Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,316 results · Feed

High max 9.8

ELSA-2025-8608 9 CVEs

Important: thunderbird security update (Oracle Linux 10)

[128.11.0-1.0.1] - Add Oracle prefs [128.11.0-1] - Update to 128.11.0 [128.10.1-1] - Update to 128.10.1

Jun 27, 2025
High max 9.1

ELSA-2025-9190 1 CVE

Important: ipa security update (Oracle Linux 10)

[4.12.2-15.0.1.el10_0.1] - Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674] - Add bind to ipa-server-common Requires [Orabug: 36518596] [4.12.2-15.el10_0.1] - Resolves: RHEL-89908 EMBARGOED CVE-2025-4404 ipa: Privilege escalation from host t…

Jun 27, 2025
High max 7.0

ELSA-2025-9328 1 CVE

Important: libblockdev security update (Oracle Linux 10)

[3.2.0-4.0.1] - enable btrfs support [Orabug: 30792917] [3.2.0-4] - Don't allow suid and dev set on fs resize - CVE-2025-6019

Jun 27, 2025
Medium max 10.0

ELSA-2025-7494 1 CVE 1 exploited

Moderate: tomcat9 security update (Oracle Linux 10)

[1:9.0.87-5] - Resolves: RHEL-82927 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

Jun 27, 2025
Medium max 6.5

ELSA-2025-8131 3 CVEs

Moderate: ruby security update (Oracle Linux 10)

[3.3.8-10] - Upgrade to Ruby 3.3.8. Resolves: RHEL-87342 - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. (CVE-2025-25186) - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219) Resolves: RHEL-86116 - Fix userinfo leakage in URI#join, …

Jun 27, 2025
Medium max 9.1

ELSA-2025-8477 1 CVE

Moderate: golang security update (Oracle Linux 10)

[1.23.9-1] - Update to 1.23.9

Jun 27, 2025
Medium max 7.8

ELSA-2025-9121 1 CVE

Moderate: wireshark security update (Oracle Linux 10)

[1:4.4.2-3.0.1] - Fix post script to not fail during initial installation [Orabug: 37565359] [1:4.4.2-3] - Resolves: RHEL-80274 - Increasing NVR due to a build error [1:4.4.2-2] - Resolves: RHEL-80274 - Uncontrolled Recursion in Wireshark - Resolves: RHEL-931…

Jun 27, 2025
Medium max 9.1

ELSA-2025-9317 1 CVE

Moderate: delve security update (Oracle Linux 10)

[1.24.1-2.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.24.1-2] - Rebuild without changes

Jun 27, 2025
Medium max 10.0

ELSA-2025-7497 3 CVEs 1 exploited

Moderate: tomcat security update (Oracle Linux 10)

[1:10.1.36-1] - Rebase tomcat to 10.1.36 - Resolves: RHEL-82925 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) - Resolves: RHEL-87272 tomcat: DoS in examples web application (CVE-2024-54677)…

Jun 27, 2025
Medium max 9.8

ELSA-2025-7593 1 CVE

Moderate: ghostscript security update (Oracle Linux 10)

[10.02.1-16] - RHEL-88964 CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow [10.02.1-15] - RHEL-67044 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-67050 CVE-2024-46952 ghostscript: B…

Jun 27, 2025
Medium max 9.1

ELSA-2025-8915 1 CVE

Moderate: grafana-pcp security update (Oracle Linux 10)

[5.2.2-3] - Resolves RHEL-89218: CVE-2025-22871

Jun 27, 2025
Medium max 9.1

ELSA-2025-9146 1 CVE

Moderate: podman security update (Oracle Linux 10)

[6:5.4.0-10.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [6:5.4.0-10] - rebuild to resolve CVE-202…

Jun 27, 2025
Medium max 9.1

ELSA-2025-9148 1 CVE

Moderate: buildah security update (Oracle Linux 10)

[2:1.39.4-2.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.39.4-2] - Rebuild on new golang to fix CVE-2025-22871 [2:1.39.4-1] - update to https://github.com/containers/buildah/releases/tag/v1.39.4 - Related: RHEL-80…

Jun 27, 2025
Medium max 9.1

ELSA-2025-9151 1 CVE

Moderate: gvisor-tap-vsock security update (Oracle Linux 10)

