Oracle Linux Security Advisories (ELSA)

8,316 results · Feed

• High max 8.6
  ELSA-2024-11122 5 CVEs

  Important: gstreamer1-plugins-good security update (Oracle Linux 9)

  [1.22.1-3] - CVE-2024-47537, CVE-2024-47539, CVE-2024-47540, CVE-2024-47606, CVE-2024-47613 Resolves: RHEL-70954, RHEL-70967, RHEL-70941, RHEL-71027, Resolves: RHEL-71003

  Dec 16, 2024
• High max 8.6
  ELSA-2024-11123 3 CVEs

  Important: gstreamer1-plugins-base security update (Oracle Linux 9)

  [1.22.1-3] - Fixes for CVE-2024-47538, CVE-2024-47607, CVE-2024-47615 Resolves: RHEL-70979, RHEL-71015, RHEL-70991

  Dec 16, 2024
• Medium max 5.3
  ELSA-2024-11111 1 CVE

  Moderate: python3.11 security update (Oracle Linux 9)

  [3.11.9-7.2] - Security fix for CVE-2024-9287 Resolves: RHEL-64882

  Dec 16, 2024
• Medium max 5.4
  ELSA-2024-10987 1 CVE

  Moderate: pcs security update (Oracle Linux 8)

  [0.10.18-2.0.1.el8_10.3] - Replace HAM-logo.png with a generic one [0.10.18-2.el8_10.3] - Prevented any future HTTP header-based attacks on puma/sinatra by removing any headers not recognized by pcsd Resolves: RHEL-65595

  Dec 13, 2024
• High max 8.4
  ELSA-2024-10953 1 CVE

  Important: python36:3.6 security update (Oracle Linux 8)

  python36 python-distro python-docs python-docutils python-nose python-pygments python-pymongo python-PyMySQL python-sqlalchemy python-virtualenv [15.1.0-23] - Security fix for CVE-2024-53899 Resolves: RHEL-68876 python-wheel scipy

  Dec 12, 2024
• Medium max 9.4
  ELSA-2024-10952 11 CVEs

  Moderate: php:7.4 security update (Oracle Linux 8)

  libzip [1.6.1-1] - update to 1.6.1 - enable lzma support php [7.4.33-2] - fix low/moderate CVEs RHEL-66589 - Fix cgi.force_redirect configuration is bypassable due to the environment variable collision CVE-2024-8927 - Fix Logs from childrens may be altered CV…

  Dec 12, 2024
• Medium max 5.3
  ELSA-2024-10979 1 CVE

  Moderate: python3.11 security update (Oracle Linux 8)

  [3.11.11-1.0.1] - Update rpm-macros description [Orabug: 36024572] [3.11.11-1] - Update to 3.11.11 Resolves: RHEL-64879

  Dec 12, 2024
• High max 8.7
  ELSA-2024-10980 2 CVEs

  Important: python3.12 security update (Oracle Linux 8)

  [3.12.8-1] - Update to 3.12.8 - Security fix for CVE-2024-9287 and CVE-2024-12254 Resolves: RHEL-64880, RHEL-70315

  Dec 12, 2024
• Medium max 7.5
  ELSA-2024-10950 6 CVEs

  Moderate: php:8.1 security update (Oracle Linux 9)

  php [8.1.30-1] - rebase to 8.1.30 RHEL-64144 php-pecl-apcu [5.1.21-1] - update to 5.1.21 for PHP 8.1 #2070040 php-pecl-rrd php-pecl-xdebug3 [3.1.4-1] - update to 3.1.4 for PHP 8.1 #2070040 php-pecl-zip [1.20.1-1] - update to 1.20.1 for PHP 8.1 #2070040

  Dec 12, 2024
• High max 8.7
  ELSA-2024-10978 2 CVEs

  Important: python3.12 security update (Oracle Linux 9)

  [3.12.5-2.2] - Security fix for CVE-2024-9287 and CVE-2024-12254 Resolves: RHEL-64885, RHEL-70316

  Dec 12, 2024
• Medium max 6.3
  ELSA-2024-10983 2 CVEs

  Moderate: python3.9:3.9.21 security update (Oracle Linux 9)

  [3.9.21-1] - Update to 3.9.21 - Security fix for CVE-2024-11168 and CVE-2024-9287 Resolves: RHEL-64888 Resolves: RHEL-67259

  Dec 12, 2024
• Medium max 7.5
  ELSA-2024-10951 6 CVEs

  Moderate: php:8.2 security update (Oracle Linux 8)

  libzip php [8.2.25-1] - rebase to 8.2.25 RHEL-66166 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip

  Dec 11, 2024
• Medium max 9.8
  ELSA-2024-10943 9 CVEs

  Moderate: kernel security update (Oracle Linux 8)

  [4.18.0-553.32.1_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.ge…

  Dec 11, 2024
• Medium max 9.8
  ELSA-2024-10939 7 CVEs

  Moderate: kernel security update (Oracle Linux 9)

