Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

  • High max 9.1
    ELSA-2026-3188 3 CVEs

    Important: grafana security update (Oracle Linux 8)

    [9.2.10-28.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-28] - Resolves RHEL-145418: CVE-2025-61728 - Resolves RHEL-146095: CVE-2025-61726 - Resolves RHEL-149271: CVE-2025-68121

  • Medium max 7.8
    ELSA-2026-3066 2 CVEs

    Moderate: kernel security update (Oracle Linux 9)

    [5.14.0-611.35.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • Medium max 7.2
    ELSA-2026-3189 1 CVE

    Moderate: 389-ds-base security update (Oracle Linux 9)

    [2.7.0-10] - Resolves: RHEL-123243 - Attribute uniqueness is not enforced upon modrdn operation [rhel-9.7.z] - Resolves: RHEL-123765 - 389-ds-base OpenScanHub Leaks Detected [rhel-9.7.z] - Resolves: RHEL-137083 - CVE-2025-14905 389-ds-base: 389-ds-base: Remot…

  • Medium max 7.2
    ELSA-2026-3208 1 CVE

    Moderate: 389-ds-base security update (Oracle Linux 10)

    [3.1.3-7] - Bump version to 3.1.3-7 - Resolves: RHEL-117764 - Replication online reinitialization of a large database gets stalled. [rhel-10.1.z] - Resolves: RHEL-123274 - LDAP high CPU usage while handling indexes with IDL scan limit at INT_MAX [rhel-10.1.z]…

  • High max 7.7
    ELSA-2026-3032 1 CVE

    Important: munge security update (Oracle Linux 8)

    [0.5.13-3] - Fix CVE-2026-25506 - Resolves: RHEL-148521

  • Medium max 7.4
    ELSA-2026-3042 1 CVE

    Moderate: openssl security update (Oracle Linux 8)

    [1:1.1.1k-15] - Fix CVE-2025-69419: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing ticket_lifetime_hint exceed 1 week in TLSv1.3 and breaks compliant clients Resolves: RHEL-149165 Resolves: RHEL-142715 [1:1.1.1k-14.1] - Backport fix…

  • High max 8.3
    ELSA-2026-3031 1 CVE

    Important: libpng15 security update (Oracle Linux 9)

    [1.5.30-14.1] - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148404)

  • High max 7.7
    ELSA-2026-3034 1 CVE

    Important: munge security update (Oracle Linux 9)

    [0.5.13-14.0.1] - Updated path for removal of unneeded init file [0.5.13-14] - Fix CVE-2026-25506 - Resolved: RHEL-148533

  • High max 9.1
    ELSA-2026-3040 3 CVEs

    Important: grafana-pcp security update (Oracle Linux 9)

    [5.1.1-12] - Resolves RHEL-146864: CVE-2025-61726 - Resolves RHEL-147082: CVE-2025-61729 - Resolves RHEL-149622: CVE-2025-68121

  • High max 5.6
    ELSA-2026-3067 3 CVEs

    Important: freerdp security update (Oracle Linux 9)

    [2:2.11.7-1.2] - Backport several CVE fixes Resolves: RHEL-148847, RHEL-148887, RHEL-149020

  • High max 8.2
    ELSA-2026-3095 1 CVE

    Important: protobuf security update (Oracle Linux 9)

    [3.14.0-17] - Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits

  • High max 9.1
    ELSA-2026-3035 3 CVEs

    Important: grafana-pcp security update (Oracle Linux 10)

    [5.3.0-2] - Resolves RHEL-146722: CVE-2025-61726 - Resolves RHEL-146927: CVE-2025-61729 - Resolves RHEL-149228: CVE-2025-68121

  • High max 7.7
    ELSA-2026-3033 1 CVE

    Important: munge security update (Oracle Linux 10)

    [0.5.15-11] - Fix CVE-2026-25506

  • High max 8.7
    ELSA-2026-3068 5 CVEs

    Important: freerdp security update (Oracle Linux 10)

    [2:3.10.3-5.2] - Backport several CVE fixes Resolves: RHEL-147912, RHEL-148815, RHEL-148859, RHEL-148892, RHEL-148973

  • High max 9.1
    ELSA-2026-3092 2 CVEs

    Important: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

    [0.9.27-5] - rebuilt to fix CVE-2025-68121, CVE-2025-61726

  • High max 8.2
    ELSA-2026-3094 1 CVE

    Important: protobuf security update (Oracle Linux 10)

    [3.19.6-15] - Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits [3.19.6-14] - Disable tests during build that are flaky [3.19.6-13] - Rebuilt for tests directory [3.19.6-12] - Copy patch from c9s to make emacs dependency optional Resolve…

  • High max 9.8
    ELSA-2026-50112 175 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-108.64.6.3] - net/rds: Fix issue with a revert in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38937451] [6.12.0-108.64.6.2] - Revert 'net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn' (Sharath Srinivasan) [Orabug: 38937451] - R…

  • High max 7.5
    ELSA-2026-0847 5 CVEs

    Important: java-11-openjdk security update (Oracle Linux 7)

