Unbreakable Enterprise kernel security update

5.4.17-2136.347.6.2 - cloneprivatemnt: make sure that caller has CAPSYSADMIN in the right userns Al Viro Orabug: 38453918 CVE-2025-38499 - vsock: Do not allow binding to VMADDRPORTANY Budimir Markovic Orabug: 38453914 - HID: core: ensure the allocated report buffer can contain the reserved report...

ImageMagick security update

6.9.10.68-7.0.1 - Fix for CVE-2025-55154 Orabug: 38417011...

kernel security update

5.14.0-570.46.1.0.16.OL9 - nvme-pci: remove two deallocate zeroes quirks Orabug: 37756650 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys lis...

firefox security update

140.3.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 140.3.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 140.3.0-1 - Update to 140.3.0...

Unbreakable Enterprise kernel security update

5.15.0-312.187.5.3 - HID: core: do not bypass hidhwrawrequest Benjamin Tissoires Orabug: 38454666 CVE-2025-38494 - vsock: Do not allow binding to VMADDRPORTANY Budimir Markovic Orabug: 38454665 CVE-2025-38618 - cloneprivatemnt: make sure that caller has CAPSYSADMIN in the right userns Al Viro...

mysql security update

8.0.43-1 - Rebase to MySQL 8.0.43 8.0.42-1 - Rebase to MySQL 8.0.42...

kernel security update

4.18.0-553.76.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

firefox security update

128.14.0-2.0.1 - Update to 128.14.0 Orabug: 38400668CVE-2025-9179CVE-2025-9180 CVE-2025-9181CVE-2025-9182CVE-2025-9185...

gnutls security update

3.8.3-6.2fips - Add FIPS package change: add fips suffix to Release and set Epoch to 10 Orabug: 35925409 - Update FIPS module name for Oracle Linux Orabug: 35925409 3.8.3-6.2 - keyupdate: rework the rekeying logic RHEL-107498 3.8.3-6.1 - Fix CVE-2025-32988, CVE-2025-32989, CVE-2025-32990, and...

gnutls security, bug fix, and enhancement update

3.8.3-6.2 - keyupdate: rework the rekeying logic RHEL-107498 3.8.3-6.1 - Fix CVE-2025-32988, CVE-2025-32989, CVE-2025-32990, and CVE-2025-6395...

firefox security update

140.3.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 140.3.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 140.3.0-1 - Update to 140.3.0...

thunderbird security update

140.3.0-1.0.1 - Fix prefs for new nss Orabug: 37079813 - Add Oracle prefs 140.3.0 - Add OpenELA debranding 140.3.0-1 - Update to 140.3.0 ESR...

container-tools:rhel8 security update

aardvark-dns buildah cockpit-podman conmon containernetworking-plugins containers-common 1-82.0.1 - Updated removed references Orabug: 33473101 Alex Burmashev - Adjust registries.conf Nikita Gerasimov - remove references to RedHat registry Nikita Gerasimov 2:1-82 - update vendored components -...

mysql:8.4 security update

mecab mecab-ipadic mysql 8.4.6-1 - Rebase to 8.4.6 8.4.5-1 - Rebase to 8.4.5 rapidjson 1.1.0-19 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz1991688 1.1.0-18 - Remove gtest dependency and turn off tests Resolves: 1977656 1.1.0-17 - Rebuilt for RHEL 9 BETA on Apr 15th 2021...

kernel security update

3.10.0-1160.119.1.0.11.el7.OL7 - kernel: media: uvcvideo: Fix double free in error path CVE-2024-57980 - kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtphidremove CVE-2025-21928 - kernel: ext4: fix off-by-one error in dosplit CVE-2025-23150 - kernel: misc/vmwvmci: fix an infoleak in...

kernel security update

3.10.0-1160.119.1.0.11.el7.OL7 - kernel: media: uvcvideo: Fix double free in error path CVE-2024-57980 - kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtphidremove CVE-2025-21928 - kernel: ext4: fix off-by-one error in dosplit CVE-2025-23150 - kernel: misc/vmwvmci: fix an infoleak in...

