Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,316 results · Feed

Medium max 5.7

ELSA-2024-6153 1 CVE

Moderate: 389-ds-base security update (Oracle Linux 7)

[1.3.11.1-5.0.1] - Security fix for CVE-2024-5953 [Orabug: 37016708][CVE-2024-5953]

Sep 28, 2024
High max 8.8

ELSA-2024-12700 7 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.90.3] - SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int (Dai Ngo) [Orabug: 37055439] [4.1.12-124.90.2] - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (Justin Tee) [Orabug: 36643241] {CVE-2024-35930} - …

Sep 27, 2024
High max 7.5

ELSA-2024-7262 2 CVEs

Important: osbuild-composer security update (Oracle Linux 8)

[101-2.0.1] - Rebuilt to fix: - CVE-2024-34156 - CVE-2024-1394 - RHEL-24303 - RHEL-57905

Sep 27, 2024
Medium

ELSA-2024-12698 0 CVEs

Moderate: ovirt-engine security update (Oracle Linux 8)

[4.5.5-1.21] - Fix external providers properties observability

Sep 26, 2024
High max 7.5

ELSA-2024-7204 1 CVE

Important: osbuild-composer security update (Oracle Linux 9)

[101-2.0.1] - Rebuild on new golang to address CVE-2024-34156

Sep 26, 2024
Medium max 6.5

ELSA-2024-7260 6 CVEs

Moderate: net-snmp security update (Oracle Linux 9)

[5.9.1-13.0.1] - fix error index value when snmpget is used a proxy pass [Orabug: 35010262] [1:5.9.1-13.3] - fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808, CVE-2022-24809 and CVE-2022-24810 (RHEL-32062)

Sep 26, 2024
High max 9.8

ELSA-2024-5324 11 CVEs

Important: firefox security update (Oracle Linux 7)

[115.12.0-1.0.3] - Security fixes [Orabug: 36904311][Orabug: 36948200][CVE-2024-6601] [CVE-2024-6603][CVE-2024-6604][CVE-2024-7519][CVE-2024-7520][CVE-2024-7521] [CVE-2024-7522][CVE-2024-7524][CVE-2024-7525][CVE-2024-7526][CVE-2024-7527] [CVE-2024-7529]

Sep 25, 2024
High max 7.5

ELSA-2024-7135 1 CVE

Important: git-lfs security update (Oracle Linux 8)

[3.4.1-3] - Rebuild with new Golang - Resolves: RHEL-57900

Sep 25, 2024
High max 7.5

ELSA-2024-7136 1 CVE

Important: git-lfs security update (Oracle Linux 9)

[3.4.1-4] - Rebuild with new Golang - Resolves: RHEL-57920

Sep 25, 2024
Medium max 9.8

ELSA-2024-6987 3 CVEs

Moderate: emacs security update (Oracle Linux 8)

[1:26.1-12] - org-file-contents: Consider all remote files unsafe (CVE-2024-30205) - org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331) - Make Gnus treats inline MIME contents as untrusted (CVE-2024-30203) - Disable xwidgets …

Sep 24, 2024
Medium max 7.0

ELSA-2024-6963 1 CVE

Moderate: gtk3 security update (Oracle Linux 8)

[3.22.30-12] - Stop loading modules from cwd (CVE-2024-6655) - Resolves: RHEL-46988

Sep 24, 2024
Medium max 7.5

ELSA-2024-6973 2 CVEs

Moderate: dovecot security update (Oracle Linux 8)

[1:2.3.16-6] - fix CVE-2024-23185: very large headers can cause resource exhaustion when parsing message (RHEL-55219) - fix CVE-2024-23184: using a large number of address headers may trigger a denial of service (RHEL-55206)

Sep 24, 2024
Medium max 7.5

ELSA-2024-6975 3 CVEs

Moderate: python3 security update (Oracle Linux 8)

[3.6.8-67.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8-67] - Security fix for CVE-2024-6232 Resolves: RHEL-57399 [3.6.8-66] - Security fix for CVE-2024-6923 Resolves: RHEL-53065 [3.6.8-65] - Build Python with -O3 - https://fed…

Sep 24, 2024
Low max 6.7

ELSA-2024-6986 1 CVE

Low: nano security update (Oracle Linux 8)

[2.9.8-3] - fix incomplete backport of the fix for the emergency file replacement vulnerability (RHEL-35236) [2.9.8-2] - fix emergency file replacement vulnerability (RHEL-35236)

Sep 24, 2024
Medium max 9.8

ELSA-2024-6989 3 CVEs

Moderate: expat security update (Oracle Linux 8)

[2.2.5-15.0.1] - lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910314] [2.2.5-15] - Rebuild for test reconfiguration [2.2.5-14] - Fix multiple CVEs - Fix CVE-2024-45492 integer overflow - Fix CVE-2024-45491 Integer Overflow or Wraparoun…

