Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,316 results · Feed

  • High max 7.8
    ELSA-2024-12851 17 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.92.3] - memcg_write_event_control(): fix a user-triggerable oops (Al Viro) [Orabug: 37070674] {CVE-2024-45021} - ocfs2: fix races between hole punching and AIO+DIO (Su Yue) [Orabug: 36835819] {CVE-2024-40943} [4.1.12-124.92.2] - fbdev: savage: Han…

  • Medium max 6.5
    ELSA-2024-10289 3 CVEs

    Moderate: container-tools:ol8 security update (Oracle Linux 8)

    aardvark-dns buildah [2:1.33.11-1] - update to the latest content of https://github.com/containers/buildah/tree/release-1.33 (https://github.com/containers/buildah/commit/fe85f0d) - Resolves: RHEL-61853 [2:1.33.10-1] - update to the latest content of https://…

  • High max 6.3
    ELSA-2024-10481 1 CVE 1 exploited

    Important: webkit2gtk3 security update (Oracle Linux 8)

    [2.46.3-2] - Add patch for CVE-2024-44309

  • Medium max 9.8
    ELSA-2024-10219 1 CVE

    Moderate: perl-App-cpanminus:1.7044 security update (Oracle Linux 8)

    perl-App-cpanminus [1.7044-6] - Patch the code to use https instead of http (CVE-2024-45321) perl-CPAN-DistnameInfo perl-CPAN-Meta-Check perl-File-pushd perl-Module-CPANfile perl-Parse-PMFile perl-String-ShellQuote perl-App-cpanminus [1.7044-6] - Patch the co…

  • High max 6.3
    ELSA-2024-10472 1 CVE 1 exploited

    Important: webkit2gtk3 security update (Oracle Linux 9)

    [2.46.3-2] - Add patch for CVE-2024-44309

  • Medium max 8.1
    ELSA-2024-10281 4 CVEs

    Moderate: kernel:4.18.0 security update (Oracle Linux 8)

    - [4.18.0-553.30.1_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.…

  • High max 7.4
    ELSA-2024-10379 2 CVEs

    Important: pam security update (Oracle Linux 8)

    [1.3.1-36.0.1] - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36272695] [1.3.1-36] - pam_access: rework resolving of tokens as hostname. Resolves: CVE-2024-10963 and RHEL-66242 [1.3.1-35] - pam_unix: always run the helper to obtain shadow pa…

  • Medium max 7.8
    ELSA-2024-10274 3 CVEs

    Moderate: kernel security update (Oracle Linux 9)

    - [5.14.0-503.15.1_5.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_ke…

  • High max 7.8
    ELSA-2024-12845 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.336.5.3.1.el8uek] - mm: avoid leaving partial pfn mappings around in error case (Linus Torvalds) [Orabug: 37311329] {CVE-2024-47674} - mm: add remap_pfn_range_notrack (Christoph Hellwig) [Orabug: 37311329] {CVE-2024-47674} - mm/memory.c: make rem…

  • Medium max 9.8
    ELSA-2024-10218 1 CVE

    Moderate: perl-App-cpanminus security update (Oracle Linux 9)

    [1.7044-14.1] - Patch the code to use https instead of http (CVE-2024-45321) - Resolves: RHEL-56519

  • High max 7.4
    ELSA-2024-10244 1 CVE

    Important: pam:1.5.1 security update (Oracle Linux 9)

    [1.5.1-22.0.1] - pam_access: clean up the remote host matching code [Orabug: 36771903] - pam_limits: fix use after free in pam_sm_open_session [Orabug: 36406534] [1.5.1-22] - pam_access: rework resolving of tokens as hostname. Resolves: CVE-2024-10963 and RHE…

  • Medium max 6.5
    ELSA-2024-12842 4 CVEs

    Moderate: edk2 security update (Oracle Linux 9)

    * Mon Sep 09 2024 Aaron Young <aaron.young@oracle.com> - Create new 20240909 release for OL9 which includes the following fixed CVEs: - EDK2: EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division-By-Zero due to a UNIT…

  • High max 8.2
    ELSA-2024-8795 1 CVE

    Important: xerces-c security update (Oracle Linux 7)

    [3.1.1-10.0.1] - back port fix for CVE-2023-37536 [Orabug: 37241079]