  [5.14.0-503.16.1_5.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.…

  Dec 11, 2024
• Medium max 7.5
  ELSA-2024-10949 6 CVEs

  Moderate: php:8.2 security update (Oracle Linux 9)

  php [8.2.25-1] - rebase to 8.2.25 RHEL-65837 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd php-pecl-xdebug3 [3.2.2-2] - drop inet_ntoa usage using upstream patch [3.2.2-1] - update to 3.2.2 for PHP 8.2 RHEL-14699 php-pecl-zip…

  Dec 11, 2024
• High max 8.8
  ELSA-2024-10791 3 CVEs

  Important: postgresql security update (Oracle Linux 9)

  [13.18-1] - Update to 13.18

  Dec 10, 2024
• High max 6.6
  ELSA-2024-10858 1 CVE

  Important: ruby security update (Oracle Linux 9)

  [3.0.7-163] - Fix REXML ReDoS vulnerability. (CVE-2024-49761) Resolves: rbhz#2322153 [3.0.7-162] - Upgrade to Ruby 3.0.7. Resolves: RHEL-35740 - Fix HTTP response splitting in CGI. Resolves: RHEL-35741 - Fix ReDoS vulnerability in URI. Resolves: RHEL-35742 - …

  Dec 10, 2024
• High max 7.5
  ELSA-2024-9654 1 CVE

  Important: libsoup security update (Oracle Linux 7)

  [2.62.2-2.0.1] - Fixed CVE-2024-52530 for smuggling nullbytes in header names [Orabug: 37289659]

  Dec 9, 2024
• High max 6.6
  ELSA-2024-10850 1 CVE

  Important: ruby:2.5 security update (Oracle Linux 8)

  ruby [2.5.9-113.0.1] - Fix REXML ReDoS vulnerability CVE-2024-49761. rubygem-abrt [0.3.0-4] - Execute test suite unconditionally. - Upload correct sources. rubygem-bson rubygem-bundler rubygem-mongo [2.5.1-2] - Disable tests to fix FTBFS by dropped MongoDB mo…

  Dec 9, 2024
• High max 9.8
  ELSA-2024-12868 80 CVEs 1 exploited

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

  [4.14.35-2047.543.3] - rds: Add rds stuck shutdown timeout (Rohit Nair) [Orabug: 37214079] - gtp: allow -1 to be specified as file description from userspace (Pablo Neira Ayuso) - ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin (Takashi Iwai) …

  Dec 6, 2024
• High max 8.8
  ELSA-2024-10785 3 CVEs

  Important: postgresql:12 security update (Oracle Linux 8)

  pgaudit pg_repack postgres-decoderbufs postgresql [12.22-1] - Update to 12.22 - Fixes: CVE-2024-10976 CVE-2024-10978

  Dec 6, 2024
• High max 8.8
  ELSA-2024-10830 3 CVEs

  Important: postgresql:15 security update (Oracle Linux 8)

  pgaudit pg_repack postgres-decoderbufs postgresql [15.10-1] - Update to 15.10 - Fixes: CVE-2024-10976 CVE-2024-10978 CVE-2024-10979

  Dec 6, 2024
• High max 6.6
  ELSA-2024-10834 1 CVE

  Important: ruby:3.1 security update (Oracle Linux 8)

  ruby [3.1.5-144] - Fix REXML ReDoS vulnerability. (CVE-2024-49761) Resolves: RHEL-68520 rubygem-abrt rubygem-mysql2 rubygem-pg

  Dec 6, 2024
• Medium max 7.0
  ELSA-2024-10869 5 CVEs

  Moderate: redis:7 security update (Oracle Linux 9)

  [7.2.6-1] - rebase to 7.2.6 RHEL-26628 [7.0.12-1] - rebase to 7.0.12 #2221899 [7.0.11-1] - rebase to 7.0.11 for new redis:7 stream #2129826 [7.0.11-1] - Upstream 7.0.11 release. [7.0.10-2] - fix modules directory ownership and permissions #2176173 - drop redi…

  Dec 6, 2024
• High max 8.8
  ELSA-2024-10787 3 CVEs

  Important: postgresql:15 security update (Oracle Linux 9)

  pgaudit pg_repack postgres-decoderbufs postgresql [15.10-1] - Update to 15.10 - Fixes: CVE-2024-10976 CVE-2024-10978 CVE-2024-10979

  Dec 6, 2024
• High max 6.6
  ELSA-2024-10860 1 CVE

  Important: ruby:3.1 security update (Oracle Linux 9)

  ruby [3.1.5-145] - Fix REXML ReDoS vulnerability. (CVE-2024-49761) Resolves: RHEL-68530 [3.1.5-144] - Upgrade to Ruby 3.1.5. Resolves: RHEL-33978 - Fix buffer overread vulnerability in StringIO. Resolves: RHEL-34129 - Fix RCE vulnerability with .rdoc_options …

  Dec 6, 2024
• High max 8.8
  ELSA-2024-10831 3 CVEs

  Important: postgresql:16 security update (Oracle Linux 8)

  pgaudit [16.0-1] - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3636 pg_repack [1.5.1-1] - Update to 1.5.1 postgres-decoderbufs [2.4.0-1.Final] - Initial import for postgresql 16 stream - Related: RHEL-3636 postgre…

