Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

High max 9.4

ELSA-2025-23530 12 CVEs

Important: python39:3.9 security update (Oracle Linux 8)

mod_wsgi numpy python39 [3.9.25-2] - Add explicit BR: libxcrypt-devel - Properly apply exported CFLAGS for dtrace/systemtap builds - Update to Python 3.9.25 - Move _sysconfigdata_d_linux*.py to the debug subpackage - Fedora contributions by: Bjorn Esser <bess…

Dec 23, 2025
Medium max 4.3

ELSA-2025-23948 1 CVE

Moderate: grafana security update (Oracle Linux 8)

[9.2.10-26.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-26] - Resolves RHEL-125664: CVE-2025-58183 - Resolves RHEL-132759: Grafana-selinux prevents plugins from searching cgroups

Dec 22, 2025
High max 7.8

ELSA-2025-28068 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.350.3.2] - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38786776] {CVE-2025-40271} [5.4.17-2136.350.3.1] - Reapply 'cpuidle: menu: Avoid discarding useful information' (Harshvardhan Jha) [Orabug: 38744458] - fbcon: fix integer overfl…

Dec 22, 2025
High max 7.3

ELSA-2025-23543 1 CVE

Important: container-tools:ol8 security update (Oracle Linux 8)

aardvark-dns buildah [2:1.33.13-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.33 (https://github.com/containers/buildah/commit/65707d0) - fixes '[Minor Incident] CVE-2025-52881 container-tools:rhel8/buildah: contain…

Dec 22, 2025
High max 9.8

ELSA-2025-23856 10 CVEs

Important: thunderbird security update (Oracle Linux 9)

[140.6.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.6.0] - Add OpenELA debranding [140.6.0-1] - Update to 140.6.0 ESR

Dec 22, 2025
High max 8.3

ELSA-2025-23919 3 CVEs

Important: httpd security update (Oracle Linux 9)

[2.4.62-7.0.1.3] - Replace index.html with Oracle's index page oracle_index.html. [2.4.62-7.3] - Resolves: RHEL-135063 - httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200) - Resolves: RHEL-135048 - httpd: Apache H…

Dec 22, 2025
High max 7.8

ELSA-2025-28067 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-315.196.5.2] - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [Orabug: 38786195] {CVE-2025-40280} - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38786194] {CVE-2025-40271} - vsock: Ignore signal/timeout on connect…

Dec 22, 2025
High max 7.8

ELSA-2025-28066 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-106.55.4.2] - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) {CVE-2025-40271} - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca) {CVE-2025-40215}

Dec 22, 2025
High max 8.3

ELSA-2025-23932 3 CVEs

Important: httpd security update (Oracle Linux 10)

[2.4.63-4.0.1.3] - Replace index.html with Oracle's index page oracle_index.html. [2.4.63-4.3] - Resolves: RHEL-135052 - httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200) - Resolves: RHEL-135035 - httpd: Apache H…

Dec 22, 2025
Medium max 4.3

ELSA-2025-23940 1 CVE

Moderate: python3.12 security update (Oracle Linux 10)

[3.12.12-1.0.1] - Remove upstream URL reference [3.12.12-1] - Update to 3.12.12 - Security fix for CVE-2025-8291 Resolves: RHEL-128361

Dec 22, 2025
High max 8.6

ELSA-2025-23745 1 CVE

Important: git-lfs security update (Oracle Linux 8)

[3.4.1-6] - Backport CVE-2025-26625 fixes - Resolves: RHEL-122423

Dec 21, 2025
High max 7.5

ELSA-2025-23739 1 CVE

Important: mod_md security update (Oracle Linux 9)

[1:2.4.26-1.1] - Resolves: RHEL-134496 - httpd: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)

Dec 21, 2025
High max 8.6

ELSA-2025-23744 1 CVE

Important: git-lfs security update (Oracle Linux 9)

[3.6.1-4] - Backport fix for CVE-2025-26625 - Resolves: RHEL-122431

Dec 21, 2025
High max 7.5

ELSA-2025-23738 1 CVE

Important: mod_md security update (Oracle Linux 10)

