Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

High max 7.5

ELSA-2026-91366 1 CVE

Important: libX11 security update (Oracle Linux 10)

[1.8.10-1.1] - CVE-2026-88806 libX11: libX11: Heap-based buffer overflow via malicious X server X server Resolves: https://issues.redhat.com/browse/RHEL-267123

Oct 27, 2026
Medium max 7.4

ELSA-2026-91004 1 CVE

Moderate: libXi security update (Oracle Linux 10)

[1.8.1-7.1] - CVE fix for CVE-2026-93541, CVE-2026-93542, CVE-2026-93543 Resolves: RHEL-270054

Oct 27, 2026
High max 2.9

ELSA-2026-90895 1 CVE

Important: thunderbird security, bug fix, and enhancement update (Oracle Linux 10)

[153.5.0-1.0.1] - Add Oracle prefs [153.5.0-1] - Update to 153.5.0 ESR [140.14.0-2] - Update to 140.14.0 ESR [140.13.0-1] - Update to 140.13.0 ESR [140.12.0-1] - Update to 140.12.0 ESR [140.11.0-1] - Update to 140.11.0 ESR [140.10.1-1] - Update to 140.10.1 ES…

Oct 27, 2026
High max 8.9

ELSA-2026-91003 1 CVE

Important: libXrender security update (Oracle Linux 10)

[0.9.11-8.1] - CVE-2026-88807 libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats overflow in RenderQueryPictFormats Resolves: RHEL-267112

Oct 27, 2026
High max 3.7

ELSA-2026-57174 1 CVE

Important: postfix security update (Oracle Linux 7)

[2:2.10.1-9.0.1] - Fix CVE-2026-43964 buffer over-read [Orabug: 39905988] - Allow build on Linux 5.x kernels [Orabug: 39905988]

Oct 26, 2026
Medium max 9.8

ELSA-2026-89754 6 CVEs

Moderate: freeipmi security, bug fix, and enhancement update (Oracle Linux 8)

[1.6.20-1] - Update to 1.6.20, fixes buffer overflows in ipmidetect and ipmi-oem fujitsu CVE number assignment pending. [1.6.19-1] - Update to 1.6.19, fixes CVE-2026-85504, CVE-2026-85505, CVE-2026-85506, CVE-2026-85507, CVE-2026-85508, CVE-2026-85509

Oct 26, 2026
High max 7.5

ELSA-2026-89730 1 CVE

Important: libX11 security update (Oracle Linux 8)

[1.6.8-10] - CVE-2026-88806 libX11: libX11: Heap-based buffer overflow via malicious X server Resolves: https://issues.redhat.com/browse/RHEL-267125

Oct 26, 2026
High max 9.2

ELSA-2026-500512 1 CVE 1 exploited

Important: brotli security update (Oracle Linux 8)

[1.0.6-4.0.1] - Fix CVE-2026-111497: reject invalid Brotli block switches

Oct 26, 2026
High max 8.5

ELSA-2026-89747 8 CVEs

Important: xorg-x11-server security update (Oracle Linux 8)

[1.20.11-28.5] - CVE fix for: CVE-2026-88812, CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93523 Resolves: https://redhat.atlassian.net/browse/RHEL-278163 Resolves: https://redhat.atlassian.net/brows…

Oct 26, 2026
High max 9.6

ELSA-2026-89756 41 CVEs

Important: firefox security, bug fix, and enhancement update (Oracle Linux 8)

[153.5.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [153.5.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [153.5.0-1] - Upd…

Oct 26, 2026
High max 9.2

ELSA-2026-500520 1 CVE 1 exploited

Important: nodejs:24 security update (Oracle Linux 8)

nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

Oct 26, 2026
High max 9.2

ELSA-2026-500519 1 CVE 1 exploited

Important: nodejs:22 security update (Oracle Linux 8)

nodejs [1:22.23.2-2.0.1] - Backport upstream fix for CVE-2026-111497 in the bundled Brotli decoder - Expose the block-switch error and add malformed-stream regression coverage - Require the fixed Oracle Linux 8 system Brotli build nodejs-nodemon nodejs-packag…

Oct 26, 2026
High max 7.1

ELSA-2026-89859 2 CVEs

Important: flatpak security update (Oracle Linux 8)

