Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

  • High max 9.8
    ELSA-2026-50006 104 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-107.59.3.2] - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca) {CVE-2025-40215} [6.12.0-107.59.3.1] - Revert 'iommu/amd: Skip enabling command/event buffers for kdump' (Dongli Zhang) [Orabug: 38781323] [6.12.0-107.59.3] - rds: Add smp_rmb befor…

  • High max 7.8
    ELSA-2026-50005 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.351.3.1] - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38787139] {CVE-2025-40271} [5.4.17-2136.351.3] - Reapply 'cpuidle: menu: Avoid discarding useful information' (Harshvardhan Jha) [Orabug: 38715366] - fbcon: fix integer overflow…

  • High max 8.2
    ELSA-2026-0421 1 CVE

    Important: libsoup security update (Oracle Linux 8)

    [2.62.3-11] - Backport patch for CVE-2025-14523

  • High max 9.8
    ELSA-2026-0444 3 CVEs

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.92.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [O…

  • High max 8.2
    ELSA-2026-0422 1 CVE

    Important: libsoup security update (Oracle Linux 9)

    [2.72.0-12.3] - Fix patch for CVE-2025-14523 to handle comparison case-insensitively [2.72.0-12.2] - Backport patch for CVE-2025-14523 [2.72.0-12.1] - Backport patch for CVE-2025-4945 and CVE-2025-11021

  • High max 7.5
    ELSA-2026-0437 1 CVE

    Important: buildah security update (Oracle Linux 9)

    [1.41.8-1.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.41.8-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.41 (https://github.com/containers/buildah/commit/f85ff89) - fix…

  • Medium max 5.9
    ELSA-2026-0458 1 CVE

    Moderate: libpq security update (Oracle Linux 9)

    [13.23-1] - Rebase to upstream release 13.23 - Resolves: RHEL-131279 (CVE-2025-12818)

  • High max 7.5
    ELSA-2026-0470 1 CVE

    Important: podman security update (Oracle Linux 9)

    [5.6.0-11.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.6.0-11] - update to the latest content…

  • Medium max 8.8
    ELSA-2026-0445 4 CVEs

    Moderate: kernel security update (Oracle Linux 9)

    [5.14.0-611.20.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 8.2
    ELSA-2026-0423 1 CVE

    Important: libsoup3 security update (Oracle Linux 10)

    [3.6.5-8] - Fix CVE-2025-14523 [3.6.5-7] - Add patch for CVE-2025-12105 [3.6.5-6] - Fix integer overflow in date/time parsing [3.6.5-5] - Bump revision number [3.6.5-4] - Fix several CVEs

  • High max 7.5
    ELSA-2026-0436 1 CVE

    Important: buildah security update (Oracle Linux 10)

    [1.41.8-1.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.41.8-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.41 (https://github.com/containers/buildah/commit/f85ff89) - fix…

  • Medium max 6.0
    ELSA-2026-0464 2 CVEs

    Moderate: cups security update (Oracle Linux 10)

    [1:2.4.10-12.2] - fix use-after-free reported by OSH [1:2.4.10-12.1] - RHEL-129721 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack - RHEL-129715 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues

  • High max 9.8
    ELSA-2026-0453 9 CVEs

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-124.27.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 8.3
    ELSA-2026-0075 1 CVE

    Important: httpd security update (Oracle Linux 7)

    [2.4.6-99.0.9.1] - Fix CVE-2025-58098 [Orabug: 38816066] [2.4.6-99.0.7.1] - Fixed security update CVE-2024-47252 CVE-2025-49812 [Orabug: 38378160] [2.4.6-99.0.5.1] - Differentiate trusted sources [Orabug: 37100272][CVE-2024-38476] [2.4.6-99.0.3.1] - Opt-ins f…

  • High max 7.0
    ELSA-2026-0247 7 CVEs

    Important: mariadb:10.11 security update (Oracle Linux 9)

    galera mariadb [3:10.11.15-1] - Rebase to 10.11.15 - Resolves: RHBZ#2417697 [3:10.11.14-3] - Add installation of downstream sysusers.d config file in place of the upstream one [3:10.11.14-3] - Bump release for tmpfiles.d change [3:10.11.14-2] - Revert to soft…