    [1:11.0.31.0.1-1.0.1] - Update to jdk-11.0.31+1 [Orabug: 38950473] - Fixes CVE-2025-64720 CVE-2025-65018 CVE-2026-21925 - CVE-2026-21933 CVE-2026-21945

  • High max 7.8
    ELSA-2026-1677 1 CVE

    Important: gnupg2 security update (Oracle Linux 7)

    [2.0.22-5.0.1] - Fix CVE-2025-68973 (gpg.fail/memcpy) [Orabug: 38914175]

  • Medium max 7.5
    ELSA-2026-50118 2 CVEs

    Moderate: virt:kvm_utils3 security update (Oracle Linux 8)

    hivex [1.3.18-23] - Limit recursion in ri-records (CVE-2021-3622) resolves: rhbz#1976194 [1.3.18-22.el8] - Resolves: bz#2000225 (Rebase virt:rhel module:stream based on AV-8.6) [1.3.18-21] - Bounds check for block exceeding page length (CVE-2021-3504) resolve…

  • High max 9.8
    ELSA-2026-2231 13 CVEs

    Important: firefox security update (Oracle Linux 7)

    [140.7.0-1.0.1] - Update to 140.7.0 ESR [Orabug: 38940976][CVE-2025-14327][CVE-2026-0877] [CVE-2026-0878][CVE-2026-0879][CVE-2026-0880][CVE-2026-0882][CVE-2026-0883] [CVE-2026-0884][CVE-2026-0885][CVE-2026-0886][CVE-2026-0887][CVE-2026-0890] [CVE-2026-0891] […

  • High max 7.5
    ELSA-2026-2782 6 CVEs

    Important: nodejs:22 security update (Oracle Linux 9)

    nodejs [1:22.22.0-1] - Update to 22.22.0 Resolves: RHEL-141879 nodejs-nodemon [3.0.1-1] - Rebase to 3.0.1 - Resolves: CVE-2022-25883 [2.0.20-2] - Patch bundled glob-parent - Resolves: CVE-2021-35065 [2.0.20-1] - Rebase to 2.0.20 Resolves: CVE-2022-3517 [2.0.1…

  • High max 7.5
    ELSA-2026-2783 6 CVEs

    Important: nodejs:20 security update (Oracle Linux 9)

    nodejs [1:20.20.0-1] - Update to version 20.20.0 Resolves: RHEL-141917 nodejs-nodemon [3.0.1-1] - Rebase to 3.0.1 - Resolves: CVE-2022-25883 [2.0.20-2] - Patch bundled glob-parent - Resolves: CVE-2021-35065 [2.0.20-1] - Rebase to 2.0.20 Resolves: CVE-2022-351…

  • High max 9.1
    ELSA-2026-2920 5 CVEs

    Important: grafana security update (Oracle Linux 9)

    [10.2.6-17] - Resolves RHEL-144959: CVE-2026-21721 - Resolves RHEL-146863: CVE-2025-61726 - Resolves RHEL-147081: CVE-2025-61729 - Resolves RHEL-147370: CVE-2025-61728 - Resolves RHEL-149621: CVE-2025-68121 [10.2.6-17] - Resolves RHEL-125692: CVE-2025-58183 -…

  • High max 9.1
    ELSA-2026-2914 5 CVEs

    Important: grafana security update (Oracle Linux 10)

    [10.2.6-22] - Resolves RHEL-144948: CVE-2026-21721 - Resolves RHEL-146721: CVE-2025-61726 - Resolves RHEL-146926: CVE-2025-61729 - Resolves RHEL-147351: CVE-2025-61728 - Resolves RHEL-149227: CVE-2025-68121

  • Medium max 9.8
    ELSA-2026-0755 4 CVEs

    Moderate: kernel security update (Oracle Linux 7)

    [3.10.0-1160.119.1.0.17] - scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675} [Orabug: 38860426] - ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-53705} [Orabug: 38860426] - net_sched: hfsc: Fix a potential UAF in hfsc_deque…

  • Medium max 9.8
    ELSA-2026-2776 1 CVE

    Moderate: edk2 security update (Oracle Linux 9)

    [20241117-4.0.1.el9_7.3] - Replace upstream references [Orabug:36569119] [20241117-4.el9_7.3] - edk2-OvmfPkg-MemEncryptSevLib-Evict-cache-lines-during-SN.patch [RHEL-125104] - edk2-MdePkg-Add-the-COHERENCY_SFW_NO-CPUID-bit-field.patch [RHEL-125104] - edk2-Ovm…

  • High max 7.5
    ELSA-2026-2781 6 CVEs

    Important: nodejs:24 security update (Oracle Linux 9)

    nodejs [1:24.13.0-1] - Update to version 24.13.0 nodejs-nodemon [3.0.3-3] - Keep BR on just npm [3.0.3-2] - Fix BR for nodejs-npm nodejs-packaging [2021.06-6] - Properly handle @group/package deps in nodejs-symlink-deps Resolves: RHEL-121581 [2021.06-5] - nod…

  • Medium max 6.5
    ELSA-2026-2799 2 CVEs

    Moderate: php security update (Oracle Linux 9)

