Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

High max 8.2

ELSA-2025-23210 1 CVE

Important: keylime security update (Oracle Linux 9)

[7.12.1-11.3] - Registrar allows identity takeover via duplicate UUID registration Resolves: RHEL-130760 [7.12.1-11.2] - Properly fix the malformed certificate workaround Resolves: RHEL-111244

Dec 16, 2025
High max 8.2

ELSA-2025-23201 1 CVE

Important: keylime security update (Oracle Linux 10)

[7.12.1-15] - Registrar allows identity takeover via duplicate UUID registration [7.12.1-14] - Properly fix malformed TPM certificates workaround [7.12.1-13] - Avoid opening /dev/stdout when printing [7.12.1-12] - Fix malformed TPM certificates workaround

Dec 16, 2025
High max 8.8

ELSA-2025-17453 7 CVEs

Important: firefox security update (Oracle Linux 7)

[140.3.0-1.0.1] - Update to 140.3.0 [Orabug: 38509157][CVE-2025-10527][CVE-2025-10528] [CVE-2025-10529][CVE-2025-10532][CVE-2025-10533][CVE-2025-10536] [CVE-2025-10537] - Disable SVE parts of libyuv if not supported [Orabug: 38509157]

Dec 15, 2025
High max 9.8

ELSA-2025-19278 7 CVEs

Important: firefox security update (Oracle Linux 7)

[140.4.0-4.0.1] - Update to 140.4.0 ESR [Orabug: 38595697][CVE-2025-11708][CVE-2025-11709] [CVE-2025-11710][CVE-2025-11711][CVE-2025-11712][CVE-2025-11714] [CVE-2025-11715]

Dec 15, 2025
High max 8.8

ELSA-2025-22371 9 CVEs

Important: firefox security update (Oracle Linux 7)

[140.5.0-1.0.1] - Update to 140.5.0 ESR [Orabug: 38708474][CVE-2025-13012][CVE-2025-13013] [CVE-2025-13014][CVE-2025-13015][CVE-2025-13016][CVE-2025-13017] [CVE-2025-13018][CVE-2025-13019][CVE-2025-13020]

Dec 15, 2025
Low max 7.3

ELSA-2025-22040 3 CVEs

Low: xorg-x11-server security update (Oracle Linux 7)

[1.20.4-29.0.5] - Security update for CVE-2025-62229 CVE-2025-62230 CVE-2025-62231 [Orabug: 38691191] [1.20.4-29.0.3] - Fix CVE-2025-49175, CVE-2025-49176, CVE-2025-49178, CVE-2025-49179, CVE-2025-49180 [Orabug: 38157695] [1.20.4-29.0.1] - Fixed CVE-2025-2659…

Dec 12, 2025
Medium max 5.5

ELSA-2025-23137 8 CVEs

Moderate: mysql:8.4 security update (Oracle Linux 8)

mecab mecab-ipadic mysql [8.4.7-1] - Rebase to 8.4.7

Dec 12, 2025
Medium max 5.5

ELSA-2025-23134 8 CVEs

Moderate: mysql:8.0 security update (Oracle Linux 8)

mecab mecab-ipadic mysql [8.0.44-1] - Rebase to MySQL 8.0.44

Dec 12, 2025
High max 8.8

ELSA-2025-28049 65 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.350.3.1] - Reapply 'cpuidle: menu: Avoid discarding useful information' (Harshvardhan Jha) [Orabug: 38744458] - fbcon: fix integer overflow in font allocation (Samasth Norway Ananda) [Orabug: 38744453] [5.4.17-2136.350.3] - net/rds: Fix rs_recv_p…

Dec 12, 2025
Medium max 5.5

ELSA-2025-23111 8 CVEs

Moderate: mysql:8.4 security update (Oracle Linux 9)

mecab mecab-ipadic mysql [8.4.7-1] - Rebase to 8.4.7 rapidjson

Dec 12, 2025
High max 9.8

ELSA-2025-28048 79 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-315.196.5.1] - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso) [Orabug: 38744086] {CVE-2025-38678} - Reapply 'cpuidle: menu: Avoid discarding useful information' (Harshvardhan Jha) [Orabug: 38744084] - rtc: expose RTC_FEAT…

