Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,316 results · Feed

  • Medium max 9.1
    ELSA-2024-5312 2 CVEs

    Moderate: krb5 security update (Oracle Linux 8)

    [1.18.2-29.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767] [1.18.2-29] - CVE-2024-37370 CVE-2024-37371 Fix vulnerabilities in GSS message token handling Resolves: RHEL-45398 RHEL-45386

  • Medium max 6.5
    ELSA-2024-5337 1 CVE

    Moderate: .NET 8.0 security update (Oracle Linux 8)

    [8.0.108-1.0.1] - Add support for Oracle Linux [8.0.108-1] - Update to .NET SDK 8.0.108 and Runtime 8.0.8 - Resolves: RHEL-52388

  • Medium max 7.5
    ELSA-2024-5294 2 CVEs

    Moderate: jose security update (Oracle Linux 8)

    [10-2.3] - Backport fix for CVE-2024-28176 Resolves: RHEL-28719 [10-2.2] - Fix tests on s390x Related: RHEL-29857 [10-2.1] - Fixes CVE-2023-50967

  • High max 8.3
    ELSA-2024-5258 8 CVEs

    Important: container-tools:ol8 security update (Oracle Linux 8)

    aardvark-dns buildah [2:1.33.8-4] - rebuild for golang fixes - Related: RHEL-28452 cockpit-podman [84.1-1] - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/84.1 - Related: Jira:RHEL-25557 conmon [3:2.1.10-1] - update to https://githu…

  • Medium max 9.8
    ELSA-2024-5291 3 CVEs

    Moderate: grafana security update (Oracle Linux 8)

    [9.2.10-17] - Allow for mssql datasource in selinux policy - Resolves RHEL-43435

  • High max 8.8
    ELSA-2024-5279 1 CVE

    Important: python3.11-setuptools security update (Oracle Linux 9)

    [65.5.1-2.1] - Security fix for CVE-2024-6345 Resolves: RHEL-50490

  • Medium max 6.5
    ELSA-2024-5334 1 CVE

    Moderate: .NET 8.0 security update (Oracle Linux 9)

    [8.0.108-1.0.1] - Add support for Oracle Linux [8.0.108-1] - Update to .NET SDK 8.0.108 and Runtime 8.0.8 - Resolves: RHEL-52389 [8.0.107-2] - Fix ownership of some missed directories - Resolves: RHEL-47080

  • High max 7.5
    ELSA-2024-5231 3 CVEs

    Important: bind and bind-dyndb-ldap security update (Oracle Linux 9)

    bind [9.16.23-18.0.1.6] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-18.6] - Minor fix of reclimit test backport (CVE-2024-1737) [32:9.16.23-18.5] - Backport addition of max-records-per-type and max-records-per-type optio…

  • High max 9.8
    ELSA-2024-5322 11 CVEs

    Important: firefox security update (Oracle Linux 9)

    [115.14.0-2.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [115.14.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [115.14.0-2] - Update to 115.14.0 build2 [115.14.0-1] - Update …

  • High max 8.8
    ELSA-2024-12583 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.14.35-2047.539.5] - Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again' (Jan Kara) - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36879158] {CVE-2024-41090} {CVE-2024-41091} [4.14.35-2047.539.4] - Fix parsin…

  • High max 10.0
    ELSA-2024-12585 52 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [5.4.17-2136.334.6.el7] - loop: Fix a race between loop detach and loop open (Gulam Mohamed) [Orabug: 36197800] - x86/bhi: Do not enable unnecessary BHI mitigation in OCI and Exadata VMs (Alexandre Chartre) [Orabug: 36672495] - x86/bhi: Avoid warning in #DB h…

  • High max 10.0
    ELSA-2024-12581 52 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.334.6] - loop: Fix a race between loop detach and loop open (Gulam Mohamed) [Orabug: 36197800] - x86/bhi: Do not enable unnecessary BHI mitigation in OCI and Exadata VMs (Alexandre Chartre) [Orabug: 36672495] - x86/bhi: Avoid warning in #DB handl…

  • High max 10.0
    ELSA-2024-12584 52 CVEs 1 exploited

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

    [5.4.17-2136.334.6.el8] - loop: Fix a race between loop detach and loop open (Gulam Mohamed) [Orabug: 36197800] - x86/bhi: Do not enable unnecessary BHI mitigation in OCI and Exadata VMs (Alexandre Chartre) [Orabug: 36672495] - x86/bhi: Avoid warning in #DB h…

