Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

High max 8.8

ELSA-2026-3887 3 CVEs

Important: postgresql16 security update (Oracle Linux 10)

[16.13-1.0.1] - Replace upstream reference [Orabug: 37044148] [16.13-1] - Update to 16.13 - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow - Fix CVE-2026-2006: PostgreSQ…

Mar 5, 2026
Medium max 6.5

ELSA-2026-3939 1 CVE

Moderate: nfs-utils security update (Oracle Linux 10)

[2.8.3-0.0.1.el10_1.3] - remove multiple warnings when upgrading nfs-utils with gssproxy [2.8.3-3] - Add requires for selinux-policy (RHEL-127092) [2.8.3-2] - mountd: Minor refactor of get_rootfh() (RHEL-127092) - mountd: Separate lookup of the exported direc…

Mar 5, 2026
High max 8.8

ELSA-2026-1581 3 CVEs

Important: kernel security update (Oracle Linux 7)

[3.10.0-1160.119.1.0.18] - e1000e: fix heap overflow in e1000_set_eeprom {CVE-2025-39898} [Orabug: 38904071] - i40e: fix idx validation in config queues msg {CVE-2025-39971} [Orabug: 38904071] - vsock: track pkt owner vsock [Orabug: 38904071] - vhost-vsock: a…

Mar 4, 2026
Medium max 5.9

ELSA-2026-3638 1 CVE

Moderate: nginx:1.24 security update (Oracle Linux 9)

[1.24.0-5.1.0.1] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-5.1] - Resolves: RHEL-146526 - nginx:1.24/nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connec…

Mar 4, 2026
High max 7.5

ELSA-2026-3668 1 CVE

Important: go-rpm-macros security update (Oracle Linux 9)

[3.6.0-13] - Rebuild with latest Go - Resolves: RHEL-146862

Mar 3, 2026
High max 7.5

ELSA-2026-3669 1 CVE

Important: go-rpm-macros security update (Oracle Linux 10)

[3.6.0-7] - Rebuild with latest Go [3.6.0-6] - Update CI support [3.6.0-5] - Add riscv64 to golang_arches for RHEL 10+

Mar 3, 2026
High max 8.6

ELSA-2026-2628 2 CVEs

Important: libsoup security update (Oracle Linux 7)

[2.62.2-2.0.11] - Fixes CVE-2026-0719 CVE-2026-1761 [Orabug: 38958074] [2.62.2-2.0.9] - Fix CVE-2025-14523 [Orabug: 38873507] [2.62.2-2.0.7] - Backport patch for CVE-2025-4945 and CVE-2025-11021 [Orabug: 38664275] [2.62.2-2.0.5] - Fixes CVE-2025-2784 CVE-2025…

Mar 2, 2026
High max 7.8

ELSA-2026-50134 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.352.5.1] - xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca) [Orabug: 39016499] - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca) [Orabug: 39016499] - Revert 'xfrm: destroy xfr…

Mar 2, 2026
Medium

ELSA-2026-3464 1 CVE

Moderate: kernel security update (Oracle Linux 8)

[4.18.0-553.109.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Mar 2, 2026
High max 10.0

ELSA-2026-3515 38 CVEs

Important: thunderbird security update (Oracle Linux 8)

[140.8.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.8.0] - Add OpenELA debranding [140.8.0-1] - Update to 140.8.0 ESR

Mar 2, 2026
Medium max 8.1

ELSA-2026-3488 3 CVEs

Moderate: kernel security update (Oracle Linux 9)

[5.14.0-611.36.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Mar 2, 2026
High max 8.5

ELSA-2026-3507 2 CVEs

Important: valkey security update (Oracle Linux 9)

[8.0.7-1] - Rebase to 8.0.7 for CVE-2026-21863 CVE-2025-67733

Mar 2, 2026
High max 10.0

ELSA-2026-3516 38 CVEs

Important: thunderbird security update (Oracle Linux 9)

[140.8.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.8.0] - Add OpenELA debranding [140.8.0-1] - Update to 140.8.0 ESR

Mar 2, 2026
High max 7.1

ELSA-2026-3476 2 CVEs

Important: udisks2 security update (Oracle Linux 10)

[2.10.90-6.0.1.el10_1.1] - Enable btrfs support for OL supported arches [Orabug: 37464632] [2.10.90-6.1] - Add missing polkit check for RestoreEncryptedHeader() (CVE-2026-26103) (RHEL-148565) - Add missing polkit check for HeaderBackup() (CVE-2026-26104) (RHE…

Mar 2, 2026
Medium max 5.3

ELSA-2026-3477 2 CVEs

Moderate: gnutls security update (Oracle Linux 10)

[3.8.10-3] - Fix CVE-2025-9820, CVE-2025-14831, drop unused patches - Fix PKCS#11 token initialization label overflow (CVE-2025-9820) - Fix name constraint processing performance issue (CVE-2025-14831) - Drop unused patches

Mar 2, 2026
High max 10.0

ELSA-2026-3517 38 CVEs

Important: thunderbird security update (Oracle Linux 10)

[140.8.0-2.0.1] - Add Oracle prefs [140.8.0-2] - Update to 140.8.0 ESR

Mar 2, 2026
High max 8.3

ELSA-2026-3551 3 CVEs

Important: libpng security update (Oracle Linux 10)

[2:1.6.40-8.2] - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148323) - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148818) - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-146645)

Mar 2, 2026
High max 7.5

ELSA-2026-3407 1 CVE

Important: mingw-fontconfig security update (Oracle Linux 8)

[2.12.6-4] - Rebuilt with mingw-expat fix Related: RHEL-114628

Feb 27, 2026
High max 7.8

ELSA-2026-50133 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-317.197.5.2] - xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca) [Orabug: 39016261] - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca) [Orabug: 39016261] - Revert 'xfrm: destroy xfrm…