Sep 24, 2024
Medium max 8.7

ELSA-2024-6961 3 CVEs

Moderate: python3.12 security update (Oracle Linux 8)

[3.12.5-2] - Security fix for CVE-2024-8088 Resolves: RHEL-55939 [3.12.5-1] - Update to 3.12.5 - Security fix for CVE-2024-6923 Resolves: RHEL-53075 [3.12.4-3] - Properly propagate the optimization flags to C extensions [3.12.4-2] - Build Python with -O3 - ht…

Sep 24, 2024
Medium max 8.7

ELSA-2024-6962 3 CVEs

Moderate: python3.11 security update (Oracle Linux 8)

[3.11.9-7.0.1] - Update rpm-macros description [Orabug: 36024572] [3.11.9-7] - Security fix for CVE-2024-8088 Resolves: RHEL-55934 [3.11.9-6] - Security fix for CVE-2024-6923 Resolves: RHEL-53089 [3.11.9-5] - Properly propagate the optimization flags to C ext…

Sep 24, 2024
Medium max 7.5

ELSA-2024-6969 5 CVEs

Moderate: container-tools:ol8 security update (Oracle Linux 8)

aardvark-dns buildah cockpit-podman conmon containernetworking-plugins containers-common container-selinux criu crun fuse-overlayfs libslirp netavark oci-seccomp-bpf-hook podman [4.9.4-13.0.1] - Fixes issue of container created in cgroupv2 not start in cgroup…

Sep 24, 2024
High max 10.0

ELSA-2024-7000 145 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-553.22.1_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.ge…

Sep 24, 2024
Medium max 8.2

ELSA-2024-6964 3 CVEs

Moderate: virt:ol and virt-devel:ol security update (Oracle Linux 8)

hivex libguestfs libguestfs-winsupport libiscsi libnbd [1.6.0-6] - Fix CVE-2024-7383 NBD server improper certificate validation resolves: RHEL-52728 libtpms libvirt libvirt-dbus libvirt-python nbdkit netcf perl-Sys-Virt qemu-kvm [6.2.0-53] - kvm-nbd-server-Fa…

Sep 24, 2024
High max 9.8

ELSA-2024-6997 21 CVEs

Important: kernel security update (Oracle Linux 9)

[5.14.0-427.37.1_4.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.…

Sep 24, 2024
Medium

ELSA-2024-12684 1 CVE

Moderate: kernel security update (Oracle Linux 7)

[3.10.0-1160.119.1.0.4.el7.OL7] - fuse: fix pipe buffer lifetime for direct_io (Miklos Szeredi) [3.10.0-1160.119.1.0.4.el7.OL7]

Sep 23, 2024
High max 7.5

ELSA-2024-6908 4 CVEs

Important: go-toolset:ol8 security update (Oracle Linux 8)

delve [1.21.2-4.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.21.2-4] - Skip tests in %check due to incompatible Go version in buildroot (temporary). - Resolves: RHEL-59518 golang [1.21.13-2] - Rebuild Go with CVE Fixes - Remove fix-me…

Sep 23, 2024
High max 7.5

ELSA-2024-6946 1 CVE

Important: grafana-pcp security update (Oracle Linux 9)

[5.1.1-3] - Resolves RHEL-57930: CVE-2024-34156

Sep 23, 2024
High max 7.5

ELSA-2024-6947 1 CVE

Important: grafana security update (Oracle Linux 9)

[9.2.10-17] - Resolves RHEL-57925: CVE-2024-34156

Sep 23, 2024
High max 7.5

ELSA-2024-6913 4 CVEs

Important: golang security update (Oracle Linux 9)

[1.21.13-3] - Related: RHEL-58226 [1.21.13-2] - Rebuild Go with CVE Fixes - Remove fix-memleak-setupRSA.patch (exists upstream) - Resolves: RHEL-58226 - Resolves: RHEL-57962 - Resolves: RHEL-57848 - Resolves: RHEL-57865 [1.21.13-1] - Rebase to Go1.21.13 to pi…

Sep 23, 2024
High max 8.8

ELSA-2024-12682 22 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-300.163.18] - crypto: qat - specify firmware files for 402xx (Giovanni Cabiddu) [Orabug: 37044631] [5.15.0-300.163.17] - KVM/x86: Do not clear SIPI while in SMM (Boris Ostrovsky) [Orabug: 36955051] - Revert 'Fix userfaultfd_api to return EINVAL as exp…

Sep 23, 2024
High max 9.8

ELSA-2024-6684 8 CVEs

Important: thunderbird security update (Oracle Linux 8)

[128.2.0-1.0.2] - Fix prefs for new nss [Orabug: 37079820] [128.2.0-1.0.1] - Add Oracle prefs file [128.2.0] - Add OpenELA debranding [128.2.0-1] - Update to 128.2.0 [128.1.1-2] - Update to 128.1.1 [128.0-1] - Update to 128.0 final [128.0b4-1] - Update to 128…

