Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

High max 6.7

ELSA-2026-13285 1 CVE

Important: libcap security update (Oracle Linux 8)

[2.48-6.1] - Fix TOCTOU race condition in cap_set_file() (CVE-2026-4878) Resolves: RHEL-169304

May 5, 2026
High max 7.5

ELSA-2026-13383 5 CVEs

Important: openssh security update (Oracle Linux 8)

[8.0p1-29.0.1] - Update upstream references [Orabug: 36587718] [8.0p1-29] - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164743 - CVE-2026-35388: Add connection multiplexing confirmation for …

May 5, 2026
High max 9.8

ELSA-2026-13577 6 CVEs 1 exploited

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.123.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

May 5, 2026
High max 9.8

ELSA-2026-13537 26 CVEs 1 exploited

Important: thunderbird security update (Oracle Linux 8)

[140.10.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.10.0] - Add OpenELA debranding [140.10.0-1] - Update to 140.10.0 ESR

May 5, 2026
Medium max 8.7

ELSA-2026-13670 2 CVEs

Moderate: python-tornado security update (Oracle Linux 9)

[6.5.5-1.1] - Update to 6.5.5 Resolves: RHEL-160941

May 5, 2026
Medium max 5.5

ELSA-2026-13677 1 CVE

Moderate: systemd security update (Oracle Linux 9)

[252-55.0.3.el9_7.9] - serialize: don't allocate 1M on the stack just like that [LINUX-16166] - Route logs from container mapped uids to the system journal [Orabug: 38135007] - Drop delay when nspawn fails to reset loginuid [Orabug: 37793135] - Improve loggin…

May 5, 2026
High max 7.5

ELSA-2026-13381 5 CVEs

Important: openssh security update (Oracle Linux 9)

[8.7p1-49.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626] [8.7p1-49] - CVE-2026-35385: Fix privileg…

May 5, 2026
High max 9.8

ELSA-2026-13565 4 CVEs 1 exploited

Important: kernel security update (Oracle Linux 9)

[5.14.0-611.54.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

May 5, 2026
High max 7.5

ELSA-2026-13380 5 CVEs

Important: openssh security update (Oracle Linux 10)

[9.9p1-14.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-14] - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164738 - CVE-2026-35388: Add connection multiplexing …

May 5, 2026
High max 7.5

ELSA-2026-13498 3 CVEs

Important: dovecot security update (Oracle Linux 10)

[1:2.3.21-16.1] - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161625) - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162273) - fix CVE-2026-27857: …

May 5, 2026
Medium max 7.5

ELSA-2026-13515 1 CVE

Moderate: freeipmi security update (Oracle Linux 10)

[1.6.17-1] - Update to 1.6.17 [1.6.14-6] - .fmf/version: Add fmf metadtata root [1.6.14-5] - gating: RHEL-10: Add OSCI testing

May 5, 2026
Medium max 8.7

ELSA-2026-13641 2 CVEs

Moderate: python-tornado security update (Oracle Linux 10)

[6.5.5-1.1] - Update to 6.5.5 Resolves: RHEL-160934

May 5, 2026
Medium max 5.5

ELSA-2026-13651 1 CVE

Moderate: systemd security update (Oracle Linux 10)

[257-13.0.1.el10_1.3] - Fix detection of Oracle Virtualization or BM envs [Orabug: 37531877] - Avoid udevadm warnings when using udev valid configs [Orabug: 37503197] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - set 'RemoveIPC=no' in l…

May 5, 2026
High max 7.5

ELSA-2026-13643 1 CVE

Important: osbuild-composer security update (Oracle Linux 10)

[149-6.0.1] - Add missing dependency over dracut-config-rescue for image-installer [Orabug: 38587453] - Add OL10 support - Update repository URLs for baseos, appstream and UERK - Fix the label for UEKR repository - Simplify repository names [JIRA: OLDIS-35893…

May 5, 2026
High max 9.8

ELSA-2026-13566 4 CVEs 1 exploited

Important: kernel security update (Oracle Linux 10)