  • Medium max 9.8
    ELSA-2026-0337 1 CVE

    Moderate: openssl security update (Oracle Linux 8)

    [1:1.1.1k-14] - Backport fix for Out-of-bounds read & write in RFC 3211 KEK Unwrap Fix CVE-2025-9230 Resolves: RHEL-128613 - Fix bug for ticket_lifetime_hint exceed issue Resolves: RHEL-119891

  • High max 7.0
    ELSA-2026-0225 1 CVE

    Important: mariadb:10.3 security update (Oracle Linux 8)

    galera Judy mariadb [3:10.3.39-2] - Release bump for rebuild

  • Medium max 6.0
    ELSA-2026-0312 2 CVEs

    Moderate: cups security update (Oracle Linux 9)

    [1:2.3.3op2-34.2] - fix use-after-free reported by OSH [1:2.3.3op2-34.1] - RHEL-129746 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack - RHEL-129738 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related i…

  • High max 7.1
    ELSA-2026-0125 3 CVEs

    Important: mingw-libpng security update (Oracle Linux 8)

    [1.6.34-1] - Rebase to version 1.6.34 - Fix the following CVEs CVE-2025-64720 CVE-2025-65018 CVE-2025-66293 - Resolves: RHEL-131458 - Resolves: RHEL-131471 - Resolves: RHEL-133229

  • High max 7.1
    ELSA-2026-0241 3 CVEs

    Important: libpng security update (Oracle Linux 8)

    [2:1.6.34-9] - CVE-2025-64720: buffer overflow (RHEL-131452) - CVE-2025-65018: heap buffer overflow (RHEL-131465) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133226) [2:1.6.34-8] - Remove redundant fix for CVE-2017-12652 [2:1.6.34-7…

  • High max 7.0
    ELSA-2026-0232 1 CVE

    Important: mariadb:10.11 security update (Oracle Linux 8)

    galera Judy mariadb [3:10.11.10-2] - Release bump for rebuild

  • High max 7.0
    ELSA-2026-0233 1 CVE

    Important: mariadb:10.5 security update (Oracle Linux 8)

    galera Judy mariadb [3:10.5.29-3] - Release bump for rebuild

  • High max 7.0
    ELSA-2026-0137 1 CVE

    Important: mariadb security update (Oracle Linux 9)

    [3:10.5.29-3] - Release bump for rebuild

  • High max 7.1
    ELSA-2026-0238 3 CVEs

    Important: libpng security update (Oracle Linux 9)

    [2:1.6.37-12.1] - CVE-2025-64720: buffer overflow (RHEL-131580) - CVE-2025-65018: heap buffer overflow (RHEL-131593) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133287)

  • High max 7.1
    ELSA-2026-0237 3 CVEs

    Important: libpng security update (Oracle Linux 10)

    [2:1.6.40-8.1] - CVE-2025-64720: buffer overflow (RHEL-131422) - CVE-2025-65018: heap buffer overflow (RHEL-131435) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133212)

  • High max 8.6
    ELSA-2025-22205 1 CVE

    Important: bind security update (Oracle Linux 7)

    [32:9.11.4-26.0.5.P2.16] - Resolve CVE-2025-40778 [Orabug: 38699863] [32:9.11.4-26.0.3.P2.16] - Resolve CVE-2024-11187 [Orabug: 37616907] [32:9.11.4-26.0.1.P2.16] - Resolve CVE-2024-1975 - Resolve CVE-2024-1737 - Add ability to change runtime limits for max t…

  • Medium max 4.0
    ELSA-2026-0130 1 CVE

    Moderate: poppler security update (Oracle Linux 8)

    [20.11.0-13] - Check bitmap in combine() - Resolves: RHEL-131786

  • Medium max 6.3
    ELSA-2026-0123 2 CVEs

    Moderate: python3.12 security update (Oracle Linux 8)

