Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,316 results · Feed

Medium max 6.3

ELSA-2025-7147 1 CVE

Moderate: rpm-ostree security update (Oracle Linux 9)

[2025.5-1] - Rebase to 2025.5 Resolves: #RHEL-78697 [2025.4-1] - Rebase to 2025.4 Resolves: #RHEL-68131 [2025.3-1] - Rebase to 2025.3 Resolves: #RHEL-68131 [2025.2-1] - Rebase to 2025.2 Resolves: #RHEL-68131 [2025.1-1] - Rebase to 2025.1 Resolves: #RHEL-68131

May 16, 2025
Medium max 6.3

ELSA-2025-7160 1 CVE

Moderate: bootc security update (Oracle Linux 9)

[1.1.6-3] - Backport https://github.com/containers/bootc/pull/1167 - Resolves: #RHEL-82293 [1.1.5-2] - Sync specfile from upstream - Resolves: #RHEL-80264 - Resolves: #RHEL-81981 [1.1.5-1] - Update to 1.1.5 - Resolves: #RHEL-77733 [1.1.4-2] - Cherry pick patc…

May 16, 2025
Medium max 7.8

ELSA-2025-7163 9 CVEs

Moderate: xorg-x11-server security update (Oracle Linux 9)

[1.20.11-28] - CVE fix for: CVE-2025-26594 (RHEL-80201), CVE-2025-26595 (RHEL-80186), CVE-2025-26596 (RHEL-80188), CVE-2025-26597 (RHEL-80191), CVE-2025-26598 (RHEL-80192), CVE-2025-26599 (RHEL-80199), CVE-2025-26600 (RHEL-80198), CVE-2025-26601 (RHEL-80200) …

May 16, 2025
Medium max 7.8

ELSA-2025-7165 9 CVEs

Moderate: xorg-x11-server-Xwayland security update (Oracle Linux 9)

[23.2.7-3] - CVE fix for: CVE-2025-26594 (RHEL-80204), CVE-2025-26595 (RHEL-80187), CVE-2025-26596 (RHEL-80190), CVE-2025-26597 (RHEL-80193), CVE-2025-26598 (RHEL-80195), CVE-2025-26599 (RHEL-80202), CVE-2025-26600 (RHEL-80203), CVE-2025-26601 (RHEL-80207) [2…

May 16, 2025
Medium max 7.8

ELSA-2025-7178 2 CVEs

Moderate: gstreamer1, gstreamer1-plugins-bad-free, gstreamer1-plugins-ugly-free, and gstreamer1-rtsp-server security update (Oracle Linux 9)

gstreamer1 [1.22.12-3] - Rebuild - Resolves: RHEL-38511, RHEL-41157 [1.22.12-2] - Rebuild - Resolves: RHEL-38511, RHEL-41157 [1.22.12-1] - Update to 1.22.12 [1.22.9-1] - 1.22.9 [1.22.8-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild [1.…

May 16, 2025
Medium max 9.0

ELSA-2025-7201 1 CVE

Moderate: corosync security update (Oracle Linux 9)

[3.1.9-2] - Resolves: RHEL-84616 - totemsrp: Check size of orf_token msg (fixes CVE-2025-30472) [3.1.9-1] - Resolves: RHEL-65699 - New upstream release (RHEL-65699)

May 16, 2025
Medium max 6.3

ELSA-2025-7241 1 CVE

Moderate: rust-bootupd security update (Oracle Linux 9)

[0.2.27-3] - spec: remove ExcludeArch ix86 as this is c9s Resolves: #RHEL-77736, #RHEL-79091 [0.2.27-2] - Add git to the build requires Resolves: #RHEL-77736, #RHEL-79091 [0.2.27-1] - https://github.com/coreos/bootupd/releases/tag/v0.2.27 Resolves: #RHEL-7773…

May 16, 2025
Medium max 6.9

ELSA-2025-7242 17 CVEs

Moderate: gstreamer1-plugins-good security update (Oracle Linux 9)

[1.22.12-4] - Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540 CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546, CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599, CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-…

May 16, 2025
Medium max 6.9

ELSA-2025-7243 4 CVEs

Moderate: gstreamer1-plugins-base security update (Oracle Linux 9)

[1.22.12-4] - Bump version - Apply patches for CVE-2024-47538, CVE-2024-47541, CVE-2024-47542, CVE-2024-47600, CVE-2024-47607, CVE-2024-47615, CVE-2024-47835 Resolves: RHEL-70983, RHEL-71035, RHEL-70932, RHEL-71037 Resolves: RHEL-71019, RHEL-70995, RHEL-71163…

May 16, 2025
Medium max 9.8

ELSA-2025-7256 6 CVEs

Moderate: git-lfs security update (Oracle Linux 9)

[3.6.1-1] - Update to 3.6.1 - Resolves: RHEL-73940 [3.6.0-1] - Update to 3.6.0 - Resolves: RHEL-63968, RHEL-61045, RHEL-47219, RHEL-43318, RHEL-35936, RHEL-2791 [3.4.1-3] - Make Git-LFS FIPS compliant - Resolves: RHEL-53086 [3.4.1-2] - Rebuild with new Golang…