Dec 12, 2025
Medium max 5.5

ELSA-2025-23109 8 CVEs

Moderate: mysql security update (Oracle Linux 9)

[8.0.44-1] - Rebase to MySQL 8.0.44

Dec 12, 2025
Medium max 7.5

ELSA-2025-23062 3 CVEs

Moderate: ruby:3.3 security update (Oracle Linux 8)

ruby [3.3.10-5] - Upgrade to Ruby 3.3.10. Resolves: RHEL-106820 - Fix possible denial of service in resolv gem (CVE-2025-24294) - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594) - Fix REXML denial of service. (CVE-2025-58767) Resolves: RHEL…

Dec 11, 2025
High max 9.8

ELSA-2025-23128 10 CVEs

Important: firefox security update (Oracle Linux 8)

[140.6.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] [140.6.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.6.0-1] - Update to 140.6.0 ESR

Dec 11, 2025
High max 7.8

ELSA-2025-23142 1 CVE

Important: wireshark security update (Oracle Linux 9)

[1:3.4.10-8.1] - Resolves: RHEL-130438 - Access of Uninitialized Pointer in Wireshark

Dec 11, 2025
High max 7.0

ELSA-2025-28047 4 CVEs

Important: edk2 security update (Oracle Linux 9)

[20250905-4] - Create new 20250905 release for OL9 which includes the following fixed CVEs: - EDK2: EDK2 contains a vulnerability in BIOS where an attacker may cause 'Protection Mechanism Failure' by local access [Orabug: 38381983] {CVE-2025-3770} - EDK2: EDK…

Dec 11, 2025
Medium max 7.5

ELSA-2025-23063 3 CVEs

Moderate: ruby:3.3 security update (Oracle Linux 9)

ruby [3.3.10-5] - Upgrade to Ruby 3.3.10. Resolves: RHEL-127912 - Fix possible denial of service in resolv gem (CVE-2025-24294) - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594) - Fix REXML denial of service. (CVE-2025-58767) Resolves: RHEL…

Dec 11, 2025
Medium max 7.5

ELSA-2025-23139 1 CVE

Moderate: libsoup3 security update (Oracle Linux 10)

[3.6.5-7] - Add patch for CVE-2025-12105

Dec 11, 2025
Medium max 7.5

ELSA-2025-23141 3 CVEs

Moderate: ruby security update (Oracle Linux 10)

[3.3.10-11] - Upgrade to Ruby 3.3.10. Resolves: RHEL-130160 - Fix possible denial of service in resolv gem (CVE-2025-24294) - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594) - Fix REXML denial of service. (CVE-2025-58767) Resolves: RHEL-122…

Dec 11, 2025
High max 9.0

ELSA-2025-21657 9 CVEs

Important: libsoup security update (Oracle Linux 7)

[2.62.2-2.0.7] - Backport patch for CVE-2025-4945 and CVE-2025-11021 [Orabug: 38664275] [2.62.2-2.0.5] - Fixes CVE-2025-2784 CVE-2025-4948 CVE-2025-32049 [Orabug: 38085184] - CVE-2025-32906 CVE-2025-32911 CVE-2025-32913 CVE-2025-32914 [2.62.2-2.0.3] - Fixed C…

Dec 10, 2025
High max 7.3

ELSA-2025-22096 3 CVEs

Important: tigervnc security update (Oracle Linux 7)

[1.8.0-33.0.9] - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation [Orabug: 38694278] - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal - Fix CVE-2025-62231: xorg-x11-server: Value ove…

Dec 10, 2025
Critical max 9.8

ELSA-2025-21404 1 CVE

Critical: lasso security update (Oracle Linux 7)

[2.5.1-8.0.1] - Fixes CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso [Orabug: 38658691]

Dec 10, 2025
High max 9.8

ELSA-2025-23048 2 CVEs

Important: tomcat security update (Oracle Linux 8)

[1:9.0.87-1.7] - Resolves: RHEL-124507 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) - Resolves: RHEL-91743 tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