[6:0.8.5-2] - Rebuild on new golang to fix CVE-2025-22871 [6:0.8.5-1] - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.5 - Related: RHEL-80817 [6:0.8.4-1] - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8…

Jun 27, 2025
Medium max 6.5

ELSA-2025-9307 1 CVE

Moderate: freerdp security update (Oracle Linux 10)

[2:3.10.3-3] - Initialize function pointers after resource allocation - Fixes CVE-2025-4478 - Resolves: RHEL-91583

Jun 27, 2025
Medium max 5.4

ELSA-2025-9466 1 CVE

Moderate: mod_proxy_cluster security update (Oracle Linux 10)

[1.3.22-1.el10_0.2] - Resolves: RHEL-82256 - Update deprecated misspeled EnableMCPMReceive directive [1.3.22-1.el10_0.1] - Resolves: RHEL-80796 - Rebase mod_proxy_cluster to upstream 1.3.22.Final release [1.3.22-1] - Resolves: RHEL-80480 Rebase mod_proxy_clus…

Jun 27, 2025
Medium max 9.1

ELSA-2025-9156 1 CVE

Moderate: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

[0.9.27-3] - rebuild to fix CVE-2025-22871

Jun 27, 2025
Medium max 4.0

ELSA-2025-7510 1 CVE

Moderate: libarchive security update (Oracle Linux 10)

[3.7.7-2] - Fix for CVE-2024-57970 - Resolves: RHEL-79877

Jun 27, 2025
Medium max 7.5

ELSA-2025-7512 1 CVE

Moderate: expat security update (Oracle Linux 10)

[2.7.1-1] - Fix behavior change caused by fix for CVE-2024-8176 [2.7.0-1] - Fix CVE-2024-8176

Jun 27, 2025
High max 6.9

ELSA-2025-7517 1 CVE

Important: sqlite security update (Oracle Linux 10)

[3.46.1-4] - Fix for CVE-2025-3277 - Resolves: RHEL-87295

Jun 27, 2025
High max 8.7

ELSA-2025-7524 1 CVE

Important: xz security update (Oracle Linux 10)

[1:5.6.2-4] - Fix: heap-use-after-free bug in threaded .xz decoder (CVE-2025-31115) - Resolves: RHEL-86029

Jun 27, 2025
High max 7.8

ELSA-2025-9178 3 CVEs

Important: kea security update (Oracle Linux 10)

[2.6.3-1] - New version 2.6.3 - Fix for: CVE-2025-32801, CVE-2025-32802, CVE-2025-32803 - kea.conf: Remove /tmp/ from socket-name for existing configurations - kea.conf: Set pseudo-random password for default config to secure fresh install and allow CA startu…

Jun 27, 2025
Medium max 5.9

ELSA-2025-9418 1 CVE

Moderate: krb5 security update (Oracle Linux 10)

[1.21.3-8.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767] [1.21.3-8] - Do not block HMAC-MD4/5 in FIPS mode Resolves: RHEL-88705 - Don't issue RC4 session keys by default (CVE-2025-3576) Resolves: RHEL-88047 - Add PKINIT paChecksum2 from…

Jun 27, 2025
Medium max 4.0

ELSA-2025-9420 1 CVE

Moderate: libarchive security update (Oracle Linux 10)

[3.7.7-3] - Resolves: CVE-2025-25724

Jun 27, 2025
Medium max 6.5

ELSA-2025-9421 1 CVE

Moderate: iputils security update (Oracle Linux 10)

[20240905-2.1] - Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (RHEL-94582)

Jun 27, 2025
Medium max 9.1

ELSA-2025-9845 1 CVE

Moderate: weldr-client security update (Oracle Linux 8)

[35.12-3] - Update test repository snapshot urls rhel 8.10 and remove cs8 repos The snapshots for cs8 have been removed from the service - Rebuild for CVE-2025-22871 Resolves: RHEL-89289

Jun 26, 2025
Medium max 9.1

ELSA-2025-9063 1 CVE

Moderate: git-lfs security update (Oracle Linux 10)

[3.6.1-2] - Rebuild with new Golang

Jun 26, 2025
High max 7.8

ELSA-2025-7496 2 CVEs

Important: libxslt security update (Oracle Linux 10)