May 16, 2025
Medium max 5.6

ELSA-2025-7309 2 CVEs

Moderate: openjpeg2 security update (Oracle Linux 9)

[2.4.0-8] - fix two heap buffer overflows CVE-2024-56826 and CVE-2024-52827 (RHEL-72519,RHEL-72521)

May 16, 2025
Medium max 6.3

ELSA-2025-7313 1 CVE

Moderate: keylime-agent-rust security update (Oracle Linux 9)

[0.2.2-2] - Update openssl crate to version 0.10.70 to fix CVE-2025-24898

May 16, 2025
Medium max 7.5

ELSA-2025-7315 9 CVEs

Moderate: php security update (Oracle Linux 9)

[8.0.30-2] - Fix Leak partial content of the heap through heap buffer over-read CVE-2024-8929 - Fix Configuring a proxy in a stream context might allow for CRLF injection in URIs CVE-2024-11234 - Fix Single byte overread with convert.quoted-printable-decode f…

May 16, 2025
Medium max 6.3

ELSA-2025-7317 1 CVE

Moderate: python3.12-cryptography security update (Oracle Linux 9)

[41.0.7-2] - Security fix for CVE-2025-24898 in the bundled openssl crate Resolves: RHEL-77735 [41.0.7-1] - Update to 41.0.7, fixes CVE-2023-49083 [41.0.5-2] - Rebuilt for timestamp .pyc invalidation mode [41.0.5-1] - Initial package - Fedora contributions by…

May 16, 2025
Medium max 4.3

ELSA-2025-7331 1 CVE

Moderate: nginx security update (Oracle Linux 9)

[1.20.1-22.0.1] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] - Update upstream references [Orabug: 36579090] [2:1.20.1-22] - Resolves: RHEL-78236 - nginx: TLS Session Resumption Vulnerability (…

May 16, 2025
Medium max 5.3

ELSA-2025-7350 1 CVE

Moderate: perl-Module-ScanDeps security update (Oracle Linux 9)

[1.30-6] - Resolves: RHEL-68282 - Fix CVE-2024-10224 - Package tests

May 16, 2025
Medium max 10.0

ELSA-2025-6966 355 CVEs

Moderate: kernel security update (Oracle Linux 9)

[5.14.0-570.12.1.0.1_6.OL9] - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650] [5.14.0-570.12.1_6.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Orac…

May 16, 2025
Medium

ELSA-2025-7540 1 CVE

Moderate: libjpeg-turbo security update (Oracle Linux 8)

[1.5.3-14] - updated previous fix (RHEL-87364) [1.5.3-13] - fix CVE-2020-13790: heap-based buffer over-read in get_rgb_row (RHEL-87364)

May 15, 2025
High max 7.4

ELSA-2025-7569 1 CVE

Important: yelp and yelp-xsl security update (Oracle Linux 8)

yelp [2:3.28.1-3.1] - Fix CVE-2025-3155 (RHEL-85922) yelp-xsl [3.28.0-2.1] - Fix CVE-2025-3155 (RHEL-85922)

May 15, 2025
High max 7.8

ELSA-2025-7531 2 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.52.1_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.ge…

May 15, 2025
Medium max 7.4

ELSA-2025-3844 3 CVEs

Moderate: java-1.8.0-openjdk security update (Oracle Linux 7)

[1:1.8.0.442.b06-1.0.3] - Fixed CVE-2025-21587, CVE-2025-30691 and CVE-2025-30698 [Orabug: 37840723]

May 12, 2025
Medium max 7.5

ELSA-2025-4791 1 CVE

Moderate: python39:3.9 security update (Oracle Linux 8)

mod_wsgi [4.7.1-7.1] - Resolves: RHEL-87514 - CVE-2022-2255 python39:3.9/mod_wsgi: Trusted Proxy Headers Removing Bypass numpy python39 python3x-pip python3x-setuptools python3x-six python-cffi python-chardet python-cryptography python-idna python-lxml python…

May 12, 2025
High max 9.1

ELSA-2025-4797 5 CVEs

Important: thunderbird security update (Oracle Linux 8)

[128.10.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file - Force use of gcc-toolset-13 due to clang dependency [128.10.0] - Add OpenELA debranding [128.10.0-1] - Update to 128.10.0 build1

May 12, 2025
Medium max 7.8

ELSA-2025-4787 1 CVE

Moderate: emacs security update (Oracle Linux 9)

[1:27.2-11.el9_5.2] - Fix arbitrary code execution via Lisp macro expansion (RHEL-69395)

May 12, 2025
High max 5.6

ELSA-2025-20318 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-1.23.3.1] - x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37920680] - x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37920680] - x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) [Ora…

May 12, 2025
High max 5.6

ELSA-2025-20323 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-308.179.6.2] - x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Pawan Gupta) [Orabug: 37920681] - x86/bpf: Add IBHF call at end of classic BPF (Daniel Sneddon) [Orabug: 37920681] - x86/bpf: Call branch history clearing sequence on exit (Daniel Sneddon) […