  • High max 7.5
    ELSA-2024-9738 1 CVE

    Important: squid security update (Oracle Linux 7)

    [7:3.5.20-17.0.3] - Disable ESI support [CVE-2024-45802][Orabug: 37289058]

  • Medium max 4.4
    ELSA-2024-9458 1 CVE

    Moderate: python3.11-urllib3 security update (Oracle Linux 9)

    [1.26.12-2.1] - Security fix for CVE-2024-37891 Resolves: RHEL-59990

  • Medium max 7.5
    ELSA-2024-9468 1 CVE

    Moderate: python3.9 security update (Oracle Linux 9)

    [3.9.19-8.1] - Security fix for CVE-2024-6232 Resolves: RHEL-57420

  • High max 7.5
    ELSA-2024-9472 1 CVE

    Important: grafana-pcp security update (Oracle Linux 9)

    [5.1.1-9] - Resolves: RHEL-57932 [5.1.1-8] - Add a premade uwsgi dashboard for the vector datasource

  • High max 10.0
    ELSA-2024-9473 2 CVEs

    Important: grafana security update (Oracle Linux 9)

    [10.2.6-7] - Resolves RHEL-62308: CVE-2024-47875 [10.2.6-6] - Resolves: RHEL-57927 [10.2.6-5] - Resolves RHEL-47185

  • High max 9.0
    ELSA-2024-9474 1 CVE

    Important: krb5 security update (Oracle Linux 9)

    [1.21.1-4.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767] [1.21.1-4] - libkrad: implement support for Message-Authenticator (CVE-2024-3596) Resolves: RHEL-55423 - Fix various issues detected by static analysis Resolves: RHEL-58216 - Remo…

  • Medium max 4.4
    ELSA-2024-9457 1 CVE

    Moderate: python3.12-urllib3 security update (Oracle Linux 9)

    [1.26.18-2.1] - Security fix for CVE-2024-37891 Resolves: RHEL-59997

  • Low max 8.6
    ELSA-2024-9470 1 CVE

    Low: cups security update (Oracle Linux 9)

    [1:2.3.3op2-31] - RHEL-60343 CVE-2024-47175 cups: remote command injection via attacker controlled data in PPD file

  • High max 7.8
    ELSA-2024-12830 7 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-300.163.18.7] - Revert 'net/mlx5: disable the 'fast unload' feature on Exadata systems' (Qing Huang) [Orabug: 37285705] - Revert 'net/mlx5: pretend 'fast unload' succeeded on Exadata systems' (Qing Huang) [Orabug: 37285705] [5.15.0-300.163.18.6] - x86…

  • High max 7.5
    ELSA-2024-9456 1 CVE

    Important: osbuild-composer security update (Oracle Linux 9)

    [118-2.0.1] - Simplify repository names [JIRA: OLDIS-35893] [118-2] - Ensure build on latest golang: CVE-2024-34156

  • High max 7.8
    ELSA-2024-9459 7 CVEs

    Important: buildah security update (Oracle Linux 9)

    [1.37.5-1.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.37.5-1] - update to https://github.com/containers/buildah/releases/tag/v1.37.5 - Resolves: RHEL-61857 [2:1.37.4-2] - enable CNI - Resolves: RHEL-62107 [2:1.37…

  • High max 7.8
    ELSA-2024-9454 7 CVEs

    Important: podman security update (Oracle Linux 9)

    [5.2.2-9.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [4:5.2.2-9] - update to the latest content o…

  • High max 7.8
    ELSA-2024-10090 1 CVE

    Important: tigervnc security update (Oracle Linux 9)

    [1.14.1-1] - 1.14.1 Resolves: RHEL-66600 - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability Resolves: RHEL-62000

  • Medium max 5.5
    ELSA-2024-9452 2 CVEs

    Moderate: pcp security update (Oracle Linux 9)

    [6.2.2-7] - Fix buffer sizing checks in pmstore PDU handling (RHEL-57809) - Guard against symlink attacks in pmpost program (RHEL-57814) - Fix libpcp_web webgroup slow request refcounting (RHEL-58307) - Updated pmdahacluster for newer crm_mon versions (RHEL-5…

  • High max 9.8
    ELSA-2024-9543 2 CVEs

    Important: .NET 9.0 security update (Oracle Linux 9)

