Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

Medium max 4.3

ELSA-2026-6390 1 CVE

Moderate: rsync security update (Oracle Linux 9)

[3.2.5-3.2] - Resolves: RHEL-152888 - CVE-2025-10158 Out of bounds array access via negative index [3.2.5-3.1] - Resolves: RHEL-152879 - clearing DISPLAY breaks SSH_ASKPASS expectations

Apr 1, 2026
High max 8.8

ELSA-2026-6300 7 CVEs

Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update (Oracle Linux 9)

gstreamer1-plugins-bad-free [1.22.12-5] - fix for CVE-2026-2923, CVE-2026-3082 Resolves: RHEL-156231, RHEL-156248 gstreamer1-plugins-base [1.22.12-5] - Apply patch for CVE-2026-2921 Resolves: RHEL-156241 gstreamer1-plugins-good [1.22.12-5] - Apply patches for…

Apr 1, 2026
High max 10.0

ELSA-2026-6342 39 CVEs

Important: thunderbird security update (Oracle Linux 10)

[140.9.0-1.0.1] - Add Oracle prefs [140.9.0-1] - Update to 140.9.0 ESR

Apr 1, 2026
High max 7.5

ELSA-2026-6344 1 CVE

Important: grafana security update (Oracle Linux 10)

[10.2.6-23] - Resolves RHEL-158458: CVE-2026-25679

Apr 1, 2026
High max 7.5

ELSA-2026-6388 1 CVE

Important: grafana-pcp security update (Oracle Linux 10)

[5.3.0-3] - Resolves RHEL-158459: CVE-2026-25679

Apr 1, 2026
High max 7.0

ELSA-2026-6281 1 CVE

Important: python3.11 security update (Oracle Linux 8)

[3.11.13-6.0.1] - Update rpm-macros description [Orabug: 36024572] [3.11.13-6] - Security fix for CVE-2026-4519 Resolves: RHEL-158028

Mar 31, 2026
High max 7.0

ELSA-2026-6283 1 CVE

Important: python3.12 security update (Oracle Linux 8)

[3.12.12-4] - Security fix for CVE-2026-4519 Resolves: RHEL-158029

Mar 31, 2026
Medium

ELSA-2026-6266 1 CVE

Moderate: libxslt security update (Oracle Linux 9)

[1.1.34-14.0.1.el9_7.1] - Fix memory leak in exclPrefixPush [Orabug: 37871881] - Added libxslt-oracle-enterprise.patch and replaced doc/redhat.gif in tarball [1.1.34-14.1] - Fix upgrade path for CVE-2023-40403 (RHEL-82213) [1.1.34-12.1] - Fix CVE-2023-40403 (…

Mar 31, 2026
High max 7.0

ELSA-2026-6285 1 CVE

Important: python3.12 security update (Oracle Linux 9)

[3.12.12-4.0.1.el9_7.2] - Remove upstream URL reference [3.12.12-4.2] - Security fix for CVE-2026-4519 Resolves: RHEL-158051 [3.12.12-4.1] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143106 RHEL-143168 R…

Mar 31, 2026
High max 7.0

ELSA-2026-6286 1 CVE

Important: python3.11 security update (Oracle Linux 9)

[3.11.13-5.2.0.1] - Remove upstream URL reference [Orabug: 36073032] [3.11.13-5.2] - Security fix for CVE-2026-4519 Resolves: RHEL-158050

Mar 31, 2026
High max 9.2

ELSA-2026-6301 2 CVEs

Important: squid security update (Oracle Linux 9)

[7:5.5-22.4] - Resolves: RHEL-160692 - squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748) [7:5.5-22.3] - Resolves: RHEL-160693 - squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)

Mar 31, 2026
High max 7.0

ELSA-2026-6256 1 CVE

Important: python3.12 security update (Oracle Linux 10)

[3.12.12-3.0.1.el10_1.2] - Remove upstream URL reference [3.12.12-3.2] - Security fix for CVE-2026-4519 Resolves: RHEL-158127 [3.12.12-3.1] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143054 RHEL-143105 …

