Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,316 results · Feed

  • High max 9.8
    ELSA-2025-20551 268 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-103.40.4.1.el10uek] - netlink: avoid infinite retry looping in netlink_unicast() (Fedor Pchelkin) [Orabug: 38361037] [6.12.0-103.40.4.el10uek] - rds: Fix NULL ptr deref in xas_start (Hakon Bugge) [Orabug: 38169301] - KVM: x86: use array_index_nospec w…

  • Medium max 9.1
    ELSA-2025-15123 4 CVEs

    Moderate: httpd:2.4 security update (Oracle Linux 8)

    httpd [2.4.37-65.5.0.1] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-65.5] - Resolves: RHEL-99944 - CVE-2025-49812 httpd: HTTP Session Hijack via a TLS upgrade - Resolves: RHEL-99969 - CVE-2024-47252 httpd: insufficient escaping of …

  • Medium max 9.8
    ELSA-2025-15005 7 CVEs

    Moderate: kernel security update (Oracle Linux 10)

    [6.12.0-55.30.1.0.1] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Di…

  • High max 8.8
    ELSA-2025-15115 2 CVEs

    Important: postgresql:12 security update (Oracle Linux 8)

    pgaudit pg_repack postgres-decoderbufs postgresql [12.22-5] - Fix previous Backport [12.22-4] - Backport CVE-2025-8715

  • Medium max 5.3
    ELSA-2025-14999 1 CVE

    Moderate: resource-agents security update (Oracle Linux 8)

    [4.9.0-54.16] - bundled requests: fix CVE-2024-47081 Resolves: RHEL-104761 [4.9.0-54.15] - ocf-shellfuncs/AWS agents: dont sleep after the final try in curl_retry() Resolves: RHEL-102731 [4.9.0-54.13] - Filesystem: add support for aznfs Resolves: RHEL-91257 […

  • Medium max 9.8
    ELSA-2025-15008 4 CVEs

    Moderate: kernel security update (Oracle Linux 8)

    [4.18.0-553.72.1_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.ge…

  • High max 7.8
    ELSA-2025-15099 2 CVEs

    Important: pam security update (Oracle Linux 9)

    [1.5.1-26.0.1] - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36406534] [1.5.1-26] - pam_namespace: fix potential privilege escalation. Resolves: CVE-2025-6020 and RHEL-96729

  • High max 9.8
    ELSA-2025-15011 7 CVEs

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-570.39.1.0.1_6.OL9] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 8.5
    ELSA-2025-15020 1 CVE

    Important: udisks2 security update (Oracle Linux 10)

    [2.10.90-5.0.1.1] - Enable btrfs support for OL supported arches [Orabug: 37464632] [2.10.90-5.1] - udisks: Out-of-bounds read in UDisks Daemon (CVE-2025-8067) [2.10.90-5] - mdraid: Avoid acquiring system inhibit lock for external array operations (RHEL-74012…

  • Medium max 9.1
    ELSA-2025-15095 3 CVEs

    Moderate: httpd security update (Oracle Linux 10)

    [2.4.63-1.0.1.2] - Replace index.html with Oracle's index page oracle_index.html.

  • High max 7.8
    ELSA-2025-10357 1 CVE

    Important: pam security update (Oracle Linux 7)

    [1.1.8-23.0.3] - pam_namespace: fix potential privilege escalation CVE-2025-6020 [Orabug: 38156729]

  • High max 8.5
    ELSA-2025-15017 1 CVE

    Important: udisks2 security update (Oracle Linux 8)

    [2.9.0-16.1] - udiskslinuxmanager: Add lower bounds check to fd_index (CVE-2025-8067) (RHEL-109408)

  • High max 8.8
    ELSA-2025-15021 2 CVEs

    Important: postgresql:13 security update (Oracle Linux 8)

    pgaudit [1.5.0-1] - Update to version 1.5.0 Related: #1855776 pg_repack [1.4.6-3] - Release bump - enable gating [1.4.6-2] - Rebuild - Resolves:#1954442 [1.4.6-1] - Rebase to upstream release 1.4.6 [1.4.5-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora…