  • High max 8.8
    ELSA-2024-12582 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-209.161.7] - loop: Fix a race between loop detach and loop open (Gulam Mohamed) [Orabug: 36865975] [5.15.0-209.161.6] - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36879156] {CVE-2024-41090} {CVE-2024-41091} - x86/bhi: Do not en…

  • Medium max 6.5
    ELSA-2024-5192 2 CVEs

    Moderate: 389-ds-base security update (Oracle Linux 9)

    [2.4.5-9] - Bump version to 2.4.5-9 - Resolves: RHEL-44323 - unauthenticated user can trigger a DoS by sending a specific extended search request - Resolves: RHEL-40945 - Malformed userPassword hash may cause Denial of Service - Resolves: RHEL-49457 - perf se…

  • Medium max 7.5
    ELSA-2024-12579 1 CVE

    Moderate: linux-firmware security update (Oracle Linux 7)

    [20240715-999.34.git4c8fb21e.el7] - Rebase to latest upstream [Orabug: 36826157]

  • Medium max 7.5
    ELSA-2024-12580 1 CVE

    Moderate: linux-firmware security update (Oracle Linux 8)

    [20240715-999.34.git4c8fb21e.el8] - Rebase to latest upstream [Orabug: 36826157]

  • High max 9.8
    ELSA-2024-5101 160 CVEs 1 exploited

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.16.1_10.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.ge…

  • Medium max 7.5
    ELSA-2024-12578 1 CVE

    Moderate: linux-firmware security update (Oracle Linux 9)

    [20240715-999.34.git4c8fb21e.el9] - Rebase to latest upstream [Orabug: 36826157]

  • High max 9.8
    ELSA-2024-5138 1 CVE

    Important: httpd security update (Oracle Linux 9)

    [2.4.57-11.0.1.el9_4.1] - Replace index.html with Oracle's index page oracle_index.html. [2.4.57-11.1] - Resolves: RHEL-46047 - httpd: Security issues via backend applications whose response headers are malicious or exploitable (CVE-2024-38476) - Resolves: RH…

  • Medium max 7.5
    ELSA-2024-5079 4 CVEs

    Moderate: libtiff security update (Oracle Linux 8)

    [4.0.9-32] - Fix CVE-2023-6228 CVE-2023-52356 CVE-2023-25433 CVE-2018-15209 - Resolves: RHEL-30682 RHEL-30520 RHEL-30474 RHEL-5406

  • Medium max 6.0
    ELSA-2024-12574 1 CVE

    Moderate: qemu-kvm security update (Oracle Linux 9)

    [7.2.0-13.el9] - vfio/migration: Enhance VFIO migration state tracing (Avihai Horon) - vfio/migration: Don't emit STOP_COPY VFIO migration QAPI event twice (Avihai Horon) - vfio/migration: Emit VFIO migration QAPI event (Avihai Horon) - qapi/vfio: Add VFIO mi…

  • High max 8.8
    ELSA-2024-12571 13 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.88.3] - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin) [Orabug: 36806710] {CVE-2023-52813} - usbnet: sanity check for maxpacket (Oliver Neukum) [Orabug: 36806658] {CVE-2021-47495} - phonet: fix rtm_phonet_notify() skb allocation (Eric …

  • High max 9.0
    ELSA-2024-4936 1 CVE

    Important: freeradius:3.0 security update (Oracle Linux 8)

    [3.0.20-15] - Backport BlastRADIUS CVE fix Resolves: RHEL-46572

  • High max 9.0
    ELSA-2024-4935 1 CVE

    Important: freeradius security update (Oracle Linux 9)

    [3.0.21-40] - Backport fixes for BlastRADIUS CVE Resolves: RHEL-46566

  • Medium max 8.1
    ELSA-2024-4928 17 CVEs

    Moderate: kernel security update (Oracle Linux 9)

    - [5.14.0-427.28.1_4.OL9] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_ke…

  • Medium max 6.5
    ELSA-2024-4861 2 CVEs

    Moderate: squid security update (Oracle Linux 9)

