Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,316 results · Feed

Low max 7.3

ELSA-2024-9405 1 CVE

Low: vim security update (Oracle Linux 9)

[8.2.2637-21.0.1] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-21] - RHEL-40602 CVE-2021-3903 vim: heap-based buffer overflow vulnerability

Nov 14, 2024
Medium max 7.1

ELSA-2024-9413 10 CVEs

Moderate: bluez security update (Oracle Linux 9)

[5.72-2] - Bump release to rebuild for RHEL-9.5 [5.72-1] - Update to 5.72

Nov 14, 2024
Medium max 7.0

ELSA-2024-9423 1 CVE

Moderate: python-dns security update (Oracle Linux 9)

[2.6.1-3] - Ensure dns.rdtypes subpackages are available Related: RHEL-32663 [2.6.1-2] - Add missing files due to build change from hatchling to setuptools Related: RHEL-32663 [2.6.1-1] - Rebase to 2.6.1 Resolves: RHEL-32628, RHEL-32663

Nov 14, 2024
Low max 9.1

ELSA-2024-9424 2 CVEs

Low: tpm2-tools security update (Oracle Linux 9)

[5.2-4] - Backport upstream fixes. - tpm2_checkquote: Fix check of magic number. (CVE-2024-29038) - tpm2_checkquote: Add comparison of pcr selection. (CVE-2024-29039) - Fix check of magic number. Resolves: RHEL-23198 Resolves: RHEL-41031 Resolves: RHEL-41035

Nov 14, 2024
Low max 6.7

ELSA-2024-9430 1 CVE

Low: nano security update (Oracle Linux 9)

[5.6.1-6] - fix emergency file replacement vulnerability (RHEL-35237)

Nov 14, 2024
Medium max 6.5

ELSA-2024-9439 2 CVEs

Moderate: fontforge security update (Oracle Linux 9)

[20201107-6] - Resolves: RHEL-26716 - CVE-2024-25081 and CVE-2024-25082 fontforge: various flaws

Nov 14, 2024
Medium max 5.2

ELSA-2024-9442 1 CVE

Moderate: mingw-glib2 security update (Oracle Linux 9)

[2.78.6-1] - Bump glib2 version 2.78.6 - Fix CVEs: CVE-2024-34397 - Resolves: RHEL-35776

Nov 14, 2024
Medium max 8.3

ELSA-2024-9098 4 CVEs

Moderate: skopeo security update (Oracle Linux 9)

[2:1.16.1-1] - update to https://github.com/containers/skopeo/releases/tag/v1.16.1 - Related: RHEL-27608 [2:1.16.0-1] - update to https://github.com/containers/skopeo/releases/tag/v1.16.0 - Resolves: RHEL-47197 RHEL-44886 RHEL-40812 [2:1.15.2-1] - update to h…

Nov 14, 2024
Medium max 8.3

ELSA-2024-9102 4 CVEs

Moderate: podman security update (Oracle Linux 9)

[5.2.2-1.0.2] - Bump epoch to ensure upgrade path [Orabug: 37240207] [5.2.2-1.0.1] - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694] - Drop nmap-ncat requirement and skip ignore-socket test…

Nov 14, 2024
Medium max 9.8

ELSA-2024-9115 5 CVEs

Moderate: grafana security update (Oracle Linux 9)

[10.2.6-4] - Resolves RHEL-44874 [10.2.6-3] - Resolves RHEL-35937 [10.2.6-2] - Fixes patch 1002 for update to golang-fips - Remove unused code under apsl-1.1 and apsl-1.2 licenses - Resolves RHEL-33655 [10.2.6-1] - Rebase to grafana 10.2.6 [9.2.10-15] - Resol…

Nov 14, 2024
Medium max 8.3

ELSA-2024-9097 2 CVEs

Moderate: buildah security update (Oracle Linux 9)

[1.37.2-1.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.37.2-1] - update to https://github.com/containers/buildah/releases/tag/v1.37.2 - Related: RHEL-27608 [2:1.37.1-1] - update to https://github.com/containers/bu…

Nov 14, 2024
Medium max 7.5

ELSA-2024-9089 2 CVEs

Moderate: containernetworking-plugins security update (Oracle Linux 9)

[1:1.5.1-2] - rebuild for CVE-2024-24791 - Resolves: RHEL-47166 [1:1.5.1-1] - update to https://github.com/containernetworking/plugins/releases/tag/v1.5.1 - Related: RHEL-27608 [1:1.5.0-1] - update to https://github.com/containernetworking/plugins/releases/ta…