  • High max 8.8
    ELSA-2025-15022 2 CVEs

    Important: postgresql:15 security update (Oracle Linux 8)

    pgaudit [1.7.0-1] - Update to 1.7.0 - Support postgresql 15 - Related: #2128241 pg_repack [1.4.8-1] - Update to version 1.4.8 - Postgresql 15 is supported - Related: #2128241 [1.4.6-4] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 po…

  • Medium max 7.5
    ELSA-2025-15007 1 CVE

    Moderate: python3.12 security update (Oracle Linux 9)

    [3.12.9-1.2] - Security fix for CVE-2025-8194 Resolves: RHEL-106370

  • Medium max 7.5
    ELSA-2025-15010 1 CVE

    Moderate: python3.11 security update (Oracle Linux 9)

    [3.11.11-2.2] - Security fix for CVE-2025-8194 Resolves: RHEL-106366

  • High max 8.5
    ELSA-2025-15018 1 CVE

    Important: udisks2 security update (Oracle Linux 9)

    [2.9.4-11.0.1.1] - Enable btrfs support for OL supported arches [Orabug: 37464632] [2.9.4-11.1] - udiskslinuxmanager: Add lower bounds check to fd_index (CVE-2025-8067) (RHEL-109417) [2.9.4-11] - udiskslinuxblockobject: Try issuing BLKRRPART ioctl harder - lv…

  • Medium max 9.1
    ELSA-2025-15023 3 CVEs

    Moderate: httpd security update (Oracle Linux 9)

    [2.4.62-4.0.1.4] - Replace index.html with Oracle's index page oracle_index.html. [2.4.62-4.4] - Resolves: RHEL-99949 - CVE-2025-49812 httpd: HTTP Session Hijack via a TLS upgrade [2.4.62-4.1] - Resolves: RHEL-99972 - CVE-2024-47252 httpd: insufficient escapi…

  • Medium max 7.5
    ELSA-2025-15019 1 CVE

    Moderate: python3.9 security update (Oracle Linux 9)

    [3.9.21-2.2] - Security fix for CVE-2025-8194 Resolves: RHEL-106375

  • Medium max 7.5
    ELSA-2025-14984 1 CVE

    Moderate: python3.12 security update (Oracle Linux 10)

    [3.12.9-2.0.1.3] - Remove upstream URL reference [3.12.9-2.3] - Security fix for CVE-2025-8194 Resolves: RHEL-106370 [3.12.9-2.2] - Enable PAC and BTI protections for aarch64 - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CV…

  • High max 8.8
    ELSA-2025-14862 2 CVEs

    Important: postgresql:15 security update (Oracle Linux 9)

    pgaudit [1.7.0-1] - Initial import for postgresql 15 module - Update to 1.7.0 - Support postgresql 15 - Related: #2128410 pg_repack [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47350 [1.4.8-1] - Update to version 1.4.8 …

  • Medium max 7.5
    ELSA-2025-14983 1 CVE

    Moderate: mod_http2 security update (Oracle Linux 9)

    [2.0.26-4.1] - Resolves: RHEL-99956 - CVE-2025-49630 httpd: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module

  • High max 8.8
    ELSA-2025-14899 2 CVEs

    Important: postgresql:16 security update (Oracle Linux 8)

    pgaudit [16.0-1] - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3636 pg_repack [1.5.1-1] - Update to 1.5.1 postgres-decoderbufs [2.4.0-1.Final] - Initial import for postgresql 16 stream - Related: RHEL-3636 postgre…

  • Medium max 7.7
    ELSA-2025-14900 2 CVEs

    Moderate: python39:3.9 security update (Oracle Linux 8)

    mod_wsgi numpy python39 [3.9.20-2] - Security fix for CVE-2025-8194 Resolves: RHEL-106359 python3x-pip python3x-setuptools [50.3.2-7] - Security fix for CVE-2025-47273 Resolves: RHEL-104339 python3x-six python-cffi python-chardet python-cryptography python-id…

  • High max 8.8
    ELSA-2025-14878 2 CVEs

    Important: postgresql security update (Oracle Linux 9)

    [13.22-1] - Update to 13.22 [13.18-1] - Update to 13.18

  • Medium max 7.5
    ELSA-2025-14841 1 CVE

    Moderate: python3.11 security update (Oracle Linux 8)

    [3.11.13-2.0.1] - Update rpm-macros description [Orabug: 36024572] [3.11.13-2] - Security fix for CVE-2025-8194 Resolves: RHEL-106338

