Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

  • Low
    ELSA-2021-1064 1 CVE

    Low: virt:ol and virt-devel:ol security update (Oracle Linux 8)

    libvirt [6.0.0-28.1.0.1] - Add runtime deps for pkg librbd1 >= 1:10.2.5 (Keshav Sharma) qemu-kvm [4.2.0-34.el8_3.5] - kvm-Drop-bogus-IPv6-messages.patch [bz#1939493] - Resolves: bz#1939493 (CVE-2020-10756 virt:rhel/qemu-kvm: QEMU: slirp: networking out-of-bou…

  • High max 7.8
    ELSA-2026-2707 1 CVE

    Important: gimp security update (Oracle Linux 9)

    [2:3.0.4-1.3] - fix CVE-2025-15059

  • High max 9.1
    ELSA-2026-2709 4 CVEs

    Important: golang security update (Oracle Linux 9)

    [1.25.7-1] - Update to Go 1.25.7 (fips-1) - Resolves: RHEL-146476

  • Medium max 9.8
    ELSA-2026-2722 7 CVEs

    Moderate: kernel security update (Oracle Linux 9)

    [5.14.0-611.34.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 9.1
    ELSA-2026-2706 4 CVEs

    Important: golang security update (Oracle Linux 10)

    [1.25.7-1] - Rebase to latest rhel-10-main (170a5b7e084)

  • High max 8.4
    ELSA-2026-2719 1 CVE

    Important: gnupg2 security update (Oracle Linux 10)

    [2.4.5-4] - Fix CVE-2026-24882 (tpm2daemon buffer overflow)

  • Medium max 8.0
    ELSA-2026-2721 7 CVEs

    Moderate: kernel security update (Oracle Linux 10)

    [6.12.0-124.38.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 9.8
    ELSA-2026-50113 74 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-317.197.5.1] - Revert 'net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn' (Vijayendra Suman) [Orabug: 38961010] - Revert 'net/rds: expand kref coverage to rds_notifier->n_conn' (Sharath Srinivasan) [Orabug: 38961010] [5.15.0-317.197…

  • Medium max 9.8
    ELSA-2026-1720 1 CVE

    Moderate: openssl security update (Oracle Linux 7)

    [1:1.0.2k-26.0.1] - Fixes CVE-2025-9230 Fix incorrect check of unwrapped key size [Orabug: 38916245]

  • High max 7.5
    ELSA-2026-2421 6 CVEs

    Important: nodejs:22 security update (Oracle Linux 8)

    nodejs [1:22.22.0-1] - Update to 22.22.0 Resolves: RHEL-118152 nodejs-nodemon [3.0.1-1] - Exclude ix86 arches from building. Related: RHEL-35991 nodejs-packaging [2021.06-4] - Exclude ix86 arches from building. Related: RHEL-35991

  • Medium max 5.3
    ELSA-2026-2627 1 CVE

    Moderate: gcc-toolset-14-binutils security update (Oracle Linux 8)

    [2.41-3.1] - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-130636) * Thu Feb 20 2025 Nick Clifton <nickc@redhat.com> - Backport fixes for PR 32082 and PR 32153 in order to fix the PR 20267 linker tests. [2.41-3] - NVR Bump to …

  • High max 8.2
    ELSA-2026-0925 1 CVE

    Important: libsoup security update (Oracle Linux 7)

    [2.62.2-2.0.9] - Fix CVE-2025-14523 [Orabug: 38873507] [2.62.2-2.0.7] - Backport patch for CVE-2025-4945 and CVE-2025-11021 [Orabug: 38664275] [2.62.2-2.0.5] - Fixes CVE-2025-2784 CVE-2025-4948 CVE-2025-32049 [Orabug: 38085184] - CVE-2025-32906 CVE-2025-32911…

  • Medium max 7.7
    ELSA-2026-1608 1 CVE

    Moderate: glib2 security update (Oracle Linux 7)