  Dec 5, 2024
• High max 8.8
  ELSA-2024-10832 3 CVEs

  Important: postgresql:13 security update (Oracle Linux 8)

  pgaudit [1.5.0-1] - Update to version 1.5.0 Related: #1855776 [1.4.0-4] - Bump release for rebuild against libpq-12.1-3 [1.4.0-3] - BuildRequires libpq-devel [1.4.0-2] - BuildRequires postgresql-server-devel [1.4.0-1] - Update to 1.4.0 [1.3.1-1] - Update to 1…

  Dec 5, 2024
• Medium max 6.3
  ELSA-2024-10779 2 CVEs

  Moderate: python3:3.6.8 security update (Oracle Linux 8)

  [3.6.8-69.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8.openela.0] - Add openela to supported dists [3.6.8-69] - Security fix for CVE-2024-11168 Resolves: RHEL-67252 [3.6.8-68] - Security fix for CVE-2024-9287 Resolves: RHEL-64…

  Dec 4, 2024
• High max 8.8
  ELSA-2024-10788 3 CVEs

  Important: postgresql:16 security update (Oracle Linux 9)

  pgaudit pg_repack [1.5.1-1] - Update to v1.5.1 pgvector [0.6.2-1] - Initial packaging postgres-decoderbufs postgresql [16.6-1] - Update to 16.6 - Fixes: CVE-2024-10976 CVE-2024-10978 CVE-2024-10979 [16.4-2] - Fix build on 16.4 [16.4-1] - Update to 16.4 [16.1-…

  Dec 4, 2024
• High max 7.8
  ELSA-2024-9901 1 CVE

  Important: tigervnc security update (Oracle Linux 7)

  [1.8.0-33.0.3] - xorg-x11-server: xkb: Fix buffer overflow in _XkbSetCompatMap() [CVE-2024-9632][Orabug: 37295822]

  Dec 3, 2024
• High max 8.8
  ELSA-2024-10591 7 CVEs

  Important: thunderbird security update (Oracle Linux 8)

  [128.5.0-1.0.1] - Fix prefs for new nss [Orabug: 37079820] - Add Oracle prefs file [128.5.0] - Add OpenELA debranding [128.5.0-1] - Update to 128.5.0 build1

  Dec 3, 2024
• High max 8.8
  ELSA-2024-10752 6 CVEs

  Important: firefox security update (Oracle Linux 8)

  [128.5.1-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] [128.5.1] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [128.5.1-1] - Update to 128.5.1 [128.5.0-1] - Update to 128.5.0 build1

  Dec 3, 2024
• High max 8.8
  ELSA-2024-10592 7 CVEs

  Important: thunderbird security update (Oracle Linux 9)

  [128.5.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [128.5.0] - Add OpenELA debranding [128.5.0-1] - Update to 128.5.0 build1

  Dec 3, 2024
• High max 8.8
  ELSA-2024-10702 6 CVEs

  Important: firefox security update (Oracle Linux 9)

  [128.5.1-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [128.5.1] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Ab…

  Dec 3, 2024
• High max 7.5
  ELSA-2024-10590 1 CVE

  Important: python-tornado security update (Oracle Linux 9)

  [6.4.2-1] - Update to 6.4.2 Resolves: RHEL-68663

  Dec 2, 2024
• High max 9.0
  ELSA-2024-8788 1 CVE

  Important: krb5 security update (Oracle Linux 7)

  [1.15.1-55.0.7] - libkrad: implement support for Message-Authenticator (CVE-2024-3596) [Orabug: 37241077]

  Nov 30, 2024
• High max 7.8
  ELSA-2024-10384 2 CVEs

  Important: tuned security update (Oracle Linux 9)

  [2.24.0-2.0.1] - Fix RPS/XPS and busy polling optimization not getting applied [Orabug: 32153315] - Fix error in uninstalling tuned [Orabug: 351528377] - Updated patch with the more recent version [Orabug: 30730976] - Set AMD CPU freq governor to ondemand whe…

  Nov 29, 2024
• Medium max 4.8
  ELSA-2024-8116 5 CVEs

  Moderate: java-1.8.0-openjdk security update (Oracle Linux 7)

  [1:1.8.0.432.b06-1.0.1] - Update to shenandoah8u432-b06 [Orabug: 37185223] - Fixes CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235 - Removed patches - 1001-orabug36904359-CVE-2024-21131-fix.patch - 1002-orabug36904359-CVE-2024-21138-fix.patch - 10…

  Nov 28, 2024
• Medium max 4.8
  ELSA-2024-8120 5 CVEs

  Moderate: java-11-openjdk security update (Oracle Linux 7)

  [1:11.0.25.0.9-1.0.1] - Update to jdk-11.0.25+9 (GA) [Orabug: 37178930] - Fixes CVE-2024-21208 CVE-2024-21210 CVE-2024-21217 CVE-2024-21235 - Removed patches - 1001-orabug36904359-CVE-2024-21138-fix.patch - 1002-orabug36904359-CVE-2024-21138-fix.patch - 1003-…

  Nov 28, 2024