    [3.12.12-1] - Update to 3.12.12 - Security fix for CVE-2025-8291 and CVE-2025-12084 Resolves: RHEL-128364, RHEL-135391

  • Medium max 4.0
    ELSA-2026-0126 1 CVE

    Moderate: poppler security update (Oracle Linux 9)

    [21.01.0-23] - Bump release for build inheritance - Resolves: RHEL-131792 [21.01.0-22] - Check bitmap in combine() - Resolves: RHEL-131795, RHEL-131792

  • Medium max 5.3
    ELSA-2026-0108 1 CVE

    Moderate: gcc-toolset-15-binutils security update (Oracle Linux 10)

    [2.44-7.1] - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-130616)

  • Medium max 4.0
    ELSA-2026-0128 1 CVE

    Moderate: poppler security update (Oracle Linux 10)

    [24.02.0-7] - Check bitmap in combine() - Resolves: RHEL-131783, RHEL-131782

  • High max 7.0
    ELSA-2026-0136 7 CVEs

    Important: mariadb10.11 security update (Oracle Linux 10)

    [3:10.11.15-1] - Rebase to 10.11.15 - Resolves: RHBZ#2417697 [3:10.11.14-3] - Add installation of downstream sysusers.d config file in place of the upstream one [3:10.11.14-3] - Bump release for tmpfiles.d change [3:10.11.14-2] - Revert to soft static allocat…

  • Medium max 6.5
    ELSA-2025-23415 1 CVE

    Moderate: rsync security update (Oracle Linux 7)

    [3.1.2-12.0.3] - Fix CVE-2024-12087 [Orabug: 38771262] [3.1.2-12.0.1] * Back port fix for CVE-2024-12085 [Orabug: 37524229]

  • Medium max 7.5
    ELSA-2025-23457 1 CVE

    Moderate: audiofile security update (Oracle Linux 7)

    [1:0.3.6-9.0.1] - Fix null pointer dereference [CVE-2025-50950][Orabug: 38777980] [1:0.3.6-9] - Apply security patches. CVE-2018-17095, CVE-2018-13440 - Resolves: rhbz#1600369, rhbz#1601014, rhbz#1637128 [1:0.3.6-8] - Escape macros in %changelog [1:0.3.6-7] -…

  • High max 9.8
    ELSA-2026-0026 10 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [140.6.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [140.6.0] - Add OpenELA debranding [140.6.0-1] - Update to 140.6.0 ESR

  • Medium max 5.3
    ELSA-2026-0052 1 CVE

    Moderate: gcc-toolset-14-binutils security update (Oracle Linux 9)

    [2.41-5.1] - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-130669)

  • Medium max 4.1
    ELSA-2026-0067 1 CVE

    Moderate: tar security update (Oracle Linux 9)

    [2:1.34-9] - Fix the last patch to solve a regression with -x and --xattrs: RHEL-136277 also, fix another tiny mistake in the patch (w/o visible consequences) [2:1.34-8] - Backport upstream changes to jailify extraction directory Includes related gnulib chang…

  • Medium max 4.1
    ELSA-2026-0002 1 CVE

    Moderate: tar security update (Oracle Linux 10)

    [2:1.35-9] - Fix a tiny mistake in the last patch affecting hardling extraction (w/o visible consequences) [2:1.35-8] - Backport upstream changes to jailify extraction directory Includes related gnulib changes to add openat2 Fixes CVE-2025-45582

  • High max 9.8
    ELSA-2026-0025 10 CVEs

    Important: thunderbird security update (Oracle Linux 10)

    [140.6.0-1.0.1] - Add Oracle prefs [140.6.0-1] - Update to 140.6.0 ESR

  • High max 8.3
    ELSA-2025-23732 4 CVEs

    Important: httpd:2.4 security update (Oracle Linux 8)

    httpd [2.4.37-65.0.1.7] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-65.7] - Resolves: RHEL-135054 - httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200) - Resolves: RHEL-135039 - httpd: A…