Oracle Linux Security Advisories (ELSA)

8,313 results · Feed

• High max 8.6
  ELSA-2026-83384 5 CVEs

  Important: libsoup security update (Oracle Linux 9)

  [2.72.0-16.8] - CVE-2026-102556 libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion [2.72.0-16.7] - CVE-2026-102558 libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth [2.72.0-16.6] - CVE-2026-102559 libs…

  Oct 15, 2026
• High max 8.1
  ELSA-2026-83546 5 CVEs

  Important: wireshark security update (Oracle Linux 9)

  [1:3.4.10-10.4] - Fix DoS via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) - Resolves: RHEL-272330 [1:3.4.10-9.4] - Fix DoS vulnerability in H.245 protocol dissector (CVE-2026-76927) - Resolves: RHEL-257656 [1:3.4.10-9.3] - Fix DoS vulnerabil…

  Oct 15, 2026
• High max 7.8
  ELSA-2026-83553 2 CVEs

  Important: ghostscript security update (Oracle Linux 9)

  [9.54.0-19.3] - RHEL-273957 CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data [9.54.0-19.2] - CVE-2026-101258 ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-str…

  Oct 15, 2026
• High max 7.5
  ELSA-2026-83562 1 CVE

  Important: rpcbind security update (Oracle Linux 9)

  [1.2.6-7.1] - CVE-2026-94640 rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service statistics tracking allows unauthenticated remote denial of service - Resolves: RHEL-266677

  Oct 15, 2026
• High max 7.8
  ELSA-2026-500395 1 CVE

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

  [5.15.0-325.221.6.3] - exec: Cleanup POSIX timers right after de_thread() (Hyunwoo Kim) [Orabug: 40157515] {CVE-2026-98260} [5.15.0-325.221.6.2] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner) [Orabug: 39784995] {CVE-2026-462…

  Oct 15, 2026
• High max 10.0
  ELSA-2026-83156 18 CVEs

  Important: kernel security update (Oracle Linux 9)

  [5.14.0-687.58.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  Oct 15, 2026
• High max 9.3
  ELSA-2026-82883 11 CVEs

  Important: hplip security, bug fix, and enhancement update (Oracle Linux 10)

  [3.26.6-1.3] - fix LEDM scanner regression [3.26.6-1.2] - fix OSH issues [3.26.6-1.1] - Create right dir [3.26.6-1] - RHEL-266547 [IMAGE-MODE] missing /var/lib/hp on image-mode [3.26.6-1] - Rebase to 3.26.6

  Oct 15, 2026
• High max 7.5
  ELSA-2026-83561 1 CVE

  Important: rpcbind security update (Oracle Linux 10)

  [1.2.7-3.1] - CVE-2026-94640 rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service statistics tracking allows unauthenticated remote denial of service Resolves: RHEL-266672

  Oct 15, 2026
• High max 7.8
  ELSA-2026-83551 2 CVEs

  Important: ghostscript security update (Oracle Linux 10)

  [10.02.1-16.3] - CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data [10.02.1-16.2] - CVE-2026-101258 ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-af…

  Oct 15, 2026
• High max 8.6
  ELSA-2026-83618 6 CVEs

  Important: libsoup3 security update (Oracle Linux 10)

  [3.6.5-20] - CVE-2026-102557 libsoup3: libsoup: Heap buffer overflow during WebSocket message reassembly [3.6.5-19] - CVE-2026-102556 libsoup3: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion [3.6.5-18] - CVE-2026-102558 libsoup3: libs…

  Oct 15, 2026
• High max 9.8
  ELSA-2026-500394 6 CVEs

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

  [6.12.0-207.111.5.3] - mm/pagewalk: fix stale walk->action escaping walk_pmd_range() (Hyunwoo Kim) [Orabug: 40157478] {CVE-2026-89754} - exec: Cleanup POSIX timers right after de_thread() (Hyunwoo Kim) [Orabug: 40157474] {CVE-2026-98260} [6.12.0-207.111.5.2] …

  Oct 15, 2026
• High max 9.8
  ELSA-2026-83207 20 CVEs

  Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

  [6.12.0-211.66.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  Oct 15, 2026
• High max 7.8
  ELSA-2026-72367 4 CVEs

  Important: gstreamer1-plugins-good security update (Oracle Linux 7)

  [1.10.4-2.0.7] - Backport fix for CVE-2026-18295 [Orabug: 40083058] - Backport fix for CVE-2026-18296 [Orabug: 40083058] - Backport fix for CVE-2026-18298 [Orabug: 40083058] - Backport fix for CVE-2026-18299 [Orabug: 40083058] [1.10.4-2.0.5] - Fix CVE-2026-53…

  Oct 14, 2026
• High max 7.8
  ELSA-2026-69866 1 CVE

  Important: gstreamer1-plugins-base security update (Oracle Linux 7)

