Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

  • High max 9.8
    ELSA-2026-89860 11 CVEs

    Important: httpd security update (Oracle Linux 10)

    [2.4.63-13.0.1.el10_2.8] - Replace index.html with Oracle's index page oracle_index.html. [2.4.63-13.8] - Related: RHEL-275253 - httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292) - Resolves: RHEL-280355 - httpd: Den…

  • Medium max 9.8
    ELSA-2026-89905 6 CVEs

    Moderate: freeipmi security, bug fix, and enhancement update (Oracle Linux 10)

    [1.6.20-1] - Update to 1.6.20, fixes buffer overflows in ipmidetect and ipmi-oem fujitsu CVE number assignment pending. [1.6.19-1] - Update to 1.6.19, fixes CVE-2026-85504, CVE-2026-85505, CVE-2026-85506, CVE-2026-85507, CVE-2026-85508, CVE-2026-85509

  • Medium max 7.0
    ELSA-2026-89891 1 CVE

    Moderate: gcc-toolset-15-gcc security update (Oracle Linux 10)

    [15.2.1-7.1] - fix CVE-2026-102010, PR libstdc++/127656 (RHEL-272094)

  • High max 9.6
    ELSA-2026-89758 29 CVEs

    Important: firefox security, bug fix, and enhancement update (Oracle Linux 10)

    [153.5.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [153.5.0-1] - Update to 153.5.0 ESR [140.15.0-1] - Update to 140.15.0 ESR [140.12.0-1] - Updat…

  • High max 8.8
    ELSA-2026-90523 1 CVE

    Important: xdg-dbus-proxy security update (Oracle Linux 10)

    [0.1.5-4.1] - Message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422) Resolves: RHEL-271542

  • Critical max 9.1
    ELSA-2026-72199 1 CVE

    Critical: unbound security update (Oracle Linux 7)

    [1.6.6-5.0.3] - Fix CVE-2026-81642 DNSKEY digest buffer overflow and add regression test [Orabug: 40081199] [1.6.6-5.0.1] - Fix CVE-2023-50387 and CVE-2023-50868 [Orabug: 37387426]

  • High max 9.1
    ELSA-2026-500496 4 CVEs

    Important: ca-certificates security update (Oracle Linux 7)

    [2025.2.80_v9.0.304-71.0.2] - eMudhra: add 'emSign ECC Root CA - G3' and 'Comodo AAA Services root' to blocklist [2025.2.80_v9.0.304-71.0.1] - Resolve ELBA-2025-22492 [Orabug: 38712242] - Update to CKBI 2.80_v9.0.304 from NSS 3.114 - Adding: - # Certificate '…

  • Critical max 6.8
    ELSA-2026-88550 1 CVE

    Critical: ca-certificates security update (Oracle Linux 8)

    [2026.2.92_v9.0.319-81.3] - Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch [2026.2.92_v9.0.319-81.2] - Removing: emSign Root CS CA - G3 from Microsoft Code Signing certificates [2026.2.92_v9.0.319-81] - Update to CKBI 2.92_v9.0.319 from NSS 3…

  • High max 6.2
    ELSA-2026-85916 1 CVE

    Important: perl-DBI:1.641 security update (Oracle Linux 8)

    perl-DBI [1.641-11] - CVE-2026-88815 perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting read during numeric type casting Resolves: RHEL-271961 [1.641-10] - Fix number of tests Resolves: RHEL-247869 [1.641-9] - Fix placeh…

  • Medium max 6.5
    ELSA-2026-85917 1 CVE

    Moderate: perl:5.32 security update (Oracle Linux 8)

    perl [4:5.32.1-475] - Fixes: CVE-2026-13221 - Don't create a trie that would overflow - Resolves: RHEL-247945 perl-Algorithm-Diff [1.1903-10] - Rebuild with enable hardening (bug #1636329) perl-Archive-Tar [2.38-5] - Fix CVE-2026-9538: Denial of Service via c…

  • Critical max 6.8
    ELSA-2026-88459 1 CVE

    Critical: ca-certificates security update (Oracle Linux 9)

    [2026.2.92_v9.0.319-90.3] - Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch [2026.2.92_v9.0.319-90.2] - Removing: emSign Root CS CA - G3 from Microsoft Code Signing certificates [2026.2.92_v9.0.319-90.1] - Removing: AAA Certificate Services ro…