[1:2.4.26-4] - Resolves: RHEL-134483 - httpd: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)

Dec 21, 2025
Medium max 4.3

ELSA-2025-23374 1 CVE

Moderate: container-tools:ol8 security update (Oracle Linux 8)

aardvark-dns buildah cockpit-podman conmon containernetworking-plugins containers-common container-selinux criu crun fuse-overlayfs libslirp netavark oci-seccomp-bpf-hook podman [4.9.4-24.0.1] - Fixes issue of container created in cgroupv2 not start in cgroup…

Dec 19, 2025
Medium max 5.9

ELSA-2025-23309 3 CVEs

Moderate: php:8.3 security update (Oracle Linux 9)

php [8.3.26-1] - rebase to 8.3.26 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 [5.1.21-1] - update to 5.1.21 for PHP 8.1 #2070040 php-pecl-redis6 [6.1.0-2] - ignore 1 ONLINE test [6.1.0-1] - RHEL build [6.1.0-1] - update to 6.1.0 - drop …

Dec 19, 2025
Medium max 5.3

ELSA-2025-23306 2 CVEs

Moderate: binutils security update (Oracle Linux 10)

[2.41-58.0.1.2] - Forward-port Oracle patches to 2.41-58.2 - CVE-2025-11082 - CVE-2025-11083 Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: September-29-2025 David Faust <david.faust@oracle.com> - 2.41-58.0.1 - Forward-port Oracle patches t…

Dec 19, 2025
High max 7.8

ELSA-2025-22866 2 CVEs

Important: gimp security update (Oracle Linux 7)

[2:2.22-1.0.5] - Fixes CVE-2025-10922 and CVE-2025-10934 [Orabug: 38739185] [2:2.8.22-1.0.3] - Fixes CVE-2025-5473 (GIMP ICO File Parsing Integer Overflow) [Orabug: 38110877] - Fixes CVE-2025-48797 (Multiple heap buffer overflows in TGA parser) - Fixes CVE-20…

Dec 18, 2025
High max 8.6

ELSA-2025-22982 2 CVEs

Important: python-kdcproxy security update (Oracle Linux 7)

[0.3.2-3.0.1] - Use DNS discovery for declared realms only (CVE-2025-59088) [Orabug: 38745300] - Fix DoS vulnerability based on unbounded TCP buffering (CVE-2025-59089)

Dec 18, 2025
Medium max 3.6

ELSA-2025-23481 2 CVEs

Moderate: openssh security update (Oracle Linux 8)

[8.0p1-27.0.1] - Update upstream references [Orabug: 36587718] [8.0p1-27] - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-128400 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-128390

Dec 18, 2025
Medium max 5.3

ELSA-2025-23382 1 CVE

Moderate: binutils security update (Oracle Linux 8)

[2.30-128.0.1] - Forward port Oracle patches to 2.30-128 - CVE-2025-11083 Reviewed-by: TBD Oracle history: October-8-2025 Bruce McCulloch <bruce.mcculloch@oracle.com> - 2.30-127.0.1 - Forward port Oracle patches to 2.30-127. - Muting some failing ld-ctf tests…

Dec 18, 2025
High max 8.8

ELSA-2025-23663 6 CVEs 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.50.4-1] - Update to 2.50.4

Dec 18, 2025
Medium max 7.5

ELSA-2025-23383 1 CVE

Moderate: curl security update (Oracle Linux 8)

[7.61.1-34.el8_10.9] - cookie: don't treat the leading slash as trailing (CVE-2025-9086) Resolves: RHEL-121655

Dec 18, 2025
Medium max 8.1

ELSA-2025-23483 1 CVE

Moderate: libssh security update (Oracle Linux 9)

[0.10.4-17] - Bump spec to resolve build tagging issues [0.10.4-16] - Fix CVE-2025-5987 Resolves: RHEL-130051 - Workaround sshd failure rate limiting in tests Resolves: RHEL-135506

Dec 18, 2025
Medium max 3.6

ELSA-2025-23480 2 CVEs

Moderate: openssh security update (Oracle Linux 9)

[8.7p1-47.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37814929] - upstream: fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand [Orabug: 37647064] - Update upstream references [Orabug: 36564626] [8.7p1-47] - CVE-2025-61984: Reject usern…