[6.12.0-124.55.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

May 5, 2026
Medium max 8.2

ELSA-2026-13644 2 CVEs

Moderate: corosync security update (Oracle Linux 10)

[3.1.9-2.1] - Resolves: RHEL-163801 - Resolves: RHEL-163822 - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091) - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)

May 5, 2026
High max 7.0

ELSA-2026-9614 1 CVE

Important: python security update (Oracle Linux 7)

[2.7.5-94.0.7] - Fix for CVE-2026-4519 [Orabug: 39243798]

May 4, 2026
High max 7.0

ELSA-2026-9745 1 CVE

Important: python3 security update (Oracle Linux 7)

[3.6.8-21.0.11] - Security update CVE-2026-4519 [Orabug: 39246828]

May 4, 2026
High max 7.8

ELSA-2026-50255 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update: Copy Fail (Oracle Linux 7)

[5.4.17-2136.354.4.2] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [Orabug: 39292250] - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39292250] - crypto: authencesn - Fix src offset w…

May 1, 2026
High max 7.8

ELSA-2026-50253 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update: Copy Fail (Oracle Linux 8)

[5.15.0-319.201.4.4] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [Orabug: 39291961] - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39291961] - crypto: authencesn - Fix src offset wh…

May 1, 2026
High max 7.8

ELSA-2026-50254 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update: Copy Fail (Oracle Linux 9)

[6.12.0-201.74.2.2] - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39292190] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39292190] - crypto: authencesn - Do not place hiseq …

May 1, 2026
Medium max 4.4

ELSA-2026-50251 2 CVEs

Moderate: dtrace security update (Oracle Linux 8)

[2.0.7-4] - Prevent out-of-buonds memory access during object symbol table construction (CVE-2026-35233). [Orabug: 39121881] - Prevent divide-by-zero (FPE trap) if section header data is corrupted. (CVE-2026-21996). [Orabug: 39121874] - Ensure safety checks a…

Apr 30, 2026
High max 7.8

ELSA-2026-11656 3 CVEs

Important: xorg-x11-server-Xwayland security update (Oracle Linux 8)

[21.1.3-20] - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001 CVE-2026-34002, CVE-2026-34003 Resolves: https://redhat.atlassian.net/browse/RHEL-163191 Resolves: https://redhat.atlassian.net/browse/RHEL-163287 Resolves: https://redhat.atlassian.net…

Apr 30, 2026
High max 8.2

ELSA-2026-12176 3 CVEs

Important: fence-agents security update (Oracle Linux 8)

[4.2.1-129.25] - bundled cryptography: replace with dependency to fix CVE-2026-26007 - bundled PyJWT: replace with dependency to fix CVE-2026-32597 - bundled pyasn1: fix CVE-2026-30922 Resolves: RHEL-148431, RHEL-155670, RHEL-157189

Apr 30, 2026
Medium max 4.4

ELSA-2026-50250 2 CVEs

Moderate: dtrace security update (Oracle Linux 8)

[2.0.7-4] - Prevent out-of-buonds memory access during object symbol table construction (CVE-2026-35233). [Orabug: 39121881] - Prevent divide-by-zero (FPE trap) if section header data is corrupted. (CVE-2026-21996). [Orabug: 39121874] - Ensure safety checks a…

Apr 30, 2026
High max 7.8

ELSA-2026-12271 1 CVE

Important: libtiff security update (Oracle Linux 9)

[4.4.0-15.3] - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159330)

Apr 30, 2026
High max 7.4

ELSA-2026-12310 1 CVE

Important: sudo security update (Oracle Linux 9)

[1.9.5p2-15] RHEL 9.7.0 ERRATUM - CVE-2026-35535 - Privilege escalation due to failure in privilege drop calls Resolves: RHEL-166065

Apr 30, 2026
High max 6.7

ELSA-2026-12441 1 CVE

Important: libcap security update (Oracle Linux 9)

[2.48-10.1] - Fix TOCTOU race condition in cap_set_file() (CVE-2026-4878) Resolves: RHEL-169311

Apr 30, 2026
High max 7.5

ELSA-2026-11881 1 CVE

Important: grafana-pcp security update (Oracle Linux 10)