[1.1.39-7] - Fix CVE-2024-55549 (RHEL-83503) - Fix CVE-2025-24855 (RHEL-83489)

Jun 26, 2025
High max 7.5

ELSA-2025-8135 1 CVE

Important: python-tornado security update (Oracle Linux 10)

[6.4.2-1.el10_0.1] - httputil: Raise errors instead of logging in multipart/form-data parsing Resolves: RHEL-91992

Jun 26, 2025
High max 9.2

ELSA-2025-7489 6 CVEs

Important: php security update (Oracle Linux 10)

[8.3.19-1] - rebase to 8.3.19

Jun 26, 2025
High max 8.4

ELSA-2025-7500 1 CVE

Important: perl security update (Oracle Linux 10)

[4:5.40.2-512.1] - 5.40.2 bump (see <https://metacpan.org/release/SHAY/perl-5.40.2/view/pod/perldelta.pod>) - Resolves: RHEL-87186

Jun 26, 2025
High max 7.5

ELSA-2025-7509 1 CVE

Important: valkey security update (Oracle Linux 10)

[8.0.3.1] - rebase to 8.0.3

Jun 26, 2025
High max 7.5

ELSA-2025-8128 4 CVEs

Important: libsoup3 security update (Oracle Linux 10)

[3.6.5-3.el10_0.6] - Fix CVE-2025-4035, CVE-2025-4948, CVE-2025-32049, CVE-2025-32907 [3.6.5-3] - Add patch to hopefully fix http2-body-size-test timeouts [3.6.5-2] - Add patch to hopefully fix server-test timeouts [3.6.5-1] - Update to 3.6.5 and add patches …

Jun 26, 2025
High max 5.4

ELSA-2025-8550 1 CVE

Important: varnish security update (Oracle Linux 10)

[7.6.1-2.el10_0.1] - Resolves: RHEL-89691 - varnish: request smuggling attacks (CVE-2025-47905)

Jun 26, 2025
High max 7.8

ELSA-2025-9304 6 CVEs

Important: xorg-x11-server-Xwayland security update (Oracle Linux 10)

[24.1.5-4] - CVE fix for: CVE-2025-49175 (RHEL-97129), CVE-2025-49176 (RHEL-97135), CVE-2025-49177 (RHEL-97141), CVE-2025-49178 (RHEL-97147), CVE-2025-49179 (RHEL-97153), CVE-2025-49180 (RHEL-97159) [24.1.5-3] Rebuild for 10.0.z required due to issue when rel…

Jun 26, 2025
High

ELSA-2025-20371 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 10)

[6.12.0-100.28.2.el10uek] - sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash (Omar Sandoval) - certs: Add new Oracle Linux Driver Signing (key 1) certificate (Sherry Yang) [Orabug: 37967533] - Revert 'block: sysfs option to change ioticks g…

Jun 26, 2025
Medium max 8.8

ELSA-2025-9580 4 CVEs

Moderate: kernel security update (Oracle Linux 8)

[4.18.0-553.58.1_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.ge…

Jun 25, 2025
High max 8.8

ELSA-2025-9605 1 CVE

Important: perl-File-Find-Rule security update (Oracle Linux 8)

[0.34-9] - Use 3 arg open in grep() (CVE-2011-10007) - Package tests

Jun 25, 2025
Medium max 9.1

ELSA-2025-9634 1 CVE

Moderate: osbuild-composer security update (Oracle Linux 9)

[132.2-2.0.1] - Switch to UEKR8 repositories for OL9.6 [Orabug: 37962207] - Add support to create OpenScap images [JIRA: OLDIS-35301] - Simplify repository names [JIRA: OLDIS-35893] - Refactor patches to fix some naming and set a correct kernel for Oracle Lin…

Jun 25, 2025
Medium max 9.1

ELSA-2025-9635 1 CVE

Moderate: weldr-client security update (Oracle Linux 9)

[35.12-4] - Bump release for y-stream AND z-stream building using centpkg build --rhel-target=zstream Related: RHEL-89344 [35.12-3] - tests: OSTree does not support the qcow2 image type - Add test repositories for RHEL 9.6 and 9.7 - Rebuild for CVE-2025-22871…

Jun 25, 2025