Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

Medium max 7.8

ELSA-2026-5233 1 CVE

Moderate: grub2 security update (Oracle Linux 7)

[2.02-0.87.0.29.el7.14] - Unregister gettext command on module unload [CVE-2025-61662][Orabug: 39112125] [2.02-0.87.0.27.el7.14] - Fix OOB write in grub_net_search_config_file() CVE-2025-0624 [Orabug: 37770226] - Also adds implementation of grub_strlcpy() for…

Apr 8, 2026
High max 5.6

ELSA-2026-6915 3 CVEs

Important: vim security update (Oracle Linux 8)

[8.0.1763-22.0.1.el8_10.1] - Remove upstream references [Orabug: 31197557] - Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984] [2:8.0.1763-22.1] - RHEL-159620 CVE-2026-33412 vim: Vim: Arbitrary code execution via command inje…

Apr 8, 2026
High max 7.5

ELSA-2026-7009 1 CVE

Important: grafana-pcp security update (Oracle Linux 8)

[5.1.1-13] - Resolves RHEL-156641: CVE-2026-25679

Apr 8, 2026
High max 8.2

ELSA-2026-6907 4 CVEs

Important: nginx:1.24 security update (Oracle Linux 8)

[1.24.0-3.0.1] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-3] - Resolves: RHEL-157877 CVE-2026-32647 nginx:1.24/nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files - Resolves: RHEL-159436 CVE-2026-27651 nginx:1.24/ng…

Apr 8, 2026
High max 7.8

ELSA-2026-6949 2 CVEs

Important: go-toolset:ol8 security update (Oracle Linux 8)

delve [1.25.2-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.25.2-1] - Update to Delve 1.25.2 (Sync from CentOS Stream 9) - Related: RHEL-121223 golang [1.25.7-2] - Update to Go 1.25.8 (fips-1) - Resolves: RHEL-156551 [1.25.7-1] - Upd…

Apr 8, 2026
High max 8.2

ELSA-2026-6923 4 CVEs

Important: nginx:1.24 security update (Oracle Linux 9)

[1.24.0-5.2.0.1] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-5.2] - Resolves: RHEL-157886 CVE-2026-32647 nginx:1.24/nginx: NGINX: Denial of Service or Code Execution via specially cr…

Apr 8, 2026
High max 8.2

ELSA-2026-7002 4 CVEs

Important: nginx security update (Oracle Linux 9)

[1.20.1-24.0.1.el9_7.2] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] - Update upstream references [Orabug: 36579090] [2:1.20.1-24.2] - Resolves: RHEL-159557 - CVE-2026-27654 nginx: NGINX: Denia…

Apr 8, 2026
High max 7.5

ELSA-2026-7005 1 CVE

Important: git-lfs security update (Oracle Linux 10)

[3.6.1-8] - Rebuild with new Golang

Apr 8, 2026
Medium max 7.5

ELSA-2026-7081 1 CVE

Moderate: libtiff security update (Oracle Linux 10)

[4.6.0-6.2] - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-148254)

Apr 8, 2026
High max 4.8

ELSA-2026-6817 2 CVEs

Important: capstone security update (Oracle Linux 10)

[5.0.1-7] - Fix CVE-2025-67873 (heap buffer overflow) Resolves: RHEL-141551 - Fix CVE-2025-68114 (memory corruption) Resolves: RHEL-137747

Apr 8, 2026
High max 9.2

ELSA-2026-7080 9 CVEs

Important: nodejs22 security update (Oracle Linux 10)

[1:22.22.2-1] - Update to version 22.22.2 - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135 - disabled failing tests in nghttp2 due to newer version - patch for npm/braces CVE-2026-25547 [1:22.22.0-4] - sources: changed ICU version syntax

Apr 8, 2026
High max 8.8

ELSA-2026-5320 1 CVE

Important: libvpx security update (Oracle Linux 7)

[1.3.0-8.0.3] - Fixes heap buffer overflow in libvpx CVE-2026-2447 [Orabug: 39112729] [1.3.0-8.0.1] - Fixes CVE-2025-5283 vpx_codec_enc_init_multi fix double free on init fail [Orabug: 38103810]

Apr 7, 2026
High max 8.6

ELSA-2026-5573 2 CVEs

Important: ImageMagick security update (Oracle Linux 7)