    [2.56.1-9.0.3] - Fixes CVE-2025-13601 g_escape_uri_string() overflow [Orabug: 38909821] [2.56.1-9.0.1] - Fix overflow of GDBusConnection serial [Orabug: 38666376]

  • High max 7.5
    ELSA-2026-2422 6 CVEs

    Important: nodejs:20 security update (Oracle Linux 8)

    nodejs [1:20.20.0-1] - Update to version 20.20.0 Resolves: RHEL-130972 nodejs-nodemon [3.0.1-1] - Rebase to 3.0.1 - Resolves: CVE-2022-25883

  • Medium max 6.5
    ELSA-2026-2470 13 CVEs

    Moderate: php:7.4 security update (Oracle Linux 8)

    libzip [1.6.1-1] - update to 1.6.1 - enable lzma support php [7.4.33-3] - Fix Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface GHSA-4w77-75f9-2c8w - Fix Configuring a proxy in a stream context might allow for CRLF injection in URIs …

  • High max 7.5
    ELSA-2026-2389 1 CVE

    Important: brotli security update (Oracle Linux 8)

    [1.0.6-4] - Resolves: RHEL-133986 CVE-2025-6176 Brotli decompression bomb DoS in scrapy

  • Medium max 6.3
    ELSA-2026-2419 1 CVE

    Moderate: python3.12 security update (Oracle Linux 8)

    [3.12.12-2] - Security fix for CVE-2025-13836 Resolves: RHEL-140993

  • High max 7.5
    ELSA-2026-2420 6 CVEs

    Important: nodejs:24 security update (Oracle Linux 8)

    nodejs [1:24.13.0-1] - Update to 24.13.0 Resolves: RHEL-135257 [1:24.4.1-1] - Initial import of nodejs:24 nodejs-nodemon [3.0.3-1] - Initial import into nodejs:24 module nodejs-packaging [2021.06-6] - Properly handle @group/package deps in nodejs-symlink-deps…

  • High max 6.9
    ELSA-2026-2452 1 CVE

    Important: pcs security update (Oracle Linux 9)

    [0.11.10-1.el9_7.2] - Fixed CVE-2025-13465 by updating pcs-web-ui to 0.1.23.1 Resolves: RHEL-144292

  • High max 8.6
    ELSA-2026-2410 1 CVE

    Important: libsoup3 security update (Oracle Linux 10)

    [3.6.5-10] - Add patch for CVE-2026-1761 [3.6.5-9] - Fix CVE-2026-0719 [3.6.5-8] - Fix CVE-2025-14523 [3.6.5-7] - Add patch for CVE-2025-12105 [3.6.5-6] - Fix integer overflow in date/time parsing [3.6.5-5] - Bump revision number [3.6.5-4] - Fix several CVEs

  • High max 6.9
    ELSA-2026-2438 1 CVE

    Important: pcs security update (Oracle Linux 10)

    [0.12.1-1.el10_1.2] - Fixed CVE-2025-13465 by updating pcs-web-ui to 0.1.23.1 Resolves: RHEL-144292

  • High max 7.5
    ELSA-2026-0931 3 CVEs

    Important: java-1.8.0-openjdk security update (Oracle Linux 7)

    [1.8.0.482.b08-1.0.1] - Update to 8u482-b08 (GA). [Orabug: 38893614] - Update release notes for 8u482-b08. - Resolves: RHEL-142689 - Resolves: RHEL-139521 - Resolves: RHEL-131446 - Resolves: RHEL-131459 - Resolves: RHEL-142865 - Resolves: RHEL-142696 - Fixes …

  • High max 8.6
    ELSA-2026-2215 2 CVEs

    Important: libsoup security update (Oracle Linux 8)

    [2.62.3-13] - Backport patch for CVE-2026-1761 [2.62.3-12] - Backport patch for CVE-2026-0719 - Fix NTLM authentication test failures in FIPS mode

  • High max 9.8
    ELSA-2026-2220 13 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [140.7.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.7.0] - Add OpenELA debranding [140.7.0-1] - Update to 140.7.0 ESR