glibc bug fix update

2.28-251.0.3.25 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi Oracle history: June-9-2025 Cupertino Miranda - 2.28-251.0.3.22 - Forward port of Oracle patches Reviewed-by: David Faust April-14-2025 Cupertino Miranda - 2.28-251.0.3.16 - Forward port of Oracle patches Reviewed-by:...

glibc bug fix update

2.34-168.0.1.23 - Forward-port Oracle patches for ol9-u6 Reviewed-by: Jose E. Marchesi Oracle history: June-30-2025 Cupertino Miranda - 2.34-168.0.1.20 - Forward-port Oracle patches for ol9-u6 Reviewed-by: Jose E. Marchesi June-9-2025 Cupertino Miranda - 2.34-168.0.1.19 - Forward-port Oracle...

podman security update

5.4.0-13.0.1 - Fix a potential deadlock during podman cp Orabug: 38252957 - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount Orabug: 36234694 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117404 5:5.4.0-13 - update to the...

glibc security update

2.17-326.0.11.3 - Back port fix for CVE-2025-4802 Orabug: 38144086 2.17-326.0.9.3 - Forward-port Oracle patches to 2.17-326.3 Reviewed-by: Jose E. Marchesi Oracle history: June-22-2023 Cupertino Miranda - 2.17-326.0.9 - OraBug 35517820 Reworked previous patch for OraBug 35318841 and removed free ...

python-cryptography security update

36.0.1-5 - Fix CVE-2023-49083: NULL-dereference when loading PKCS7 certificates, resolves RHEL-97450...

kernel security update

4.18.0-553.75.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

kernel security update

5.14.0-570.44.1.0.16.OL9 - nvme-pci: remove two deallocate zeroes quirks Orabug: 37756650 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys lis...

libarchive security update

3.1.2-14.0.1 - rar: Fix double free Orabug: 38364091CVE-2025-5914...

kernel security update

5.14.0-570.42.2.0.16.OL9 - nvme-pci: remove two deallocate zeroes quirks Orabug: 37756650 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys lis...

cups security update

1.2.3.3op2-33.1 - RHEL-113077 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ippreadio Leading to Remote DoS 1.2.3.3op2-33.1 - RHEL-112438 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling...

php:8.2 security update

libzip php 8.2.28-1 - rebase to 8.2.28 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip...

cups security update

1:2.2.6-63 - RHEL-112424 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling...

gdk-pixbuf2 security update

2.36.12-3.0.1 - jpeg: Be more careful with chunked icc data Orabug: 38359772CVE-2025-7345...

python3.12-cryptography security update

41.0.7-2.1 - Security fix for CVE-2024-26130 Resolves: RHEL-112483...

microcode_ctl security update

4:20250512-1.0.1 - enable use with ueknext and UEK8 kernels - don't bother calling dracut if virtualized Orabug: 35710077 - ensure UEK also rebuilds initramfs Orabug: 34280058 - add support for UEK7 kernels - enable early update for 06-4f-01 - remove no longer appropriate caveats for 06-2d-07 and...

kernel security update

5.14.0-570.41.1.0.16.OL9 - nvme-pci: remove two deallocate zeroes quirks Orabug: 37756650 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys lis...

Unbreakable Enterprise kernel security update

5.4.17-2136.347.6 - netsched: schsfq: move the limit validation Octavian Purdila Orabug: 38377926 CVE-2025-37752 - netsched: schsfq: use a temporary work area for validating configuration Octavian Purdila Orabug: 38377926 - netsched: schsfq: don't allow 1 packet limit Octavian Purdila Orabug:...

Unbreakable Enterprise kernel security update

5.4.17-2136.347.6.1 - x86/vmscape: Warn when STIBP is disabled with SMT Pawan Gupta Orabug: 38343661 - x86/bugs: Move cpubugssmtupdate down Pawan Gupta Orabug: 38343661 - x86/vmscape: Enable the mitigation Pawan Gupta Orabug: 38343661 - x86/vmscape: Add conditional IBPB mitigation Pawan Gupta...