[6.9.10.68-7.0.7] - Fixes Local File Disclosure via Path Traversal (CVE-2026-25965) [Orabug: 39118995] - Fixes Memory allocation with excessive without limits in the internal SVG decoder (CVE-2026-25985) [6.9.10.68-7.0.5] - Fix CVE-2025-62171 and CVE-2026-238…

Apr 7, 2026
High max 8.8

ELSA-2026-6750 6 CVEs

Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good security update (Oracle Linux 8)

gstreamer1-plugins-bad-free [1.16.1-6.0.1] - Update origin URL [Orabug: 36209826] [1.16.1-6] - Add patch for CVE-2026-3082 Resolves: RHEL-156202 gstreamer1-plugins-base [1.16.1-6.0.1] - Update origin URL [Orabug: 36209826] [1.16.1-6] - Add patch for CVE-2026-…

Apr 7, 2026
High max 10.0

ELSA-2026-6917 39 CVEs

Important: thunderbird security update (Oracle Linux 8)

[140.9.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.9.0] - Add OpenELA debranding [140.9.0-1] - Update to 140.9.0 ESR

Apr 7, 2026
High max 9.3

ELSA-2026-6918 13 CVEs

Important: freerdp security update (Oracle Linux 8)

[2:2.11.7-6] - Fix use of nsc_process_message Resolves: RHEL-155984 [2:2.11.7-5] - Backport several CVE fixes Resolves: RHEL-147954, RHEL-147955, RHEL-147970, RHEL-147977, RHEL-147980 Resolves: RHEL-148002, RHEL-148014, RHEL-148031, RHEL-148906, RHEL-148996 R…

Apr 7, 2026
Medium max 8.8

ELSA-2026-6571 4 CVEs

Moderate: kernel security update (Oracle Linux 8)

[4.18.0-553.117.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Apr 7, 2026
Medium max 0.0

ELSA-2026-6621 1 CVE

Moderate: crun security update (Oracle Linux 9)

[1.27-1] - update to https://github.com/containers/crun/releases/tag/1.27 - fixes CVE-2026-30892 crun: crun: Privilege escalation due to incorrect parsing of the --user option [rhel-9.7.z] - Resolves: RHEL-161439

Apr 7, 2026
Medium max 7.8

ELSA-2026-6570 4 CVEs

Moderate: kernel security update (Oracle Linux 9)

[5.14.0-611.47.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Apr 7, 2026
High max 7.0

ELSA-2026-6766 1 CVE

Important: python3.9 security update (Oracle Linux 9)

[3.9.25-3.0.1.el9_7.2] - Remove upstream URL reference [3.9.25-3.2] - Security fix for CVE-2026-4519 Resolves: RHEL-158052 [3.9.25-3.1] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143108 RHEL-143169 RHEL…

Apr 7, 2026
Medium max 0.0

ELSA-2026-6622 1 CVE

Moderate: crun security update (Oracle Linux 10)

[1.27-1] - update to https://github.com/containers/crun/releases/tag/1.27 - fixes CVE-2026-30892 crun: crun: Privilege escalation due to incorrect parsing of the --user option [rhel-10.1.z] - Resolves: RHEL-161416

Apr 7, 2026
High max 9.3

ELSA-2026-6799 14 CVEs

Important: freerdp security update (Oracle Linux 10)

[2:3.10.3-5.5] - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155979 [2:3.10.3-5.4] - Backport several CVE fixes Resolves: RHEL-147948, RHEL-147949, RHEL-147956, RHEL-147963, RHEL-147964 Resolves: RHEL-147972, RHEL-14…

Apr 7, 2026
Medium max 4.3

ELSA-2026-6825 1 CVE

Moderate: rsync security update (Oracle Linux 10)

[3.4.1-2.2] - Resolves: RHEL-152885 - CVE-2025-10158 Out of bounds array access via negative index [3.4.1-2.1] - Resolves: RHEL-152878 - clearing DISPLAY breaks SSH_ASKPASS expectations

Apr 7, 2026
High max 8.2

ELSA-2026-6906 4 CVEs

Important: nginx security update (Oracle Linux 10)

[2:1.26.3-2.0.1.1] - Reference oracle-indexhtml within Requires [Orabug: 33802044] [2:1.26.3-6] - Resolves: RHEL-157874 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files [2:1.26.3-5] - Resolves: RHEL-159433 CVE-2…

Apr 7, 2026
High max 8.8

ELSA-2026-6631 1 CVE

Important: fontforge security update (Oracle Linux 10)

[20230101-15] - Resolves: RHEL-138129 CVE-2025-15270 SFD File Parsing Remote Code Execution Vulnerability