May 12, 2025
High max 7.5

ELSA-2025-20319 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.343.5.1] - nvme: fix deadlock between reset and scan (Bitao Hu) [Orabug: 37920457] [5.4.17-2136.343.5] - sctp: sysctl: auth_enable: avoid using current->nsproxy (Matthieu Baerts (NGI0)) [Orabug: 37846673] - sctp: sysctl: cookie_hmac_alg: avoid us…

May 11, 2025
High max 8.8

ELSA-2025-20320 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-308.179.6] - net: bridge: IP defragmentation failing for jumboframes (Venkat Venkatsubra) [Orabug: 37847171] - uek-rpm: remove .el9 from shim version (Samasth Norway Ananda) [Orabug: 37834731] - RDS: avoid using offlined CPU during reconnect (Arumugam…

May 11, 2025
High max 7.5

ELSA-2025-4669 1 CVE

Important: osbuild-composer security update (Oracle Linux 9)

[118.2-1.0.1] - jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

May 8, 2025
Medium

ELSA-2025-4658 1 CVE

Moderate: libtiff security update (Oracle Linux 8)

[4.0.9-34] - fix CVE-2017-17095: heap-based buffer overflow in pal2rgb (RHEL-87363)

May 7, 2025
Medium max 7.5

ELSA-2025-4597 1 CVE

Moderate: mod_auth_openidc:2.3 security update (Oracle Linux 8)

cjose mod_auth_openidc [2.4.9.4-8] - Resolves: RHEL-87759 - Empty POST causes crash with OIDCPreservePost

May 7, 2025
High max 6.4

ELSA-2025-4649 3 CVEs

Important: thunderbird security update (Oracle Linux 8)

[128.9.2-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file - Force use of gcc-toolset-13 due to clang dependency [128.9.2] - Add OpenELA debranding [128.9.2-1] - Update to 128.9.2

May 7, 2025
Medium max 5.8

ELSA-2025-4487 2 CVEs

Moderate: ruby security update (Oracle Linux 9)

[3.0.7-165] - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219) Resolves: RHEL-86104 - Fix ReDoS in CGI::Util#escapeElement. (CVE-2025-27220) Resolves: RHEL-86130 [3.0.7-164] - Undefine GC compaction methods on ppc64le. Resolves: RHEL-83136 - Fix p…

May 7, 2025
High max 9.1

ELSA-2025-4458 5 CVEs

Important: firefox security update (Oracle Linux 8)

[128.10.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - Force use of gcc-toolset-13 due to clang dependency [128.10.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [128.10.0-1] - Updat…

May 6, 2025
High max 9.0

ELSA-2025-4560 8 CVEs

Important: libsoup security update (Oracle Linux 8)

[2.62.3-8] - Backport patches for various CVEs, plus test improvements Resolves: RHEL-85887 Resolves: RHEL-85900 Resolves: RHEL-85901 Resolves: RHEL-87039 Resolves: RHEL-87094 Resolves: RHEL-87114 Resolves: RHEL-88348 Resolves: RHEL-88351

May 6, 2025
Medium max 5.9

ELSA-2025-4488 7 CVEs

Moderate: ruby:3.1 security update (Oracle Linux 9)

ruby [3.1.7-146] - Upgrade to Ruby 3.1.7. Resolves: RHEL-55410 - Fix DoS vulnerability in REXML. (CVE-2024-39908) Resolves: RHEL-86077

May 6, 2025
Medium max 4.9

ELSA-2025-4491 1 CVE

Moderate: 389-ds-base security update (Oracle Linux 9)

[2.5.2-9] - Resolves: RHEL-83874 - CVE-2025-2487 389-ds-base: null pointer dereference leads to denial of service [rhel-9.5.z] - Resolves: RHEL-80712 - Increased memory consumption caused by NDN cache [rhel-9.5.z] - Resolves: RHEL-87194 - Some replication sta…

May 6, 2025
Medium max 5.5

ELSA-2025-4492 2 CVEs

Moderate: qemu-kvm security update (Oracle Linux 9)

[9.0.0-10.el9_5.3] - kvm-target-i386-fix-feature-dependency-for-WAITPKG.patch [RHEL-84866] - Resolves: RHEL-84866 (Live migration after workload update fails with operation failed: guest CPU doesn't match specification: missing features: waitpkg [rhel-9.5.z])

May 6, 2025
Medium max 6.5

ELSA-2025-4493 3 CVEs

Moderate: ruby:3.3 security update (Oracle Linux 9)

ruby [3.3.8-4] - Upgrade to Ruby 3.3.8. Resolves: RHEL-86933 - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. (CVE-2025-25186) - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219) Resolves: RHEL-87182 - Fix userinfo leakage in URI#jo…

May 6, 2025
High max 7.5

ELSA-2025-4039 1 CVE

Important: virtuoso-opensource security update (Oracle Linux 7)

[1:6.1.6-7.0.1] - Back port fix for CVE-2024-57656 [Orabug:37856848]

May 5, 2025