Mar 31, 2026
High max 8.8

ELSA-2026-6259 7 CVEs

Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update (Oracle Linux 10)

gstreamer1-plugins-bad-free [1.24.11-3] - fix for CVE-2026-2923, CVE-2026-3082 Resolves: RHEL-156111, RHEL-156158 gstreamer1-plugins-base [1.24.11-2] - Apply patch for CVE-2026-2921 Resolves: RHEL-156120 gstreamer1-plugins-good [1.24.11-2] - Apply patches for…

Mar 31, 2026
High max 8.8

ELSA-2026-6005 2 CVEs

Important: freerdp security update (Oracle Linux 8)

[2:2.11.7-4] - Backport several CVE fixes Resolves: RHEL-151979, RHEL-152206

Mar 30, 2026
Medium max 7.8

ELSA-2026-6037 3 CVEs

Moderate: kernel security update (Oracle Linux 8)

[4.18.0-553.115.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Mar 30, 2026
High max 8.8

ELSA-2026-6004 2 CVEs

Important: freerdp security update (Oracle Linux 9)

[2:2.11.7-1.3] - Backport several CVE fixes Resolves: RHEL-151988, RHEL-152215

Mar 30, 2026
High max 10.0

ELSA-2026-6188 39 CVEs

Important: thunderbird security update (Oracle Linux 9)

[140.9.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.9.0] - Add OpenELA debranding [140.9.0-1] - Update to 140.9.0 ESR

Mar 30, 2026
Medium max 8.8

ELSA-2026-6153 8 CVEs

Moderate: kernel security update (Oracle Linux 9)

[5.14.0-611.45.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Mar 30, 2026
Medium max 7.8

ELSA-2026-6053 2 CVEs

Moderate: kernel security update (Oracle Linux 10)

[6.12.0-124.47.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Mar 30, 2026
High max 5.6

ELSA-2026-4471 3 CVEs

Important: freerdp security update (Oracle Linux 7)

[2:2.2.0-5.0.3] - Fixed CVE-2026-22855 CVE-2026-22858 CVE-2026-22859 [Orabug: 39075086] [2:2.2.0-5.0.1] - fixed CVE-2026-23530 CVE-2026-23531 CVE-2026-23532 CVE-2026-23533 CVE-2026-23884 [Orabug: 38971897] [2:2.2.0-5] - Update: Refactored RPC gateway parser (…

Mar 27, 2026
High max 8.3

ELSA-2026-4756 1 CVE

Important: libpng security update (Oracle Linux 7)

[2:1.5.13-8.0.3] - Fix CVE-2026-25646 [Orabug: 39093556] [2:1.5.13-8.0.1] - Fix CVE-2025-64720 [Orabug: 38824465]

Mar 27, 2026
High max 10.0

ELSA-2026-5932 37 CVEs

Important: firefox security update (Oracle Linux 8)

[140.9.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] [140.9.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.9.0-1] - Update to 140.9.0 ESR

Mar 27, 2026
High max 10.0

ELSA-2026-5930 37 CVEs

Important: firefox security update (Oracle Linux 9)

[140.9.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.9.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Ab…

Mar 27, 2026
High max 10.0

ELSA-2026-5931 37 CVEs

Important: firefox security update (Oracle Linux 10)

[140.9.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.9.0-1] - Update to 140.9.0 ESR

Mar 27, 2026
High max 7.8

ELSA-2026-5942 2 CVEs

Important: golang security update (Oracle Linux 9)

[1.25.8-2] - Update to Go 1.25.8 (fips-1) - Resolves: RHEL-157451

Mar 26, 2026
High max 8.1

ELSA-2026-50171 1 CVE

Unbreakable Enterprise kernel bug fix update (NA) (Oracle Linux 8)

[5.15.0-318.199.3.2.1] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39071316] [5.15.0-318.199.3.2] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [O…

Mar 26, 2026
Medium max 7.3

ELSA-2026-5913 1 CVE

Moderate: ncurses security update (Oracle Linux 10)

[6.4-15.20240127] - fix buffer overflow in infocmp -i (CVE-2025-69720)

Mar 26, 2026
High max 8.8

ELSA-2026-5939 2 CVEs

Important: freerdp security update (Oracle Linux 10)