  • High max 7.5
    ELSA-2026-2323 1 CVE

    Important: git-lfs security update (Oracle Linux 8)

    [3.4.1-7] - Rebuild with new Golang - Resolves: RHEL-140536

  • High max 8.1
    ELSA-2026-2264 8 CVEs

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.104.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 8.6
    ELSA-2026-2216 2 CVEs

    Important: libsoup security update (Oracle Linux 9)

    [2.72.0-12.5] - Backport patch for CVE-2026-1761 [2.72.0-12.4] - Backport patch for CVE-2026-0719 - Fix NTLM authentication test failures in FIPS mode

  • Critical max 9.4
    ELSA-2026-2224 1 CVE

    Critical: keylime security update (Oracle Linux 9)

    [7.12.1-11.4] - CVE-2026-1709: Registrar authentication bypass Resolves: RHEL-145390

  • Medium max 8.8
    ELSA-2026-2212 16 CVEs

    Moderate: kernel security update (Oracle Linux 9)

    [5.14.0-611.30.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 8.8
    ELSA-2026-2230 3 CVEs

    Important: fontforge security update (Oracle Linux 10)

    [20230101-14] - Resolves: RHEL-138159 CVE-2025-15279 GUtils BMP File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138144 CVE-2025-15275 SFD File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138126 CVE-2025-15269 SFD File Parsing Use-After-Free

  • Critical max 9.4
    ELSA-2026-2225 1 CVE

    Critical: keylime security update (Oracle Linux 10)

    [7.12.1-16] - CVE-2026-1709: Registrar authentication bypass [7.12.1-15] - Registrar allows identity takeover via duplicate UUID registration [7.12.1-14] - Properly fix malformed TPM certificates workaround [7.12.1-13] - Avoid opening /dev/stdout when printin…

  • High max 9.8
    ELSA-2026-2271 13 CVEs

    Important: firefox security update (Oracle Linux 10)

    [140.7.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.7.0-1] - Update to 140.7.0 ESR

  • High max 9.8
    ELSA-2026-2286 13 CVEs

    Important: thunderbird security update (Oracle Linux 10)

    [140.7.0-1.0.1] - Add Oracle prefs [140.7.0-1] - Update to 140.7.0 ESR

  • Medium max 9.8
    ELSA-2026-2282 8 CVEs

    Moderate: kernel security update (Oracle Linux 10)

    [6.12.0-124.35.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 7.7
    ELSA-2026-2222 7 CVEs

    Important: freerdp security update (Oracle Linux 10)

    [2:3.10.3-5.1] - Backport several CVE fixes Resolves: RHEL-142413, RHEL-142397, RHEL-142381, RHEL-142365, RHEL-142349 Resolves: RHEL-142333, RHEL-142317

  • High max 9.8
    ELSA-2026-50100 30 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.352.5] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38879907] {CVE-2025-40022} [5.4.17-2136.352.4] - arm64: pensando: Must boot Ortano kernel with spin-table (Rob Gardner) [Orabug: 38821197] [5.4.17-2136.3…

  • High max 7.5
    ELSA-2026-2124 1 CVE

    Important: osbuild-composer security update (Oracle Linux 8)

    [101.4-3.0.1] - Support using repository definitons with OCI variables [JIRA: OLDIS-38657] - Update repositories to contain OCI variables - Remove image types Minimal-raw and wsl [JIRA: OLDIS-38123] - Increase default /boot size to 1GB [Orabug: 36827079] - su…

  • High max 9.8
    ELSA-2026-50095 5 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-316.196.4.2] - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca) - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon) - ext4: clear i_state_flags when alloc in…

  • High max 9.8
    ELSA-2026-50094 4 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-107.59.3.4] - mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38932996] {CVE-2025-40257} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38932973] {CVE-2025-40149} - mptcp: fix r…

  • Medium max 6.3
    ELSA-2026-1537 1 CVE

    Moderate: python security update (Oracle Linux 7)

    [2.7.5-94.0.3] - Fix for CVE-2025-12084 [Orabug: 38902314]