  • High max 8.8
    ELSA-2025-14827 2 CVEs

    Important: postgresql:16 security update (Oracle Linux 9)

    pgaudit pg_repack pgvector [0.6.2-2] - Enable Portable build - Resolves: RHEL-84405 postgres-decoderbufs postgresql [16.10-1] - Update to 16.10

  • High max 8.8
    ELSA-2025-14826 2 CVEs

    Important: postgresql16 security update (Oracle Linux 10)

    [16.10-1.0.1] - Replace upstream reference [Orabug: 37044148] [16.10-1] - Update to version 16.10 - Resolves: rhbz#2388580 [16.8-2] - Add tmpfiles.d configuration

  • High max 9.8
    ELSA-2025-14844 5 CVEs

    Important: thunderbird security update (Oracle Linux 10)

    [128.14.0-3.0.1] - Add Oracle prefs [128.14.0-3] - Update to 128.14.0 build2 [128.14.0-2] - Add missing translations [128.14.0-1] - Update to 128.14.0 build1

  • Medium max 5.3
    ELSA-2025-14750 1 CVE

    Moderate: fence-agents security update (Oracle Linux 8)

    [4.2.1-129.14] - fence_aws: add skip_os_shutdown parameter Resolves: RHEL-109814 [4.2.1-129.13] - bundled requests: fix CVE-2024-47081 Resolves: RHEL-104741 [4.2.1-129.12] - fence_ibm_vpc: add apikey file support Resolves: RHEL-107506

  • High max 9.8
    ELSA-2025-14743 5 CVEs

    Important: thunderbird security update (Oracle Linux 8)

    [128.14.0-3.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [128.14.0] - Add OpenELA debranding [128.14.0-3] - Update to 128.14.0 build2 [128.14.0-2] - Add missing translations [128.14.0-1] - Update to 128.14.0 build1

  • High max 7.8
    ELSA-2025-14510 3 CVEs

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-55.29.1.0.1.el10_0.OL10] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin…

  • Medium max 5.9
    ELSA-2025-14553 1 CVE

    Moderate: python-cryptography security update (Oracle Linux 8)

    [3.2.1-8] - Fix CVE-2023-49083: NULL-dereference when loading PKCS7 certificates, resolves RHEL-97452

  • High max 6.2
    ELSA-2025-14573 1 CVE

    Important: aide security update (Oracle Linux 8)

    [0.16.15.2] - CVE-2025-54389 aide: improper output neutralization enables bypassing resolves: RHEL-109907

  • High max 7.8
    ELSA-2025-14557 1 CVE

    Important: pam security update (Oracle Linux 8)

    [1.3.1-38.0.1] - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36272695] [1.3.1-38] - pam_namespace: fix potential privilege escalation. Resolves: CVE-2025-6020 and RHEL-96724

  • Medium max 7.5
    ELSA-2025-14560 1 CVE

    Moderate: python3 security update (Oracle Linux 8)

    [3.6.8-71.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8.openela.0] - Add openela to supported dists [3.6.8-71] - Security fix for CVE-2025-8194 Resolves: RHEL-106333

  • High max 9.8
    ELSA-2025-14640 5 CVEs

    Important: thunderbird security update (Oracle Linux 9)

    [128.14.0-3.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [128.14.0] - Add OpenELA debranding [128.14.0-3] - Update to 128.14.0 build2 [128.14.0-2] - Add missing translations [128.14.0-1] - Update to 128.14.0 build1

  • High max 6.2
    ELSA-2025-14592 1 CVE

    Important: aide security update (Oracle Linux 10)

    [0.18.6-8.2] - aide: improper output neutralization enables bypassing (CVE-2025-54389) Resolves: rhbz#2388019

  • Medium max 7.5
    ELSA-2025-14625 1 CVE

    Moderate: mod_http2 security update (Oracle Linux 10)

    [2.0.29-2.1] - Resolves: RHEL-106263 - CVE-2025-49630 httpd: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module

  • Medium max 7.8
    ELSA-2025-10219 1 CVE

    Moderate: glibc security update (Oracle Linux 7)

    [2.17-326.0.11.3] - Back port fix for CVE-2025-4802 [Orabug: 38144086]