Dec 18, 2025
High max 9.8

ELSA-2025-23241 3 CVEs

Important: kernel security update (Oracle Linux 9)

[5.14.0-611.16.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Dec 18, 2025
Medium max 4.3

ELSA-2025-23323 1 CVE

Moderate: python3.12 security update (Oracle Linux 9)

[3.12.12-1.0.1] - Remove upstream URL reference [3.12.12-1] - Update to 3.12.12 Resolves: RHEL-125856

Dec 18, 2025
Medium max 4.3

ELSA-2025-23325 1 CVE

Moderate: podman security update (Oracle Linux 9)

[5.6.0-9.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.6.0-9] - update to the latest content o…

Dec 18, 2025
Medium max 4.3

ELSA-2025-23326 1 CVE

Moderate: skopeo security update (Oracle Linux 9)

[1:1.20.0-2] - rebuild for CVE-2025-58183 - Resolves: RHEL-125717

Dec 18, 2025
Medium max 5.3

ELSA-2025-23336 1 CVE

Moderate: gcc-toolset-13-binutils security update (Oracle Linux 9)

[2.40-21.0.1.1] - Forward-port Oracle patches to 2.40-21.1. - CVE-2025-11083 - Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: April-02-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.40-21.0.1 - Forward-port Oracle patchs to 2.40-21. -…

Dec 18, 2025
Medium max 6.5

ELSA-2025-23342 4 CVEs

Moderate: python3.9 security update (Oracle Linux 9)

[3.9.25-2.0.1] - Remove upstream URL reference [3.9.25-2] - Move _sysconfigdata_d_linux*.py to the debug subpackage [3.9.25-1] - Update to Python 3.9.25 [3.9.24-1] - Update to Python 3.9.24

Dec 18, 2025
High max 8.8

ELSA-2025-23700 6 CVEs 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.50.4-1] - Update to 2.50.4

Dec 18, 2025
Medium max 5.3

ELSA-2025-23343 1 CVE

Moderate: binutils security update (Oracle Linux 9)

[2.35.2-67.0.1.1] - Merge Oracle patches to 2.35.2-67.1. - CVE-2025-11083 - Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: September-24-2025 Bruce McCulloch <bruce.mcculloch@oracle.com> - 2.35.2-67.0.1 - Merge Oracle patches to 2.35.2-66. -…

Dec 18, 2025
Medium max 4.3

ELSA-2025-23294 1 CVE

Moderate: skopeo security update (Oracle Linux 10)

[1:1.20.0-2] - rebuild for CVE-2025-58183 - Resolves: RHEL-125643

Dec 18, 2025
Medium max 4.3

ELSA-2025-23295 1 CVE

Moderate: podman security update (Oracle Linux 10)

[5.6.0-8.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.6.0-8] - update to the latest content o…

Dec 18, 2025
High max 8.6

ELSA-2025-23667 1 CVE

Important: git-lfs security update (Oracle Linux 10)

[3.6.1-4] - Backport fix for CVE-2025-26625

Dec 18, 2025
High max 7.8

ELSA-2025-23279 2 CVEs

Important: kernel security update (Oracle Linux 10)

[6.12.0-124.21.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Dec 17, 2025
Medium max 3.6

ELSA-2025-23479 2 CVEs

Moderate: openssh security update (Oracle Linux 10)

[9.9p1-12.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-12] - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-128397 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-128387

Dec 17, 2025
Medium max 8.1

ELSA-2025-23484 1 CVE

Moderate: libssh security update (Oracle Linux 10)

[0.11.1-5] - Fix CVE-2025-5987 Resolves: RHEL-130040

Dec 17, 2025
Medium max 7.8

ELSA-2025-21063 6 CVEs

Moderate: kernel security update (Oracle Linux 7)

[3.10.0-1160.119.1.0.14] - HID: core: fix shift-out-of-bounds in hid_report_raw_event {CVE-2022-48978} [Orabug: 38644370] - crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373} [Orabug: 38644370] - nfsd: don't ignore the return code of svc_proc_register() …

Dec 16, 2025