  • High max 8.4
    ELSA-2026-87805 8 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.60.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • Critical max 6.8
    ELSA-2026-88455 1 CVE

    Critical: ca-certificates security update (Oracle Linux 10)

    [2026.2.92_v9.0.319-100.3] - Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch [2026.2.92_v9.0.319-100.2] - Removing: emSign Root CS CA - G3 from Microsoft Code Signing certificates [2026.2.92_v9.0.319-100.1] - Removing: AAA Certificate Services…

  • High max 7.5
    ELSA-2026-88280 4 CVEs

    Important: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

    [0.9.27-7.4] - rebuilt with golang-1.26.10-1.el10_2

  • High max 7.5
    ELSA-2026-88262 4 CVEs

    Important: buildah security update (Oracle Linux 10)

    [1.43.1-7.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.43.1-7] - Rebuild for CVE-2026-111943 - Resolves: RHEL-287469

  • High max 8.8
    ELSA-2026-88477 18 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.68.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 9.2
    ELSA-2026-87073 3 CVEs 2 exploited

    Important: php:8.2 security update (Oracle Linux 8)

    libzip [1.7.3-1] - update to 1.7.3 [1.6.1-1] - update to 1.6.1 - enable lzma support [1.5.2-1] - update to 1.5.2 - add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available [1.5.1-1] - update to 1.5.1 - drop …

  • High max 7.5
    ELSA-2026-88188 4 CVEs

    Important: grafana security update (Oracle Linux 8)

    [9.2.10-36.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-36] - Rebuild against updated golang - Resolves RHEL-287629 - Resolves RHEL-279255 - Resolves RHEL-278945 - Resolves RHEL-278602

  • High max 7.5
    ELSA-2026-88189 3 CVEs

    Important: grafana-pcp security update (Oracle Linux 8)

    [5.1.1-19] - Rebuild against updated golang - Resolves RHEL-287631 - Resolves RHEL-279256 - Resolves RHEL-278603

  • Medium max 6.5
    ELSA-2026-88211 5 CVEs

    Moderate: openssh security update (Oracle Linux 8)

    [8.0p1-34.0.1] - Update upstream references [Orabug: 36587718] [8.0p1-34] - CVE-2026-59998: Document caveat regarding GSSAPIStrictAcceptorCheck Resolves: RHEL-272840 - CVE-2026-59997: Fix internal-sftp server argument parsing limit Resolves: RHEL-272843 - CVE…

  • High max 8.8
    ELSA-2026-87375 7 CVEs

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.177.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 9.2
    ELSA-2026-87079 3 CVEs 2 exploited

    Important: php:8.3 security update (Oracle Linux 9)

    php [8.3.36-1] - rebase to 8.3.36 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 [5.1.21-1] - update to 5.1.21 for PHP 8.1 #2070040 php-pecl-redis6 [6.1.0-3] - use valkey for tests [6.1.0-2] - ignore 1 ONLINE test [6.1.0-1] - RHEL build [6…

  • High max 9.2
    ELSA-2026-87072 3 CVEs 2 exploited

    Important: php:8.2 security update (Oracle Linux 9)

    php [8.2.35-1] - rebase to 8.2.35 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd [2.0.3-4] - build for PHP 8.1 #2070040 [2.0.3-3] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 [2.0.3-2] - Rebuilt for …

  • Critical max 7.5
    ELSA-2026-88354 3 CVEs

    Critical: grafana-pcp security update (Oracle Linux 9)

    [5.1.1-17.2] - Rebuild against updated golang - Resolves RHEL-287511 - Resolves RHEL-279381 - Resolves RHEL-278739

  • High max 8.2
    ELSA-2026-88247 2 CVEs

    Important: expat security update (Oracle Linux 9)

    [2.5.0-6.7] - CVE-2026-102633 expat: expat: Denial of Service via integer overflow in expat_realloc - Resolves: RHEL-272833 [2.5.0-6.6] - CVE-2026-77214 expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer over-read in XML_ParseBu…

  • High max 9.8
    ELSA-2026-88229 11 CVEs

    Important: httpd security update (Oracle Linux 9)

    [2.4.62-13.0.1.el9_8.9] - Replace index.html with Oracle's index page oracle_index.html. [2.4.62-13.9] - Related: RHEL-275261 - httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292) - Resolves: RHEL-280369 - httpd: Deni…