  [1.10.4-2.0.5] - Backport fix for CVE-2026-18297 [Orabug: 40057731] [1.10.4-2.0.3] - Security update for CVE-2026-2921 [Orabug: 39199326] [1.10.4-2.0.1] - Fixed CVE-2024-47607,CVE-2024-47538 and CVE-2024-47615 [Orabug: 37407070]

  Oct 14, 2026
• High max 7.6
  ELSA-2026-67861 1 CVE

  Important: gstreamer1-plugins-bad-free security update (Oracle Linux 7)

  [1.10.4-4.0.7] - Backport fix for CVE-2026-19387 [Orabug: 40030729] [1.10.4-4.0.5] - Security update for CVE-2026-59691 CVE-2026-59692 [Orabug: 39878399] [1.10.4-4.0.3] - Security update for CVE-2026-52720 CVE-2026-52722 [Orabug: 39799399] [1.10.4-4.0.1] - Se…

  Oct 14, 2026
• High max 9.4
  ELSA-2026-82807 9 CVEs

  Important: kernel security update (Oracle Linux 8)

  [4.18.0-553.173.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  Oct 14, 2026
• High max 9.3
  ELSA-2026-35843 2 CVEs

  Important: flatpak security update (Oracle Linux 7)

  [1.12.9-4.0.1] - Restore the flatpak-builder 1.0.0 subpackage [Orabug: 40105180] - Move flatpak-session-helper back into flatpak [Orabug: 40105180] [1.12.9-4] - Import to OL7 [Orabug: 39695281] [1.12.9-4] - Fix arbitrary code execution via crafted symlinks in…

  Oct 13, 2026
• High max 9.3
  ELSA-2026-82295 12 CVEs

  Important: hplip security update (Oracle Linux 8)

  [3.26.6-3] - Fix LEDM scanning [3.26.6-2] - fix OSH issues [3.26.6-1] - Rebase to 3.26.6

  Oct 13, 2026
• High max 7.1
  ELSA-2026-82345 5 CVEs

  Important: OpenEXR security update (Oracle Linux 8)

  [2.2.0-12.3] - fix CVE-2026-59184 - fix CVE-2026-59981 - fix CVE-2026-59189 - fix CVE-2026-59186 [2.2.0-12.2] - fix CVE-2026-68515

  Oct 13, 2026
• High max 7.1
  ELSA-2026-82094 1 CVE

  Important: librabbitmq security update (Oracle Linux 9)

  [0.11.0-7.1] - CVE-2026-44236 librabbitmq: rabbitmq-c: Heap buffer overflow leading to denial of service [rhel-8.10.z] to denial of service [rhel-8.10.z] Resolves: RHEL-266750

  Oct 13, 2026
• High max 7.5
  ELSA-2026-82040 1 CVE

  Important: python-tornado security update (Oracle Linux 9)

  [6.5.10-1.1] - Update to 6.5.10 Resolves: RHEL-274870

  Oct 13, 2026
• High max 7.8
  ELSA-2026-82015 3 CVEs

  Important: xorg-x11-server security update (Oracle Linux 9)

  [1.20.11-34.4] - CVE fix for: CVE-2026-88812, CVE-2026-93521, CVE-2026-93523 Resolves: https://redhat.atlassian.net/browse/RHEL-278161 Resolves: https://redhat.atlassian.net/browse/RHEL-278164 Resolves: https://redhat.atlassian.net/browse/RHEL-278169

  Oct 13, 2026
• High max 9.8
  ELSA-2026-80694 42 CVEs

  Important: thunderbird security update (Oracle Linux 9)

  [140.17.0-1.0.1] - Fix prefs for new nss [Orabug: 37079813] - Add Oracle prefs [140.17.0] - Add OpenELA debranding [140.17.0-1] - Update to 140.17.0 ESR

  Oct 13, 2026
• High max 8.5
  ELSA-2026-82013 4 CVEs

  Important: libreoffice security update (Oracle Linux 9)

  [7.1.8.1-15.0.1.el9_8.3] - Added the --with-hamcrest option to configure. - Replace colors with Oracle colors [Orabug: 32120093] [1:7.1.8.1-15.el9_8.3] - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-…

  Oct 13, 2026
• High max 9.8
  ELSA-2026-81552 13 CVEs

  Important: kernel security update (Oracle Linux 9)

  [5.14.0-687.57.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  Oct 13, 2026
• High max 8.2
  ELSA-2026-81532 7 CVEs

  Important: pcre2 security update (Oracle Linux 9)

  [10.40-7.0.1] - Add post script to resolve Regex version mismatch [Orabug: 34742224] [10.40-7] - Backport multiple CVE fixes - CVE-2026-86145, CVE-2026-89156, CVE-2026-89157, CVE-2026-89158, CVE-2026-89160, CVE-2026-89161