Unbreakable Enterprise kernel security update

5.15.0-312.187.5.1 - x86/vmscape: Warn when STIBP is disabled with SMT Pawan Gupta Orabug: 38343660 - x86/bugs: Move cpubugssmtupdate down Pawan Gupta Orabug: 38343660 - x86/vmscape: Enable the mitigation Pawan Gupta Orabug: 38343660 - x86/vmscape: Add conditional IBPB mitigation Pawan Gupta...

kernel security update

4.18.0-553.74.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

Unbreakable Enterprise kernel security update

5.15.0-312.187.5 - Revert 'mm: hugetlb: independent PMD page table shared count' Harshit Mogalapalli Orabug: 38327655 5.15.0-312.187.4 - rds: Fix NULL ptr deref in xasstart Hakon Bugge Orabug: 38166374 - KVM: x86: use arrayindexnospec with indices that come from guest Thijs Raymakers Orabug:...

libxml2 security update

2.9.1-6.0.11.6 - Fix CVE-2025-32415: Fix heap buffer overflow Orabug: 38310750...

httpd:2.4 security update

httpd 2.4.37-65.5.0.1 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65.5 - Resolves: RHEL-99944 - CVE-2025-49812 httpd: HTTP Session Hijack via a TLS upgrade - Resolves: RHEL-99969 - CVE-2024-47252 httpd: insufficient escaping of user-supplied data in modssl - Resolves:...

postgresql:12 security update

pgaudit pgrepack postgres-decoderbufs postgresql 12.22-5 - Fix previous Backport 12.22-4 - Backport CVE-2025-8715...

pam security update

1.5.1-26.0.1 - pamlimits: fix use after free in pamsmopensession Orabug: 36406534 1.5.1-26 - pamnamespace: fix potential privilege escalation. Resolves: CVE-2025-6020 and RHEL-96729...

kernel security update

4.18.0-553.72.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

kernel security update

5.14.0-570.39.1.0.16.OL9 - nvme-pci: remove two deallocate zeroes quirks Orabug: 37756650 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys lis...

resource-agents security update

4.9.0-54.16 - bundled requests: fix CVE-2024-47081 Resolves: RHEL-104761 4.9.0-54.15 - ocf-shellfuncs/AWS agents: dont sleep after the final try in curlretry Resolves: RHEL-102731 4.9.0-54.13 - Filesystem: add support for aznfs Resolves: RHEL-91257 4.9.0-54.12 - tomcat: fix CATALINAPID not set, a...

python3.9 security update

3.9.21-2.2 - Security fix for CVE-2025-8194 Resolves: RHEL-106375...

python3.11 security update

3.11.11-2.2 - Security fix for CVE-2025-8194 Resolves: RHEL-106366...

python3.12 security update

3.12.9-1.2 - Security fix for CVE-2025-8194 Resolves: RHEL-106370...

pam security update

1.1.8-23.0.3 - pamnamespace: fix potential privilege escalation CVE-2025-6020 Orabug: 38156729...

postgresql:15 security update

pgaudit 1.7.0-1 - Update to 1.7.0 - Support postgresql 15 - Related: 2128241 pgrepack 1.4.8-1 - Update to version 1.4.8 - Postgresql 15 is supported - Related: 2128241 1.4.6-4 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz1991688 postgres-decoderbufs 1.9.7-1.Final - Iitial import...

udisks2 security update

2.9.4-11.0.1.1 - Enable btrfs support for OL supported arches Orabug: 37464632 2.9.4-11.1 - udiskslinuxmanager: Add lower bounds check to fdindex CVE-2025-8067 RHEL-109417 2.9.4-11 - udiskslinuxblockobject: Try issuing BLKRRPART ioctl harder - lvm2: Refactor udisksdaemonutillvm2wipeblock 2.9.4-10...