    [7:5.5-13] - Resolves: RHEL-45056 - squid: Out-of-bounds write error may lead to Denial of Service (CVE-2024-37894) - Resolves: RHEL-45643 - squid: vulnerable to a Denial of Service attack against Cache Manager error responses (CVE-2024-23638)

  • Medium max 7.0
    ELSA-2024-4749 3 CVEs

    Moderate: edk2 security update (Oracle Linux 9)

    [20231122-6.0.1.el9_4.2] - Replace upstream references [Orabug:36569119] [20231122-6.el9_4.2] - edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch [RHEL-40270 RHEL-40272] - edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch [RHEL-40270 RHEL-40272] - …

  • High max 7.5
    ELSA-2024-4761 1 CVE

    Important: containernetworking-plugins security update (Oracle Linux 9)

    [1:1.4.0-4] - rebuild for CVE-2024-1394 - Resolves: RHEL-40809

  • High max 8.8
    ELSA-2024-12549 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.1.12-124.87.2.2] - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36660755]

  • High max 8.8
    ELSA-2024-12548 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [4.14.35-2047.538.5.1] - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36660755]

  • High max 8.8
    ELSA-2024-12551 2 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

    [5.4.17-2136.333.5.1.el7] - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36660755] - pci: add hotplug patch support for SOLIDIGM Aura10 AIC 0x025e:0x0b60 (Alan Adamson) [Orabug: 36836653]

  • High max 9.1
    ELSA-2024-4720 5 CVEs 1 exploited

    Important: httpd:2.4 security update (Oracle Linux 8)

    httpd [2.4.37-65.0.1.1] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-65.1] - Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue in mod_rewrite (CVE-2024-38474) - Resolves: RHEL-45785 - httpd:2.4/httpd: Encoding prob…

  • High max 8.8
    ELSA-2024-12547 2 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.333.5.1] - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36660755] - pci: add hotplug patch support for SOLIDIGM Aura10 AIC 0x025e:0x0b60 (Alan Adamson) [Orabug: 36836653]

  • High max 8.8
    ELSA-2024-12552 2 CVEs

    Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

    [5.4.17-2136.333.5.1.el8] - net/mlx5e: drop shorter ethernet frames (Manjunath Patil) [Orabug: 36660755] - pci: add hotplug patch support for SOLIDIGM Aura10 AIC 0x025e:0x0b60 (Alan Adamson) [Orabug: 36836653]

  • Low max 7.5
    ELSA-2024-4766 1 CVE

    Low: python3 security update (Oracle Linux 9)

    [3.11.7-1.3] - Security fix for CVE-2024-4032 Resolves: RHEL-44097 [3.11.7-1.2] - Enable importing of hash-based .pyc files under FIPS mode Resolves: RHEL-40785

  • Low max 7.5
    ELSA-2024-4779 1 CVE

    Low: python3 security update (Oracle Linux 9)

    [3.9.18-3.3] - Security fix for CVE-2024-4032 Resolves: RHEL-44106 [3.9.18-3.2] - Enable importing of hash-based .pyc files under FIPS mode Resolves: RHEL-40767

  • High max 9.1
    ELSA-2024-4726 5 CVEs 1 exploited

    Important: httpd security update (Oracle Linux 9)

    [2.4.57-11.0.1] - Replace index.html with Oracle's index page oracle_index.html. [2.4.57-11] - Resolves: RHEL-45792 - httpd: Encoding problem in mod_proxy (CVE-2024-38473) [2.4.57-9] - Resolves: RHEL-45766 - httpd: null pointer dereference in mod_proxy (CVE-2…

  • Medium max 6.5
    ELSA-2024-4755 1 CVE

    Moderate: libreoffice security update (Oracle Linux 9)

    [7.1.8.1-13.0.1] - Replace colors with Oracle colors [Orabug: 32120093] - Added the --with-hamcrest option to configure. [1:7.1.8.1-13] - Fix CVE-2024-3044 add notify for script use

  • Medium max 6.2
    ELSA-2024-4757 1 CVE

    Moderate: libvirt security update (Oracle Linux 9)

    [10.0.0-6.6.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] [10.0.0-6.6.el9_4] - vmx: Do not require DVS Port ID (RHEL-45520) - vmx: Do not require all ID data for VMWare Distributed Switch (RHEL-46595) [10.0.0-6.5.el9_4] - qemu: Fix migration …