[1.12.9-9] - Use fd-relative operations for files/etc during runtime deploy (CVE-2026-97024) Resolves: RHEL-272181 [1.12.9-8] - Avoid path traversal deletion via deploy export/bin (CVE-2026-97023) Resolves: RHEL-272023

Oct 26, 2026
Medium max 8.8

ELSA-2026-89816 1 CVE

Moderate: kernel security update (Oracle Linux 8)

[4.18.0-553.179.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 26, 2026
High max 9.8

ELSA-2026-89083 13 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.178.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 26, 2026
High max 7.5

ELSA-2026-89755 2 CVEs

Important: lrzsz security, bug fix, and enhancement update (Oracle Linux 9)

[0.12.20-58] - Fix long-standing SIGSEGV bug when using the -s parameter without an argument (RHEL-282108) [0.12.20-57] - Backport tightened path handling from 0.13.1 (CVE-2026-105840) [0.12.20-56] - Remove 'Topipe' feature. (CVE-2026-105841)

Oct 26, 2026
Medium max 9.8

ELSA-2026-89753 6 CVEs

Moderate: freeipmi security, bug fix, and enhancement update (Oracle Linux 9)

[1.6.20-1] - Update to 1.6.20, fixes buffer overflows in ipmidetect and ipmi-oem fujitsu CVE number assignment pending. [1.6.19-1] - Update to 1.6.19, fixes CVE-2026-85504, CVE-2026-85505, CVE-2026-85506, CVE-2026-85507, CVE-2026-85508, CVE-2026-85509

Oct 26, 2026
High max 9.2

ELSA-2026-89742 3 CVEs

Important: python3.9 security update (Oracle Linux 9)

[3.9.25-7.0.1.el9_8.6] - Remove upstream URL reference [3.9.25-7.6] - CVE-2026-19553 python3.9: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() Resolves: RHEL-274143 [3.9.25-7.5] - CVE-2026-19445 python3…

Oct 26, 2026
High max 7.5

ELSA-2026-89748 3 CVEs

Important: libreswan security update (Oracle Linux 9)

[4.15-11.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.15-11] - Backport fixes for CVE-2026-94453, CVE-2026-77206, and CVE-2026-77207 (RHEL-281889, RHEL-281998, RHEL-281985)

Oct 26, 2026
High max 9.2

ELSA-2026-500513 1 CVE 1 exploited

Important: brotli security update (Oracle Linux 9)

[1.0.9-10.0.1] - Fix out-of-bounds write in the Brotli decoder [CVE-2026-111497]

Oct 26, 2026
Critical max 7.5

ELSA-2026-89744 5 CVEs

Critical: grafana security update (Oracle Linux 9)

[10.2.6-23.7] - CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting - Resolves RHEL-290771 [10.2.6-23.6] - Rebuild against updated golang - Resolves RHEL-287510 - Resolves RHEL-279380 - Resolves RHEL-279012 - Resolves RHE…

Oct 26, 2026
Medium max 1.7

ELSA-2026-89749 1 CVE

Moderate: xz security update (Oracle Linux 9)

[5.2.5-8.1] - Fix: a buffer overflow in lzma_index_append() - Add test for the issue above (needs a special build config to actually fail -> does not fail in our environment) - Resolves: CVE-2026-34743

Oct 26, 2026
High max 9.6

ELSA-2026-89757 48 CVEs

Important: firefox security, bug fix, and enhancement update (Oracle Linux 9)

[153.5.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [153.5.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Ab…

Oct 26, 2026
Medium max 5.9

ELSA-2026-89746 1 CVE

Moderate: bind9.18 security update (Oracle Linux 9)

[32:9.18.29-14.11] - Fix CVE-2026-19662: NOQNAME proof use-after-free could crash recursive resolver.

Oct 26, 2026
Medium max 5.9

ELSA-2026-89745 1 CVE

Moderate: bind security update (Oracle Linux 9)

[9.16.23-40.0.1.el9_8.12] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-40.12] - Fix CVE-2026-19662: NOQNAME proof use-after-free could crash recursive resolver. [32:9.16.23-40.11] - Backport 'Do not use header_prev in exp…

Oct 26, 2026
High max 9.2

ELSA-2026-500517 1 CVE 1 exploited

Important: nodejs:22 security update (Oracle Linux 9)

nodejs [1:22.23.2-2.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

Oct 26, 2026
High max 9.2

ELSA-2026-500518 1 CVE 1 exploited

Important: nodejs:24 security update (Oracle Linux 9)

nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

Oct 26, 2026
High max 7.1

ELSA-2026-89850 2 CVEs

Important: flatpak security update (Oracle Linux 9)