Nov 14, 2024
Medium max 10.0

ELSA-2024-9315 478 CVEs

Moderate: kernel security update (Oracle Linux 9)

[5.14.0-503.11.1_5.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.…

Nov 14, 2024
High max 8.6

ELSA-2024-7553 4 CVEs

Important: cups-filters security update (Oracle Linux 7)

[1.0.35-29.0.3] - Unsupport cups-browsed service - CVE-2024-47076, CVE-2024-47175, CVE-2024-47176 [Orabug: 37217141]

Nov 13, 2024
Medium max 5.9

ELSA-2024-9502 1 CVE

Moderate: expat security update (Oracle Linux 8)

[2.2.5-16.0.1] - lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910314] [2.2.5-16] - Fix CVE-2024-50602 - Resolves: RHEL-65062

Nov 13, 2024
High max 7.5

ELSA-2024-9573 2 CVEs

Important: libsoup security update (Oracle Linux 8)

[2.62.3-6] - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends of header names - Backport upstream patch for CVE-2024-52530 - infinite loop while reading websocket data - Resolves: RHEL-67076 - Resolves…

Nov 13, 2024
High max 7.8

ELSA-2024-9540 1 CVE

Important: tigervnc security update (Oracle Linux 8)

[1.13.1-14] - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability Resolves: RHEL-61999

Nov 13, 2024
High max 9.8

ELSA-2024-12813 73 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.337.5] - net/mlx5: disable the 'fast unload' feature on Exadata systems (Qing Huang) [Orabug: 37093177] [5.4.17-2136.337.4] - ocfs2: reserve space for inline xattr before attaching reflink tree (Gautham Ananthakrishna) [Orabug: 37199020] - Revert…

Nov 12, 2024
High max 9.8

ELSA-2024-12814 9 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.542.2] - fs/dcache: allow fractional values in fs.negative-dentry-limit (Gautham Ananthakrishna) [Orabug: 37156524] - lib/math: move int_pow() from pwm_bl.c for wider use (Andy Shevchenko) [Orabug: 37156524] [4.14.35-2047.542.1] - genirq/cpuhotp…

Nov 11, 2024
Low max 9.8

ELSA-2024-8922 1 CVE

Low: bzip2 security update (Oracle Linux 8)

[1.0.6-27.0.1] - CVE-2019-12900: Accept as many selectors as the file format allows [Orabug: 37266061] [1.0.6-27] - Fixes out of bounds access in BZ2_decompress (RHEL-64929)

Nov 11, 2024
Medium max 7.8

ELSA-2024-9056 1 CVE

Moderate: gstreamer1-plugins-base security update (Oracle Linux 8)

[1.16.1-4.0.1] - Update origin URL [Orabug: 36209826] [1.16.1-4] - CVE-2024-4453 gstreamer1: EXIF Metadata Parsing Integer Overflow - Resolves: RHEL-38509

Nov 11, 2024
High max 7.8

ELSA-2024-9051 3 CVEs

Important: podman security update (Oracle Linux 9)

[4.9.4-16.0.1] - Fixes issue of podman execvp error while using podmansh [Orabug: 36073625] - Improved saving remote build context to tarfile in Podman daemon [Orabug: 36495655] - Add devices on container startup, not on creation - Backport fast gzip for comp…

Nov 11, 2024
High max 9.8

ELSA-2024-12815 211 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-302.167.6] - ice: Add a per-VF limit on number of FDIR filters (Ahmed Zaki) [Orabug: 36964088] {CVE-2024-42291} - scsi: lpfc: Fix a possible null pointer dereference (Huai-Yuan Liu) [Orabug: 36964437] {CVE-2024-43821} - power: reset: pwr-mlxbf: suppor…

Nov 11, 2024
High max 7.8

ELSA-2024-8357 1 CVE

Important: NetworkManager-libreswan security update (Oracle Linux 7)

[1.2.4-2.0.1] - Fix improper escaping of Libreswan configuration [CVE-2024-9050][Orabug: 37206712]

Nov 8, 2024
Medium max 9.8

ELSA-2024-8727 10 CVEs

Moderate: firefox security update (Oracle Linux 7)

[128.4.0-1.0.1] - Update to 128.4.0 build1 [Orabug: 37236498][CVE-2024-10458][CVE-2024-10459] [CVE-2024-10460][CVE-2024-10461][CVE-2024-10462][CVE-2024-10463] [CVE-2024-10464][CVE-2024-10465][CVE-2024-10466][CVE-2024-10467]

Nov 8, 2024
Medium max 6.2

ELSA-2024-8365 1 CVE

Moderate: python-idna security update (Oracle Linux 7)