    [8.0.30-5] - Fix Null byte termination in dns_get_record() GHSA-www2-q4fc-65wf - Fix Heap buffer overflow in array_merge() CVE-2025-14178 - Fix Information Leak of Memory in getimagesize CVE-2025-14177

  • Medium max 8.4
    ELSA-2026-2786 3 CVEs

    Moderate: glibc security update (Oracle Linux 9)

    [2.34-231.0.1.10] - Forward-port Oracle patches for ol9-u7 Reviewed-by: [TBD] Oracle history: November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.2 - Forward-port Oracle patches for ol9-u7 Reviewed-by: Jose E. Marchesi <jose.march…

  • Medium max 9.8
    ELSA-2026-50114 1 CVE

    Moderate: openssl security update (Oracle Linux 7)

    [1.0.2k-26.0.1_fips] - Change Epoch from 1 to 10 - Fix DH self-test to add shared secret comparison [Orabug: 32467026] - Add DH support changes for SP 800-56A rev3 requirements [Orabug: 32467059] - Add TLS KDF self-test [Orabug: 32467193] - Add EC keys pairwi…

  • High max 7.5
    ELSA-2019-2726 2 CVEs

    Important: go-toolset:ol8 security and bug fix update (Oracle Linux 8)

    go-toolset [1.11.13-1] - Bump version to 1.11.13 - Related: rhbz#1743204 - Related: rhbz#1743206 golang [1.11.13-2] - Improve error message when using non-FIPS API in FIPS mode. - Fixes CVE-2019-9512. - Fixes CVE-2019-9514. - Resolves: rhbz#1745711 - Resolves…

  • High max 9.1
    ELSA-2026-2708 4 CVEs

    Important: go-toolset:ol8 security update (Oracle Linux 8)

    delve [1.25.2-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.25.2-1] - Update to Delve 1.25.2 (Sync from CentOS Stream 9) - Related: RHEL-121223 golang [1.25.7-1] - Update to Go 1.25.7 (fips-1) - Resolves: RHEL-146469

  • Medium max 8.8
    ELSA-2026-2720 3 CVEs

    Moderate: kernel security update (Oracle Linux 8)

    [4.18.0-553.105.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 7.8
    ELSA-2023-5264 2 CVEs

    Important: virt:ol and virt-devel:ol security and bug fix update (Oracle Linux 8)

    hivex libguestfs libguestfs-winsupport [8.8-2] - Rebase to ntfs-3g 2022.10.3 - Fixes: CVE-2022-40284 - resolves: rhbz#2236373 libiscsi libnbd libtpms libvirt libvirt-dbus libvirt-python nbdkit netcf perl-Sys-Virt qemu-kvm [6.2.0-33] - CVE-2023-3354 QEMU: VNC:…

  • Medium max 5.5
    ELSA-2023-3822 1 CVE

    Moderate: virt:ol and virt-devel:ol security and bug fix update (Oracle Linux 8)

    hivex libguestfs [1.44.0-9.0.1] - Replace upstream references from description tag - Config supermin to use host yum.conf in ol8 [Orabug: 29319324] - Set DISTRO_ORACLE_LINUX correspeonding to ol [1:1.44.0-9] - Fix CVE-2022-2211 Denial of Service in --key para…

  • Low max 6.5
    ELSA-2023-0099 1 CVE

    Low: virt:ol and virt-devel:ol security and bug fix update (Oracle Linux 8)

    libvirt [8.0.0-10.1.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] - Add runtime deps for pkg librbd1 >= 1:10.2.5 (Keshav Sharma) [8.0.0-10.1.el8] - qemu_process: Don't require a hugetlbfs mount for memfd (rhbz#2132176) - qemu_namespace: Toler…

  • Low
    ELSA-2022-0886 1 CVE

    Low: virt:ol and virt-devel:ol security update (Oracle Linux 8)

    qemu-kvm [4.2.0-59.el8_5.2] - kvm-virtiofsd-Drop-membership-of-all-supplementary-group.patch [bz#2048627] - Resolves: bz#2048627 (CVE-2022-0358 virt:rhel/qemu-kvm: QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405 [rhel-8.5.0.z])

  • Low
    ELSA-2021-5238 2 CVEs

    Low: virt:ol and virt-devel:ol security update (Oracle Linux 8)

    qemu-kvm [4.2.0-59.el8_5] - kvm-hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch [bz#2025605] - kvm-e1000-fix-tx-re-entrancy-problem.patch [bz#2025011] - Resolves: bz#2025605 (CVE-2021-3930 virt:rhel/qemu-kvm: QEMU: off-by-one error in mode_sense_pa…

  • Low
    ELSA-2021-3061 5 CVEs

    Low: virt:ol and virt-devel:ol security and bug fix update (Oracle Linux 8)

    hivex [1.3.18-21] - Bounds check for block exceeding page length (CVE-2021-3504) resolves: rhbz#1950501 libvirt [6.0.0-35.1.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] - Add runtime deps for pkg librbd1 >= 1:10.2.5 (Keshav Sharma) - Disable…