[2:3.10.3-5.3] - Backport several CVE fixes Resolves: RHEL-151975, RHEL-152202

Mar 26, 2026
High max 7.8

ELSA-2026-5941 2 CVEs

Important: golang security update (Oracle Linux 10)

[1.25.8-1] - Update to Go 1.25.8 (fips-1)

Mar 26, 2026
High max 8.1

ELSA-2026-50170 1 CVE

Unbreakable Enterprise kernel bug fix update (NA) (Oracle Linux 9)

[6.12.0-200.74.27.1] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39071315]

Mar 26, 2026
Medium max 6.5

ELSA-2026-5580 6 CVEs

Moderate: mysql:8.0 security update (Oracle Linux 8)

mecab [0.996-2.12] - Bump version for 'mysql' module rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'AppStream' repo - Resolves: #2180411 [0.996-2] - Rebuild to fix the issue described in #2000986 - Resolves: #2000986 [0.996-1.9]…

Mar 25, 2026
Medium max 7.5

ELSA-2026-5578 1 CVE

Moderate: virt:ol and virt-devel:ol security update (Oracle Linux 8)

hivex [1.3.18-23] - Limit recursion in ri-records (CVE-2021-3622) resolves: rhbz#1976194 libguestfs [1.44.0-9.0.2] - libguestfs.spec: Add btrfs-progs RPM to appliance [Orabug: 35634755] libguestfs-winsupport [8.10-1] - Rebase to ntfs-3g 2022.10.3 - Fixes: CVE…

Mar 25, 2026
Medium max 6.5

ELSA-2026-5640 6 CVEs

Moderate: mysql:8.4 security update (Oracle Linux 9)

mecab [0.996-3.4] - Bump version for package rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'CRB' repo - Resolves: #2182069 [0.996-3.3] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 [0.996-3.2] - Rebuilt…

Mar 25, 2026
Medium max 5.9

ELSA-2026-5599 1 CVE

Moderate: nginx security update (Oracle Linux 9)

[1.20.1-24.0.1.el9_7.1] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] - Update upstream references [Orabug: 36579090] [2:1.20.1-24.1] - Resolves: RHEL-146525 - nginx: NGINX: Data injection via m…

Mar 25, 2026
High max 7.8

ELSA-2026-3685 9 CVEs

Important: kernel security update (Oracle Linux 7)

[3.10.0-1160.119.1.0.19] - ext4: fix use-after-free in ext4_orphan_cleanup {CVE-2022-50673} [Orabug: 39036029] - Squashfs: check return result of sb_min_blocksize {CVE-2025-38415} [Orabug: 39036029] - atm: clip: Fix infinite recursive call of clip_push(). {CV…

Mar 24, 2026
Medium max 7.2

ELSA-2026-5513 1 CVE

Moderate: 389-ds:1.4 security update (Oracle Linux 8)

[1.4.3.39-23] - Resolves: RHEL-137074 - CVE-2025-14905 389-ds:1.4/389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-8.10.z] - Resolves: RHEL-152098 - Scalability issue of replication online initialization wit…

Mar 24, 2026
Medium max 5.9

ELSA-2026-5581 1 CVE

Moderate: nginx:1.24 security update (Oracle Linux 8)

[1.24.0-2.0.1] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-2] - Resolves: RHEL-146517 - nginx:1.24/nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642) [1:1.24.0-1] - Resolves: RHEL-14714 - add ngin…

Mar 24, 2026
Medium max 5.3

ELSA-2026-5585 2 CVEs

Moderate: gnutls security update (Oracle Linux 8)

[3.6.16-8.5] - Backport the fixes for CVE-2025-9820 and CVE-2025-14831

Mar 24, 2026
Medium max 6.8

ELSA-2026-5587 1 CVE

Moderate: opencryptoki security update (Oracle Linux 8)

[3.22.0-3.2] - Resolves: RHEL-144817, CVE-2026-23893 Privilege Escalation or Data Exposure via Symlink Following

Mar 24, 2026
Medium max 6.3

ELSA-2026-5588 1 CVE

Moderate: python3 security update (Oracle Linux 8)

[3.6.8-74.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8.openela.0] - Add openela to supported dists [3.6.8-74] - Security fix for CVE-2025-0938 Resolves: RHEL-153235

Mar 24, 2026