  • Medium max 5.5
    ELSA-2026-86970 3 CVEs

    Moderate: cockpit-machines security update (Oracle Linux 9)

    [348.1-1.0.1] - Apply the patch for upstream reference [Orabug: 39248919] - Replace upstream references [Orabug: 34340088] [348.1-1] - CVE-2026-92768 (RHEL-263127) - CVE-2026-92747 (RHEL-263114) - CVE-2026-92745 (RHEL-263111)

  • High max 8.2
    ELSA-2026-88248 2 CVEs

    Important: expat security update (Oracle Linux 10)

    [2.7.3-63] - CVE-2026-102633 expat: expat: Denial of Service via integer overflow in expat_realloc [2.7.3-62] - CVE-2026-77214 expat: expat: Information disclosure via heap buffer over- read in XML_ParseBuffer [2.7.3-61] - CVE-2026-66046 expat: Expat: Denial …

  • High max 10.0
    ELSA-2026-88202 1 CVE

    Important: podman security update (Oracle Linux 10)

    [5.8.2-10.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-10] - update to the latest upstream commit bd9083e0 - Resolves: RHEL-271981

  • High max 7.5
    ELSA-2026-88207 1 CVE

    Important: iperf3 security update (Oracle Linux 10)

    [3.17.1-6.2] - DoS via UDP receive worker infinite loop (CVE-2026-102253) - Resolves: RHEL-273152

  • High max 7.5
    ELSA-2026-88336 3 CVEs

    Important: podman security update (Oracle Linux 10)

    [5.8.2-11.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-11] - Rebuild for CVE-2026-111943 - Resolves: RHEL-287477

  • High max 7.5
    ELSA-2026-88316 3 CVEs

    Important: grafana-pcp security update (Oracle Linux 10)

    [5.3.0-8.2] - Rebuilt against updated golang - Resolves RHEL-287474, RHEL-279348, RHEL-278699

  • High max 8.8
    ELSA-2026-88359 1 CVE

    Important: postgresql16-pgvector security update (Oracle Linux 10)

    [0.8.7-1] - CVE-2026-103484 postgresql16-pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build execution via out-of-bounds write during IVFFlat index build - Resolves: RHEL-282041

  • High max 8.8
    ELSA-2026-88360 1 CVE

    Important: postgresql18-pgvector security update (Oracle Linux 10)

    [0.8.7-0.1] - CVE-2026-103484 postgresql18-pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build execution via out-of-bounds write during IVFFlat index build - Resolves: RHEL-282040

  • Critical max 9.4
    ELSA-2026-86170 20 CVEs

    Critical: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [9.0.122-1.0.1] - Add support for Oracle Linux [9.0.122-1] - Update to .NET SDK 9.0.122 and Runtime 9.0.21 - Resolves: RHEL-277797

  • Critical max 9.4
    ELSA-2026-86594 21 CVEs

    Critical: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [8.0.132-2.0.1] - Add support for Oracle Linux [8.0.132-2] - Fix apphost hash duplication under compiler optimizations on ppc64le - Resolves: RHEL-277790 [8.0.132-1] - Update to .NET SDK 8.0.132 and Runtime 8.0.32 - Resolves: RHEL-277790

  • Medium max 5.3
    ELSA-2026-86982 1 CVE

    Moderate: fetchmail security update (Oracle Linux 8)

    [6.4.24-1.1] - Fix CVE-2026-94184: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) Resolves: RHEL-265182

  • High max 7.8
    ELSA-2026-86842 1 CVE

    Important: librsvg2 security update (Oracle Linux 8)

    [2.42.7-6] - CVE-2026-96889 librsvg2: Use-after-free when XML includes have duplicated entities duplicated entities - Resolves: RHEL-267981

  • High max 8.5
    ELSA-2026-86907 8 CVEs

    Important: xorg-x11-server-Xwayland security update (Oracle Linux 8)

    [21.1.3-20.4] - CVE fix for: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516 CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93523, CVE-2026-93524 Resolves: https://redhat.atlassian.net/browse/RHEL-277856 Resolves: http…

  • High max 9.2
    ELSA-2026-87080 12 CVEs 2 exploited

    Important: php:7.4 security update (Oracle Linux 8)

    libzip [1.6.1-1] - update to 1.6.1 - enable lzma support [1.5.2-1] - update to 1.5.2 - add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available [1.5.1-1] - update to 1.5.1 - drop dependency on zlib-devel and…