[1.12.9-4.6] - Use fd-relative operations for files/etc during runtime deploy (CVE-2026-97024) Resolves: RHEL-272190 [1.12.9-4.5] - Avoid path traversal deletion via deploy export/bin (CVE-2026-97023) Resolves: RHEL-272030

Oct 26, 2026
High max 7.5

ELSA-2026-90462 3 CVEs

Important: skopeo security update (Oracle Linux 9)

[1:1.22.2-9] - Rebuild for CVE-2026-78667 and CVE-2026-111943 - Resolves: RHEL-279016 - Resolves: RHEL-287514

Oct 26, 2026
High max 8.9

ELSA-2026-90494 2 CVEs

Important: python-urllib3 security update (Oracle Linux 9)

[1.26.5-8.2] - CVE-2026-97687 python-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override Resolves: RHEL-282326 [1.26.5-8.1] - CVE-2026-97689 python-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk pars…

Oct 26, 2026
High max 8.8

ELSA-2026-90522 1 CVE

Important: xdg-dbus-proxy security update (Oracle Linux 9)

[0.1.3-1.1] - Message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422) Resolves: RHEL-271548

Oct 26, 2026
High max 9.2

ELSA-2026-500514 1 CVE 1 exploited

Important: brotli security update (Oracle Linux 10)

[1.1.0-8.0.1] - Fix out-of-bounds write in the Brotli decoder [CVE-2026-111497]

Oct 26, 2026
High max 7.5

ELSA-2026-89761 3 CVEs

Important: skopeo security update (Oracle Linux 10)

[2:1.22.2-6] - Rebuild for CVE-2026-111943 - Resolves: RHEL-287480

Oct 26, 2026
High max 7.5

ELSA-2026-89732 2 CVEs

Important: grafana security update (Oracle Linux 10)

[10.2.6-28.9] - Rebuild against updated golang - Resolves RHEL-290737 [10.2.6-28.9] - CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting in Unified Alerting - Resolves RHEL-290765 [10.2.6-28.8] - Rebuild against updated …

Oct 26, 2026
High max 7.1

ELSA-2026-89849 2 CVEs

Important: flatpak security update (Oracle Linux 10)

[1.16.0-9.6] - Use fd-relative operations for files/etc during runtime deploy (CVE-2026-97024) Resolves: RHEL-272185 [1.16.0-9.5] - Avoid path traversal deletion via deploy export/bin (CVE-2026-97023) Resolves: RHEL-272031

Oct 26, 2026
High max 9.2

ELSA-2026-500515 1 CVE 1 exploited

Important: nodejs24 security update (Oracle Linux 10)

[24.21.0-1.0.2] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Require fixed OL10 system Brotli for builds without bundled Brotli

Oct 26, 2026
High max 9.2

ELSA-2026-500516 1 CVE 1 exploited

Important: nodejs22 security update (Oracle Linux 10)

[1:22.23.2-3.0.2] - Backport upstream fix for CVE-2026-111497 in the bundled Brotli decoder - Expose the block-switch error and add malformed-stream regression coverage - Require the fixed Oracle Linux 10 system Brotli build

Oct 26, 2026
High max 7.5

ELSA-2026-89923 3 CVEs

Important: libreswan security update (Oracle Linux 10)

[5.3.3-1.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [5.3.3-1] - update to 5.3.3 to fix CVE-2026-94453, CVE-2026-77207, CVE-2026-77205, and CVE-2026-77206

Oct 26, 2026
High max 7.5

ELSA-2026-89752 3 CVEs

Important: oci-seccomp-bpf-hook security update (Oracle Linux 10)

[1.2.11-3] - Rebuild for CVE-2026-111943 - Resolves: RHEL-287608 [1.2.11-2] - rebuild with golang to fix CVE-2026-33811 - Resolves: RHEL-187133

Oct 26, 2026
Medium max 5.9

ELSA-2026-90328 1 CVE

Moderate: bind security update (Oracle Linux 10)

[9.18.33-15.0.1.el10_2.13] - Hard require needed openssl-libs [Orabug: 38742109] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.18.33-15.13] - Fix CVE-2026-19662: NOQNAME proof use-after-free could crash recursive resolver. [32:9…

Oct 26, 2026