to fix CVE-2026-30922 - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597 Resolves: RHEL-157186, RHEL-155667

  • High max 7.5
    ELSA-2026-13642 1 CVE

    Important: image-builder security update (Oracle Linux 10)

    [45-1.0.4] - Rebuilt to fix CVE-2026-25679, CVE-2026-27137

  • High max 9.8
    ELSA-2026-8578 2 CVEs

    Important: perl-XML-Parser security update (Oracle Linux 7)

    [2.41-10.0.3] - Security update for CVE-2006-10002 and CVE-2006-10003 [Orabug: 39220442]

  • High max 8.5
    ELSA-2026-13414 4 CVEs

    Important: tigervnc security update (Oracle Linux 8)

    [1.15.0-9] - Fix CVE-2026-33999, CVE-2026-34000, CVE-2026-34001, CVE-2026-34002, CVE-2026-34003 xorg-x11-server: various XKB and XSYNC vulnerabilities Resolves: RHEL-163203 Resolves: RHEL-163271 Resolves: RHEL-163257 - Fix CVE-2026-34352 Resolves: RHEL-167760

  • High max 9.8
    ELSA-2026-13284 3 CVEs

    Important: LibRaw security update (Oracle Linux 8)

    [0.19.5-6] - Backport fix for CVE-2026-24660 from upstream Resolves: RHEL-165412 [0.19.5-5] - Backport fixes for CVE-2026-20889 and CVE-2026-21413 from upstream - Migrate to SPDX license Resolves: RHEL-165404, RHEL-165408