Dec 10, 2025
Medium max 4.4

ELSA-2025-23086 1 CVE

Moderate: luksmeta security update (Oracle Linux 8)

[9-4.1] - Fix handling of large metadata Resolves: RHEL-122138

Dec 10, 2025
High max 9.8

ELSA-2025-23049 2 CVEs

Important: tomcat security update (Oracle Linux 9)

[1:9.0.87-6.1] - Resolves: RHEL-124518 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) - Resolves: RHEL-91753 tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

Dec 10, 2025
Medium max 4.3

ELSA-2025-23087 1 CVE

Moderate: grafana security update (Oracle Linux 9)

[10.2.6-17] - Resolves RHEL-125692: CVE-2025-58183 - Resolves RHEL-120426: Grafana-selinux prevents plugins from searching cgroups

Dec 10, 2025
High max 9.8

ELSA-2025-23034 10 CVEs

Important: firefox security update (Oracle Linux 9)

[140.6.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.6.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Ab…

Dec 10, 2025
Medium max 5.5

ELSA-2025-23008 8 CVEs

Moderate: mysql8.4 security update (Oracle Linux 10)

[8.4.7-1] - Rebase to 8.4.7

Dec 10, 2025
High max 9.8

ELSA-2025-23050 3 CVEs

Important: tomcat security update (Oracle Linux 10)

[1:10.1.36-3.1] - Resolves: RHEL-124494 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) - Resolves: RHEL-91729 tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651) - Resolves: RHEL-132527 tomcat: Denial of service (CVE-2025-617…

Dec 10, 2025
High max 9.8

ELSA-2025-23052 2 CVEs

Important: tomcat9 security update (Oracle Linux 10)

[1:9.0.87-8.1] - Resolves: RHEL-124497 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) - Resolves: RHEL-91732 tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

Dec 10, 2025
High max 7.8

ELSA-2025-23083 1 CVE

Important: wireshark security update (Oracle Linux 10)

[4.4.2-4.0.1.1] - Fix post script to not fail during initial installation [Orabug: 37565359] [1:4.4.2-4.1] - Resolves: RHEL-130425 - Access of Uninitialized Pointer in Wireshark

Dec 10, 2025
Medium max 4.3

ELSA-2025-23088 1 CVE

Moderate: grafana security update (Oracle Linux 10)

[10.2.6-21] - Resolves RHEL-125631: CVE-2025-58183 - Resolves RHEL-132760: Grafana-selinux prevents plugins from searching cgroups

Dec 10, 2025
High max 9.8

ELSA-2025-23035 10 CVEs

Important: firefox security update (Oracle Linux 10)

[140.6.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.6.0-1] - Update to 140.6.0 ESR

Dec 10, 2025
High max 9.4

ELSA-2025-28040 41 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-106.55.4.1] - netfilter: nf_tables: reject duplicate device on updates (Pablo Neira Ayuso) [Orabug: 38712798] {CVE-2025-38678} [6.12.0-106.55.4] - ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Mateusz Polchlopek) [Orabug: 37844…

Dec 10, 2025
Medium max 7.8

ELSA-2025-22865 2 CVEs

Moderate: kernel security update (Oracle Linux 9)

[5.14.0-611.13.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Dec 9, 2025
High max 8.8

ELSA-2025-22789 18 CVEs 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.50.3-1] - Update to 2.50.3

Dec 8, 2025
Medium max 7.8

ELSA-2025-22801 3 CVEs

Moderate: kernel security update (Oracle Linux 8)

[4.18.0-553.89.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [O…

Dec 8, 2025
High max 8.8

ELSA-2025-22790 18 CVEs 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.50.3-1] - Update to 2.50.3

Dec 8, 2025
Medium max 9.8

ELSA-2025-22854 9 CVEs

Moderate: kernel security update (Oracle Linux 10)

[6.12.0-124.20.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Dec 8, 2025
High max 8.8

ELSA-2025-19847 1 CVE

Important: sssd security update (Oracle Linux 7)

[1.16.5-10.0.5.16] - krb5: disable Kerberos localauth an2ln plugin for AD/IPA [Orabug: 38621159]

Dec 5, 2025