11088 matches found
python3.12-urllib3 security update
1.26.19-5 - CVE-2026-97689 Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282256 1.26.19-4 - CVE-2026-97687 Traffic interception via HTTPS proxy TLS configuration override Resolves: RHEL-282315...
bind security update
9.18.33-15.0.1.el102.14 - Hard require needed openssl-libs Orabug: 38742109 - Fix warning when changing device file permissions Orabug: 36518580 32:9.18.33-15.14 - Prevent arbitrary code execution via GSS-TSIG UDP message replay CVE-2026-94300 - Fix Denial of service via assertion failure in RPZ...
libXrender security update
0.9.10-16.2 - CVE-2026-88807 libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats in RenderQueryPictFormats Resolves: https://redhat.atlassian.net/browse/RHEL-267120...
tomcat security update
1:9.0.121-1 - Resolves: RHEL-255793 tomcat: Security constraint bypass due to improper access control CVE-2026-65182 - Resolves: Local information disclosure via Unix domain socket TOCTOU race condition CVE-2026-65183 - Resolves: RHEL-271822 tomcat: Improper Input Validation allows HTTP/2...
curl security update
7.76.1-40.el98.9 - fix incomplete mTLS config in connection reuse CVE-2026-8932...
curl security, bug fix, and enhancement update
7.61.1-34.el810.18 - fix incomplete mTLS config in connection reuse CVE-2026-8932 7.61.1-34.el810.17 - fix cookie injection via trailing dot super cookies CVE-2026-8924 - fix digest auth state leak on origin or credential change CVE-2026-11856 7.61.1-34.el810.16 - add sasl service name to...
kernel security, bug fix, and enhancement update
4.18.0-553.180.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...
expat security update
2.5.0-6 - CVE-2026-102633 expat: expat: Denial of Service via integer overflow in expatrealloc - Resolves: RHEL-272828 2.5.0-5 - CVE-2026-77214 expat: expat: Information disclosure via heap buffer over-read in XMLParseBuffer over-read in XMLParseBuffer - Resolves: RHEL-277497...
ignition security update
2.26.0-1.2 - Rebuild with updated golang 2.26.0-1.1 - Rebuild with updated golang - Resolves: RHEL-175424, RHEL-177307...
dogtag-pki security update
11.9.0-6.0.1.el102.1 - Treat Oracle Linux the same as RHEL when selecting the Tomcat app server version. 11.9.0-6.1 - Update jackson-core, jackson-databind and resteasy - Fix CVE-2026-89059: RESTEasy IIOImageProvider Unbounded Image Decode - Fix CVE-2026-89058: RESTEasy CorsFilter Reflects...
mod_auth_openidc:2.3 security update
cjose 0.6.1-6 - CVE-2026-53939 modauthopenidc:2.3/cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption Resolves: RHEL-287898 modauthopenidc 2.4.9.4-9 - Resolves: RHEL-248080 CVE-2026-54789 Denial of Service via malformed state cookie parsing...
php security update
5.4.16-48.0.1 - Backport fix for CVE-2026-109619 Orabug: 40200805...
libXi security update
1.7.10-8.1 - CVE fix for CVE-2026-93541, CVE-2026-93542, CVE-2026-93543 Resolves: RHEL-270061...
libXtst security update
1.2.3-16.1 - CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser read in RECORD reply parser Resolves: RHEL-271689...
libX11 security update
1.8.12-1.1 - CVE-2026-88806 libX11: libX11: Heap-based buffer overflow via malicious X server X server...
aspell security update
12:0.60.6.1-23 - Backport fix for CVE-2026-103658...
yggdrasil security update
0.4.9.2-4 - Rebuild yggdrasil against updated golang 0.4.9.2-3 - Rebuild yggdrasil against updated golang 0.4.9.2-2 - Rebuild yggdrasil against updated golang...
gcc-toolset-15-gcc security update
15.2.1-7.2 - fix CVE-2026-102010, PR libstdc++/127656 RHEL-272113...
libXtst security update
1.2.4-8.1 - CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser out-of-bounds read in RECORD reply parser Resolves: RHEL-271682...
thunderbird security update
140.17.0-1.0.1 - Add Oracle prefs file 140.17.0 - Add OpenELA debranding 140.17.0-1 - Update to 140.17.0 ESR...
cjose security update
0.6.1-17.1 - CVE-2026-53938 cjose: heap buffer overflow in AES key unwrap Resolves: RHEL-256972...
webkit2gtk3 security update
2.54.2-1 - Update to 2.54.2...
brotli security update
1.0.6-5 - Resolves: RHEL-290271 - CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder...
kernel security, bug fix, and enhancement update
5.14.0-687.61.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...
libXrender security update
0.9.10-8 - CVE-2026-88807 libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats in RenderQueryPictFormats...
brotli security update
1.1.0-8.0.1 - Fix out-of-bounds write in the Brotli decoder CVE-2026-111497...
buildah security update
1.43.4-2.0.1 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117178 2:1.43.4-2 - Rebuild for CVE-2026-78667 and CVE-2026-111943 - Resolves: RHEL-279009 - Resolves: RHEL-287507 2:1.43.4-1 - Update to buildah 1.43.4 c7061d00 - fix CVE-2026-56855 golang.org/x/crypto/ssh DoS a...