Apr 7, 2026
Medium max 8.8

ELSA-2026-6632 7 CVEs

Moderate: kernel security update (Oracle Linux 10)

[6.12.0-124.49.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Apr 7, 2026
High max 8.8

ELSA-2026-6628 1 CVE

Important: fontforge security update (Oracle Linux 9)

[20201107-8] - Resolves: RHEL-138245 CVE-2025-15270 SFD File Parsing Remote Code Execution Vulnerability

Apr 6, 2026
High max 9.1

ELSA-2026-6470 1 CVE

Important: perl-YAML-Syck security update (Oracle Linux 8)

[1.30-6] - Resolves: RHEL-156475 - Fix CVE-2026-4177

Apr 3, 2026
High max 2.7

ELSA-2026-6462 1 CVE

Important: openssh security update (Oracle Linux 9)

[8.7p1-48.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626] [8.7p1-48] - CVE-2026-3497: Fix informati…

Apr 3, 2026
Medium max 6.5

ELSA-2026-6391 6 CVEs

Moderate: mysql:8.4 security update (Oracle Linux 8)

mecab mecab-ipadic mysql [8.4.8-1] - Rebase to 8.4.8

Apr 2, 2026
Medium max 6.5

ELSA-2026-6435 7 CVEs

Moderate: mariadb:10.11 security update (Oracle Linux 8)

galera [26.4.23-1] - Rebase to 26.4.23 Judy mariadb [3:10.11.15-1] - Rebase to 10.11.15 - Resolves: RHBZ#2417697 [3:10.11.14-1] - Rebase to 10.11.14 - Resolves: RHBZ#2386961 [3:10.11.13-1] - Rebase to 10.11.13 [3:10.11.11-1] - Rebase to 10.11.11

Apr 2, 2026
Medium max 4.3

ELSA-2026-6436 1 CVE

Moderate: rsync security update (Oracle Linux 8)

[3.1.3-24] - Resolves: RHEL-152887 - CVE-2025-10158 - Out of bounds array access via negative index

Apr 2, 2026
High max 8.3

ELSA-2026-6439 1 CVE

Important: libpng15 security update (Oracle Linux 8)

[1.5.30-8] - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148340)

Apr 2, 2026
High max 2.7

ELSA-2026-6461 1 CVE

Important: openssh security update (Oracle Linux 8)

[8.0p1-28.0.1] - Update upstream references [Orabug: 36587718] [8.0p1-28] - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155814

Apr 2, 2026
High max 7.0

ELSA-2026-6473 1 CVE

Important: python3 security update (Oracle Linux 8)

[3.6.8-75.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8.openela.0] - Add openela to supported dists [3.6.8-75] - Security fix for CVE-2026-4519 Resolves: RHEL-158077

Apr 2, 2026
High max 8.3

ELSA-2026-6445 1 CVE

Important: libpng12 security update (Oracle Linux 8)

[1.2.57-6] - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148339)

Apr 2, 2026
High max 2.7

ELSA-2026-6463 1 CVE

Important: openssh security update (Oracle Linux 10)

[9.9p1-13.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-13] - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155811

Apr 2, 2026
High max 9.3

ELSA-2026-6340 13 CVEs

Important: freerdp security update (Oracle Linux 9)

[2:2.11.7-1.5] - Fix use of nsc_process_message Resolves: RHEL-155993 [2:2.11.7-1.4] - Backport several CVE fixes Resolves: RHEL-148046, RHEL-148049, RHEL-148054, RHEL-148061, RHEL-148079 Resolves: RHEL-148094, RHEL-148096, RHEL-148104, RHEL-148939, RHEL-1490…

Apr 1, 2026
High max 7.5

ELSA-2026-6382 1 CVE

Important: grafana security update (Oracle Linux 9)

[10.2.6-19] - Resolves RHEL-158728: CVE-2026-25679 [10.2.6-17] - Resolves RHEL-144959: CVE-2026-21721 - Resolves RHEL-146863: CVE-2025-61726 - Resolves RHEL-147081: CVE-2025-61729 - Resolves RHEL-147370: CVE-2025-61728 - Resolves RHEL-149621: CVE-2025-68121 […

Apr 1, 2026
High max 7.5

ELSA-2026-6383 1 CVE

Important: grafana-pcp security update (Oracle Linux 9)

[5.1.1-13] - Resolves RHEL-158731: CVE-2026-25679

Apr 1, 2026