    [9.0.100-1.0.1] - Add support for Oracle Linux [9.0.100-1] - Update to .NET SDK 9.0.100 and Runtime 9.0.0 - Resolves: RHEL-65539 [9.0.100~rc.2.24474.1-0.7] - Disable bootstrap - Related: RHEL-62776 [9.0.100~rc.2.24474.1-0.6] - Rebootstrap - Related: RHEL-6277…

  • Medium max 8.1
    ELSA-2024-9605 3 CVEs

    Moderate: kernel security update (Oracle Linux 9)

    - [5.14.0-503.14.1_5.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_ke…

  • High max 10.0
    ELSA-2024-9449 1 CVE

    Important: bubblewrap and flatpak security update (Oracle Linux 9)

    bubblewrap [0.4.1-8] - Backport upstream fix to help address CVE-2024-42472 in flatpak flatpak [1.12.9-3] - Fix previous changelog entry [1.12.9-2] - Backport upstream patches for CVE-2024-42472 - Require bubblewrap version that has new --bind-fd option backp…

  • High max 7.8
    ELSA-2024-9555 1 CVE

    Important: NetworkManager-libreswan security update (Oracle Linux 9)

    [1.2.22-4] - Unbreak validation of unknown keys [1.2.22-2] - Fix improper escaping of Libreswan configuration (CVE-2024-9050)

  • Medium max 7.5
    ELSA-2024-9451 1 CVE

    Moderate: python3.12 security update (Oracle Linux 9)

    [3.12.5-2.1] - Security fix for CVE-2024-6232 Resolves: RHEL-57415

  • Medium max 5.9
    ELSA-2024-9541 1 CVE

    Moderate: expat security update (Oracle Linux 9)

    [2.5.0-3.1] - Fix CVE-2024-50602 - Resolves: RHEL-65064 [2.5.0-3] - Fix CVE-2024-45490, CVE-2024-45491, CVE-2024-45492 - Resolves: RHEL-56761 - Resolves: RHEL-57520 - Resolves: RHEL-57511

  • High max 9.1
    ELSA-2024-9548 1 CVE

    Important: openexr security update (Oracle Linux 9)

    [3.1.1-2.1] - fix CVE-2023-5481 (RHEL-64162)

  • High max 9.8
    ELSA-2024-9552 11 CVEs 1 exploited

    Important: thunderbird security update (Oracle Linux 9)

    [128.4.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [128.4.0] - Add OpenELA debranding [128.4.0-1] - Update to 128.4.0 build1

  • High max 6.5
    ELSA-2024-9553 5 CVEs

    Important: webkit2gtk3 security update (Oracle Linux 9)

    [2.46.3-1] - Update to 2.46.3 [2.46.2-1] - Update to 2.46.2 - Add patch to disable Evolution sandbox warning [2.46.1-2] - Add patch to keep GSocketMonitor callback alive Resolves: RHEL-59185 [2.46.1-1] - Update to 2.46.1 Resolves: RHEL-59185

  • High max 9.8
    ELSA-2024-9554 11 CVEs 1 exploited

    Important: firefox security update (Oracle Linux 9)

    [128.4.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [128.4.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Ab…

  • High max 7.5
    ELSA-2024-9559 2 CVEs

    Important: libsoup security update (Oracle Linux 9)

    [2.72.0-8.el9_5.2] - Backport upstream patch for CVE-2024-52532 - infinite loop while reading websocket data - Resolves: RHEL-67068 [2.72.0-8.el9_5.1] - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends…

  • High max 7.5
    ELSA-2024-9625 1 CVE

    Important: squid security update (Oracle Linux 9)

    [7:5.5-14.3] - Disable ESI support - Resolves: RHEL-65076 - CVE-2024-45802 squid: Denial of Service processing ESI response content [7:5.5-14.2] - Resolves: RHEL-64425 TCP_MISS_ABORTED/100 erros when uploading [7:5.5-14.1] - Resolves: RHEL-62332 - (Regression…

  • Medium max 5.9
    ELSA-2024-9827 1 CVE

    Moderate: libvpx security update (Oracle Linux 9)

    [1.9.0-8] - Add patch to fix integer overflows. - Disable LTO to fix build - Resolves: RHEL-58144