libreswan security update
4.12-2.0.1.el810.7 - Add libreswan-oracle.patch to detect Oracle Linux distro 4.12-7 - Backport fixes for CVE-2026-94453, CVE-2026-77206 and CVE-2026-77207 RHEL-281879, RHEL-282682, RHEL-282477 4.12-2.6 - Backport fix for CVE-2026-14957 RHEL-212498 4.12-2.5 - Backport fixes for CVE-2026-12413,...
libXi security update
1.8.1-7.1 - CVE fix for CVE-2026-93541, CVE-2026-93542, CVE-2026-93543 Resolves: RHEL-270054...
libX11 security update
1.8.10-1.1 - CVE-2026-88806 libX11: libX11: Heap-based buffer overflow via malicious X server X server Resolves: https://issues.redhat.com/browse/RHEL-267123...
libXi security update
1.7.10-2 - CVE fix for CVE-2026-93541, CVE-2026-93542, CVE-2026-93543 Resolves: RHEL-270049...
libXtst security update
1.2.3-8 - CVE-2026-94286 libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser in RECORD reply parser...
emacs security update
1:26.1-15.4 - Add missing untrusted-content variable definition fixes CVE-2026-96442 - Related: RHEL-265099 1:26.1-15.3 - Generalize trusted-content-p check to all Flymake backends CVE-2026-96442 - Resolves: RHEL-265099...
emacs security update
1:29.4-17 - Fix arbitrary code execution upon opening file CVE-2026-96269 1:29.4-16 - Generalize trusted-content-p check to all Flymake backends CVE-2026-96442 1:29.4-15 - tramp: restrict user name to prevent shell injection CVE-2026-79992...
python-urllib3 security update
1.24.2-11 - CVE-2026-97689 python-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser memory allocation in chunk parser Resolves: RHEL-282251...
flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update
flute 1.3.0-19.OOo31 - OpenJDK 8 won't be supported anymore on RHEL 8 starting from November 2026, move to OpenJDK 21 - Resolves: RHEL-275416 libbase 1.1.3-21 - Remove commons logging dependency - Related: RHEL-286491 1.1.3-20 - OpenJDK 8 won't be supported anymore on RHEL 8 starting from Novembe...
thunderbird security, bug fix, and enhancement update
153.5.0-1.0.1 - Add Oracle prefs 153.5.0-1 - Update to 153.5.0 ESR 140.14.0-2 - Update to 140.14.0 ESR 140.13.0-1 - Update to 140.13.0 ESR 140.12.0-1 - Update to 140.12.0 ESR 140.11.0-1 - Update to 140.11.0 ESR 140.10.1-1 - Update to 140.10.1 ESR 140.10.0-1 - Update to 140.10.0 ESR 140.9.1-1 -...
podman security update
5.8.2-8.0.1 - Rework CNI/Netavark detection logic JIRA: EVG-3769 - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117404 6:5.8.2-8 - Rebuild for CVE-2026-78667 and CVE-2026-111943 - Resolves: RHEL-2790...
libXrender security update
0.9.11-8.1 - CVE-2026-88807 libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats overflow in RenderQueryPictFormats Resolves: RHEL-267112...
container-tools:ol8 security, bug fix, and enhancement update
aardvark-dns 2:1.10.1-2 - build off the RHEL maintenance branch - Resolves: RHEL-59129 buildah 2:1.33.15-2 - Rebuild for CVE-2026-78667 and CVE-2026-111943 - Resolves: RHEL-278949 RHEL-287628 RHEL-272014 2:1.33.15-1 - fix Version to match the upstream release-1.33 branch content - Resolves:...
nodejs:24 security update
nodejs 1:24.21.0-1.0.1 - Fix out-of-bounds write in bundled Brotli decoder CVE-2026-111497 - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging...
brotli security update
1.0.6-4.0.1 - Fix CVE-2026-111497: reject invalid Brotli block switches...
nodejs:22 security update
nodejs 1:22.23.2-2.0.1 - Fix out-of-bounds write in bundled Brotli decoder CVE-2026-111497 - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging...
bind security update
9.16.23-40.0.1.el98.12 - Fix warning when changing device file permissions Orabug: 36518580 32:9.16.23-40.12 - Fix CVE-2026-19662: NOQNAME proof use-after-free could crash recursive resolver. 32:9.16.23-40.11 - Backport 'Do not use headerprev in expirelruheaders' from upstream. RHEL-276913...
xorg-x11-server security update
1.20.11-28.5 - CVE fix for: CVE-2026-88812, CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93523 Resolves: https://redhat.atlassian.net/browse/RHEL-278163 Resolves: https://redhat.atlassian.net/browse/RHEL-282168 Resolves:...
python3.9 security update
3.9.25-7.0.1.el98.6 - Remove upstream URL reference 3.9.25-7.6 - CVE-2026-19553 python3.9: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio Resolves: RHEL-274143 3.9.25-7.5 - CVE-2026-19445 python3.9: Use-after-free of a server-side SSLContext wh...
libX11 security update
1.6.8-10 - CVE-2026-88806 libX11: libX11: Heap-based buffer overflow via malicious X server Resolves: https://issues.redhat.com/browse/RHEL-267125...
xdg-dbus-proxy security update
0.1.3-1.1 - Message filtering bypass via reply serial allows sandbox escape CVE-2026-94422 Resolves: RHEL-271548...
firefox security, bug fix, and enhancement update
153.5.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 153.5.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 153.5.0-1 - Update to 153.5.0 ESR 140.15.0-1...