[2.4-1.0.1] - Fixed CVE 2024-3651 [Orabug: 37206964]

Nov 7, 2024
Medium max 7.5

ELSA-2024-8935 1 CVE

Moderate: edk2 security update (Oracle Linux 9)

[20231122-6.0.1.el9_4.4] - Replace upstream references [Orabug:36569119] [20231122-6.el9_4.4] - edk2-Bumped-openssl-submodule-version-to-0205b5898872.patch [RHEL-55337] - Resolves: RHEL-55337 (CVE-2024-6119 edk2/openssl: Possible denial of service in X.509 na…

Nov 6, 2024
Low max 2.8

ELSA-2024-8830 1 CVE

Low: bpftrace security update (Oracle Linux 8)

[0.16.0-6] - Fix security hole checking unpacked kernel headers (CVE-2024-2313) - Resolves: RHEL-28764

Nov 5, 2024
Low max 2.8

ELSA-2024-8831 1 CVE

Low: bcc security update (Oracle Linux 8)

[0.25.0-9] - Really prevent the loading of compromised headers (RHEL-28768, CVE-2024-2314) [0.25.0-8] - Check header ownership (RHEL-28768)

Nov 5, 2024
High max 9.8

ELSA-2024-8834 1 CVE

Important: python-gevent security update (Oracle Linux 8)

[1.2.2-5] - Avoid printing TypeError traceback - gevent.pywsgi: Much improved handling of chunk trailers Backport fix for CVE-2023-41419 Resolves: RHEL-17078

Nov 5, 2024
Medium max 7.5

ELSA-2024-8833 1 CVE

Moderate: libtiff security update (Oracle Linux 8)

[4.0.9-33] - fix CVE-2024-7006 a null pointer dereference in tif_dirinfo (RHEL-52927)

Nov 5, 2024
Medium max 4.4

ELSA-2024-8843 1 CVE

Moderate: python3.11-urllib3 security update (Oracle Linux 8)

[1.26.12-4] - Fix test_ssltransport for changes in ssl.SSLSocket in Python 3.11.3 Related: RHEL-59995 [1.26.12-3] - Security fix for CVE-2024-37891 Resolves: RHEL-59995

Nov 5, 2024
Medium max 8.2

ELSA-2024-8849 1 CVE

Moderate: haproxy security update (Oracle Linux 8)

[1.8.27-5.1] - Reject '#' as part of URI path component (CVE-2023-45539, RHEL-18168)

Nov 5, 2024
Medium max 4.4

ELSA-2024-8842 1 CVE

Moderate: python3.12-urllib3 security update (Oracle Linux 8)

[1.26.19-1] - Rebase to 1.26.19 to fix CVE-2024-37891 Resolves: RHEL-59989

Nov 5, 2024
Medium max 7.3

ELSA-2024-8859 1 CVE

Moderate: xmlrpc-c security update (Oracle Linux 8)

[1.51.0-10] - Prevent integer overflow or wraparound, CVE-2024-4549 (RHEL-57519)

Nov 5, 2024
High max 9.0

ELSA-2024-8860 1 CVE

Important: krb5 security update (Oracle Linux 8)

[1.18.2-30.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767] [1.18.2-30] - libkrad: implement support for Message-Authenticator (CVE-2024-3596) Resolves: RHEL-50253 - Remove RSA protocol for PKINIT Resolves: RHEL-17616

Nov 5, 2024
Medium max 7.5

ELSA-2024-8836 1 CVE

Moderate: python3.12 security update (Oracle Linux 8)

[3.12.6-1] - Update to 3.12.6 Resolves: RHEL-57405

Nov 5, 2024
Medium max 7.5

ELSA-2024-8838 1 CVE

Moderate: python3.11 security update (Oracle Linux 8)

[3.11.10-1.0.1] - Update rpm-macros description [Orabug: 36024572] [3.11.10-1] - Update to 3.11.10 Resolves: RHEL-57400

Nov 5, 2024
High max 7.8

ELSA-2024-8846 3 CVEs

Important: container-tools:ol8 security update (Oracle Linux 8)

aardvark-dns buildah cockpit-podman conmon containernetworking-plugins containers-common [1-82.0.1] - Updated removed references [Orabug: 33473101] (Alex Burmashev) - Adjust registries.conf (Nikita Gerasimov) - remove references to RedHat registry (Nikita Ger…

Nov 5, 2024
Medium max 6.5

ELSA-2024-8847 1 CVE

Moderate: grafana-pcp security update (Oracle Linux 8)

[5.1.1-9] - Resolves RHEL-61780: CVE-2024-9355

Nov 5, 2024