[5.3.0-4] - Resolves RHEL-166433: CVE-2026-32282 - Resolves RHEL-167474: CVE-2026-32283

Apr 30, 2026
High max 7.8

ELSA-2026-12265 1 CVE

Important: libtiff security update (Oracle Linux 10)

[4.6.0-6.3] - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159309)

Apr 30, 2026
Medium max 4.4

ELSA-2026-50249 2 CVEs

Moderate: dtrace security update (Oracle Linux 9)

[2.0.7-4] - Prevent out-of-buonds memory access during object symbol table construction (CVE-2026-35233). [Orabug: 39121881] - Prevent divide-by-zero (FPE trap) if section header data is corrupted. (CVE-2026-21996). [Orabug: 39121874] - Ensure safety checks a…

Apr 30, 2026
High max 9.8

ELSA-2026-12285 25 CVEs

Important: thunderbird security update (Oracle Linux 10)

[140.10.0-1.0.1] - Add Oracle prefs [140.10.0-1] - Update to 140.10.0 ESR

Apr 30, 2026
High max 6.7

ELSA-2026-12423 1 CVE

Important: libcap security update (Oracle Linux 10)

[2.69-7.1] - Fix TOCTOU race condition in cap_set_file() (CVE-2026-4878) Resolves: RHEL-169301

Apr 30, 2026
High max 7.5

ELSA-2026-11507 3 CVEs

Important: grafana security update (Oracle Linux 8)

[9.2.10-30.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-30] - Resolves RHEL-166519: CVE-2026-32282 - Resolves RHEL-167380: CVE-2026-32280 - Resolves RHEL-167542: CVE-2026-32283

Apr 29, 2026
High max 8.2

ELSA-2026-11509 1 CVE

Important: vim security update (Oracle Linux 8)

[8.0.1763-22.0.1.el8_10.3] - Remove upstream references [Orabug: 31197557] - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984] [2:8.0.1763-22.3] - Relates: RHEL-164956 vim: arbitrary command execution via modeline sandbox byp…

Apr 29, 2026
High max 7.5

ELSA-2026-11514 3 CVEs

Important: grafana-pcp security update (Oracle Linux 8)

[5.1.1-14] - Resolves RHEL-166520: CVE-2026-32282 - Resolves RHEL-167381: CVE-2026-32280 - Resolves RHEL-167543: CVE-2026-32283

Apr 29, 2026
High max 7.8

ELSA-2026-11692 3 CVEs

Important: xorg-x11-server security update (Oracle Linux 8)

[1.20.11-28] - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001 CVE-2026-34002, CVE-2026-34003 Resolves: https://redhat.atlassian.net/browse/RHEL-163216 Resolves: https://redhat.atlassian.net/browse/RHEL-163298 Resolves: https://redhat.atlassian.ne…

Apr 29, 2026
High max 7.4

ELSA-2026-11521 1 CVE

Important: sudo security update (Oracle Linux 8)

[1.9.5p2-1.0.1.el8_10.5] - Fixes sudo -s unclosed sessions when use_pty option used [Orabug: 36952911] [1.9.5p2-1.5] RHEL 8.10.0.Z ERRATUM - CVE-2026-35535 - Privilege escalation due to failure in privilege drop calls Resolves: RHEL-166060 [1.9.5p2-1.3] RHEL …

Apr 29, 2026
High max 8.8

ELSA-2026-11635 1 CVE

Important: PackageKit security update (Oracle Linux 8)

[1.1.12-8.0.1] - removed rhel-Vendor.conf.patch [1.1.12-8] - Backport fix for CVE-2026-41651. - Resolves: #RHEL-170493

Apr 29, 2026
High max 8.2

ELSA-2026-11510 1 CVE

Important: vim security update (Oracle Linux 9)

[8.2.2637-23.0.1.el9_7.3] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-23.3] - Resolves: RHEL-164965 vim: arbitrary command execution via modeline sandbox bypass [2:8.2.2637-23.2] - RHEL-155437 CVE-2026-28417 vim: Vim: Arbitrary code execution …

Apr 29, 2026