Feb 27, 2026
High max 7.5

ELSA-2026-3428 3 CVEs

Important: container-tools:ol8 security update (Oracle Linux 8)

aardvark-dns [2:1.10.1-2] - build off the RHEL maintenance branch - Resolves: RHEL-59129 buildah [2:1.33.14-2] - rebuild for CVE-2025-61729 - Resolves: RHEL-140529 cockpit-podman [84.1-1] - update to https://github.com/cockpit-project/cockpit-podman/releases/…

Feb 26, 2026
High max 10.0

ELSA-2026-3338 38 CVEs

Important: firefox security update (Oracle Linux 8)

[140.8.0-2.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] [140.8.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.8.0-2] - Update to 140.8.0 ESR

Feb 26, 2026
High max 8.3

ELSA-2026-3405 3 CVEs

Important: libpng security update (Oracle Linux 9)

[2:1.6.37-12.2] - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148970) - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148403) - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147343)

Feb 26, 2026
High max 10.0

ELSA-2026-3339 38 CVEs

Important: firefox security update (Oracle Linux 9)

[140.8.0-2.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.8.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Ab…

Feb 26, 2026
High max 8.5

ELSA-2026-3443 2 CVEs

Important: valkey security update (Oracle Linux 10)

[8.0.7-1] - Rebase to 8.0.7 for CVE-2026-21863 CVE-2025-67733

Feb 26, 2026
High max 10.0

ELSA-2026-3361 38 CVEs

Important: firefox security update (Oracle Linux 10)

[140.8.0-2.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.8.0-2] - Update to 140.8.0 ESR

Feb 26, 2026
High max 5.6

ELSA-2026-3334 3 CVEs

Important: freerdp security update (Oracle Linux 8)

[2:2.11.7-3] - Backport several CVE fixes Resolves: RHEL-148825, RHEL-148865, RHEL-148982

Feb 25, 2026
High max 9.1

ELSA-2026-3291 3 CVEs

Important: runc security update (Oracle Linux 9)

[4:1.4.0-2] - Rebuild for new golang to address CVE-2025-68121 - Resolves: RHEL-149630

Feb 25, 2026
High max 9.1

ELSA-2026-3340 3 CVEs

Important: skopeo security update (Oracle Linux 9)

[1:1.20.0-3] - Rebuild for new golang to address CVE-2025-61726 - Resolves: RHEL-146872

Feb 25, 2026
High max 9.1

ELSA-2026-3341 3 CVEs

Important: containernetworking-plugins security update (Oracle Linux 9)

[1:1.7.1-3] - Rebuild for new golang to address CVE-2025-61726 - Resolves: RHEL-146859 [1:1.7.1-2] - rebuild for CVE-2025-22871 - Resolves: RHEL-90030

Feb 25, 2026
High max 9.1

ELSA-2026-3298 3 CVEs

Important: buildah security update (Oracle Linux 9)

[1.41.8-2.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.41.8-2] - Rebuild with golang 1.25.7 to fix CVE-2025-68121 - Resolves: RHEL-149617

Feb 25, 2026
High max 9.1

ELSA-2026-3337 4 CVEs

Important: podman security update (Oracle Linux 9)

[5.6.0-14.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.6.0-14] - Rebuild for new golang to ad…

Feb 25, 2026
High max 7.5

ELSA-2026-3359 1 CVE

Important: python-pyasn1 security update (Oracle Linux 9)

[0.4.8-7] - Resolves: RHEL-148154

Feb 25, 2026
High max 9.1

ELSA-2026-3297 3 CVEs

Important: buildah security update (Oracle Linux 10)

[1.41.8-2.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.41.8-2] - Rebuild for new golang to address CVE-2025-61726 - Resolves: RHEL-146715

Feb 25, 2026
High max 9.1

ELSA-2026-3336 4 CVEs

Important: podman security update (Oracle Linux 10)

[5.6.0-12.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.6.0-12] - Rebuild for new golang to ad…

Feb 25, 2026
High max 9.1

ELSA-2026-3343 3 CVEs

Important: skopeo security update (Oracle Linux 10)

[1:1.20.0-3] - Rebuild for new golang to address CVE-2025-61726 - Resolves: RHEL-146730

Feb 25, 2026
High max 7.5

ELSA-2026-3354 1 CVE

Important: python-pyasn1 security update (Oracle Linux 10)

[0.6.2-1] - Update to 0.6.2 - Update modules to 0.4.2 Resolves: RHEL-148142

Feb 25, 2026
Medium max 8.1

ELSA-2026-3275 4 CVEs

Moderate: kernel security update (Oracle Linux 10)

[6.12.0-124.39.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Feb 25, 2026
High max 7.8

ELSA-2026-1590 1 CVE

Important: gimp security update (Oracle Linux 7)

[2.8.22-1.0.5] - Fixes CVE-2025-14422 [Orabug: 38904303] [2:2.22-1.0.5] - Fixes CVE-2025-10922 and CVE-2025-10934 [Orabug: 38739185] [2:2.8.22-1.0.3] - Fixes CVE-2025-5473 (GIMP ICO File Parsing Integer Overflow) [Orabug: 38110877] - Fixes CVE-2025-48797 (Mul…

Feb 24, 2026
High max 7.8

ELSA-2026-3083 5 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.107.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Feb 24, 2026
High max 9.1

ELSA-2026-3187 2 CVEs

Important: grafana-pcp security update (Oracle Linux 8)

[5.1.1-12] - Resolves RHEL-146096: CVE-2025-61726 - Resolves RHEL-149272: CVE-2025-68121

Feb 24, 2026