Sep 20, 2024
High max 9.8

ELSA-2024-6682 8 CVEs

Important: firefox security update (Oracle Linux 8)

[128.2.0-1.0.2] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] [128.2.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding OpenELA file [128.2.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default prefe…

Sep 20, 2024
High max 9.8

ELSA-2024-6683 8 CVEs

Important: thunderbird security update (Oracle Linux 9)

[128.2.0-1.0.2] - Fix prefs for new nss [Orabug: 37079813] [128.2.0-1.0.1] - Add Oracle prefs [128.2.0] - Add OpenELA debranding [128.2.0-1] - Update to 128.2.0 [128.1.1-2] - Update to 128.1.1 [128.0-1] - Update to 128.0 final [128.0b4-1] - Update to 128.0b4

Sep 20, 2024
High max 9.8

ELSA-2024-6681 8 CVEs

Important: firefox security update (Oracle Linux 9)

[128.2.0-1.0.2] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] [128.2.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [128.2.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default prefe…

Sep 20, 2024
High max 5.5

ELSA-2024-6837 2 CVEs

Important: pcp security update (Oracle Linux 8)

[5.3.7-22.0.1] - pcp-zoneinfo fix to replay ol7 archives [Orabug: 35903733] - Backporting of python tool pcp-meminfo [Orabug: 35759707] - Backporting of python tool pcp-slabinfo [Orabug: 35560940] - Backporting of python tool pcp-buddyinfo [Orabug: 35660932] …

Sep 19, 2024
Medium max 5.9

ELSA-2024-6784 4 CVEs

Moderate: ruby:3.3 security update (Oracle Linux 8)

ruby [3.3.5-3] - Upgrade to Ruby 3.3.5 Resolves: RHEL-55409 - Fix DoS vulnerability in rexml. (CVE-2024-39908) (CVE-2024-41946) (CVE-2024-43398) Resolves: RHEL-57049 Resolves: RHEL-57054 Resolves: RHEL-57069 - Fix REXML DoS when parsing an XML having many spe…

Sep 19, 2024
High max 6.2

ELSA-2024-12673 1 CVE

Important: libvirt security update (Oracle Linux 9)

libvirt [9.0.0-6.el9] - rpc: ensure temporary GSource is removed from client event loop (Daniel P. Berrange) [Orabug: 36821472] {CVE-2024-4418} - rpc: Don't warn about 'max_client_requests' in single-threaded daemons (Peter Krempa) [Orabug: 36422853] libvirt-…

Sep 19, 2024
Medium max 7.5

ELSA-2024-12675 1 CVE

Moderate: openssl security update (Oracle Linux 9)

[3.0.7-28.0.1_fips] - Replace upstream references in fips man pages [Orabug: 35824276] - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35824276] - Update FIPS module name and remove upstream references from fips_module_indic…

Sep 19, 2024
Medium max 7.5

ELSA-2024-6783 1 CVE

Moderate: openssl security update (Oracle Linux 9)

[3.0.7-28.0.1] - Drop OpenELA branding, apply Oracle branding patches - Enable openssl-fips-provider dependency [Orabug: 36504822] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] - Replace upstream references [Orabug: 34340177] [1:3.0.…

Sep 19, 2024
Medium max 5.9

ELSA-2024-6785 4 CVEs

Moderate: ruby:3.3 security update (Oracle Linux 9)

ruby [3.3.5-3] - Upgrade to Ruby 3.3.5 Resolves: RHEL-57576 - Fix DoS vulnerability in rexml. (CVE-2024-39908) (CVE-2024-41946) (CVE-2024-43398) Resolves: RHEL-57573 Resolves: RHEL-57570 Resolves: RHEL-57578 - Fix REXML DoS when parsing an XML having many spe…

Sep 19, 2024
Medium max 7.4

ELSA-2024-6757 1 CVE

Moderate: libnbd security update (Oracle Linux 9)

[1.18.1-4.0.1] - Add new content to nbd_connect_uri.pod [1.18.1-4] - Fix CVE-2024-7383 NBD server improper certificate validation resolves: RHEL-52730

Sep 19, 2024
High max 5.5

ELSA-2024-6848 2 CVEs

Important: pcp security update (Oracle Linux 9)

[6.2.0-5.0.1] - Fixed libpcp derived metric issue for ol9 [Orabug: 36538820] [6.2.0-5] - Fix buffer sizing checks in pmstore PDU handling (RHEL-57805) - Guard against symlink attacks in pmpost program (RHEL-57810) - Fix libpcp_web webgroup slow request refcou…

Sep 19, 2024
High max 8.2

ELSA-2024-12674 4 CVEs

Important: qemu-kvm security update (Oracle Linux 9)

[7.2.0-15.el9] - migration: abort on destination if switchover limit exceeded (Elena Ufimtseva) - migration: introduce strict switchover SLA (Elena Ufimtseva) - migration: add error to MigrationIncomingState (Elena Ufimtseva) - migration: Set migration status…

Sep 19, 2024