  Oct 13, 2026
• High max 8.4
  ELSA-2026-500385 9 CVEs

  Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

  [5.15.0-325.221.6.2] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner) [Orabug: 39784995] {CVE-2026-46242} - eventpoll: move epi_fget() up (Christian Brauner) [Orabug: 39784995] - eventpoll: rename ep_remove_safe() back to ep_r…

  Oct 13, 2026
• High max 7.5
  ELSA-2026-82041 1 CVE

  Important: python-tornado security update (Oracle Linux 10)

  [6.5.10-1.1] - Update to 6.5.10 Resolves: RHEL-274866

  Oct 13, 2026
• High max 8.2
  ELSA-2026-81522 7 CVEs

  Important: pcre2 security update (Oracle Linux 10)

  [10.44-1.5.0.1] - Add post script to resolve Regex version mismatch [Orabug: 34742224] [10.44-1.5] - Fix and bump release, resolve the issue of build not attaching to errata [10.44-1.4] - Backport CVE fixes for CVE-2026-86145, CVE-2026-89156, CVE-2026-89157, …

  Oct 13, 2026
• High max 7.0
  ELSA-2026-67979 2 CVEs

  Important: microcode_ctl security, bug fix, and enhancement update (Oracle Linux 10)

  [20260812-1.0.2] - disable late update for 06-ad-01 [20260812-1.0.1] - enable use with ueknext and UEK8 kernels - don't bother calling dracut if virtualized - ensure UEK also rebuilds initramfs - enable early update for 06-4f-01 - enable early and late load o…

  Oct 13, 2026
• Medium max 7.5
  ELSA-2026-82280 1 CVE

  Moderate: tftp security update (Oracle Linux 10)

  [5.2-50.1] - fix buffer overflow in remap genmatchstring() with inverse rules (CVE-2026-85234) (RHEL-260604)

  Oct 13, 2026
• High max 9.8
  ELSA-2026-81406 11 CVEs

  Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

  [6.12.0-211.65.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  Oct 13, 2026
• High max 7.5
  ELSA-2026-80817 2 CVEs

  Important: rsyslog security update (Oracle Linux 8)

  [8.2102.0-15.0.1.el8_10.3] - Fixes rsyslog segfault during shutdown when relp is configured with TLS [Orabug: 37588023] [8.2102.0-15.3] - Fix CVE-2026-78002: heap buffer overflow in RainerScript replace() function Resolves: RHEL-246632 [8.2102.0-15.2] - Backp…

  Oct 12, 2026
• High max 7.8
  ELSA-2026-80973 1 CVE

  Important: flatpak-builder security update (Oracle Linux 8)

  [1.2.3-2] - Disable git hooks when applying patches (CVE-2026-86320) Resolves: RHEL-262183

  Oct 12, 2026
• High max 8.2
  ELSA-2026-81613 4 CVEs

  Important: pcre2 security update (Oracle Linux 8)

  [10.32-4] - Backport multiple CVEs fixes - CVE-2026-89157, CVE-2026-89158, CVE-2026-86145, CVE-2026-103111 - Add explicit Requires on pcre2-utf16/utf32 for pcre2-tools subpackage

  Oct 12, 2026
• High max 9.1
  ELSA-2026-80825 8 CVEs

  Important: dovecot security update (Oracle Linux 9)

  [1:2.3.16-18.8] - fix CVE-2026-33605: ManageSieve protocol denial of service via lone CR character (RHEL-251989) [1:2.3.16-18.7] - fix CVE-2026-42007: use-after-free in pigeonhole editheader (RHEL-251952) [1:2.3.16-18.6] - fix CVE-2026-40018: incorrect escapi…

  Oct 12, 2026
• High
  ELSA-2026-81517 0 CVEs

  Important: gd security update (Oracle Linux 9)

  [2.3.2-3.1] - Fix buffer overflow and use of uninitialized memory in GIF decoding (CVE-2026-9672) Related: RHEL-259613

  Oct 12, 2026
• High max 7.0
  ELSA-2026-68011 2 CVEs

  Important: microcode_ctl security, bug fix, and enhancement update (Oracle Linux 9)

  [20260812-1.0.2] - disable late update for 06-ad-01 [20260812-1.0.1] - add support for UEK7/UEK8 and ueknext kernels - don't bother calling dracut if virtualized [Orabug: 35710094] - ensure UEK also rebuilds initramfs [Orabug: 34280058] - enable early update …

  Oct 12, 2026
• High
  ELSA-2026-81518 0 CVEs

  Important: gd security update (Oracle Linux 10)

  [2.3.3-20.1] - Fix LZW decompression in GIF handling (CVE-2026-9672) (Resolves: RHEL-259570)

  Oct 12, 2026
• Medium max 7.3
  ELSA-2026-80664 1 CVE

  Moderate: environment-modules security update (Oracle Linux 10)

  [5.6.1-2.1] - fix command injection in bash Tab completion (CVE-2026-85013) (RHEL-260562)

  Oct 12, 2026