openssh security update

9.9p1-11.0.1 - Upstream references found with /usr/bin/ssh Orabug: 37824421 9.9p1-11 - Move the redhat help message to debug1 log level Resolves: RHEL-93957 9.9p1-10 - Support for authentication indicators in OpenSSH Resolves: RHEL-40790 9.9p1-9 - CVE-2025-32728: Fix logic error in...

pam security update

1.6.1-8 - pamnamespace: fix potential privilege escalation. Resolves: CVE-2025-6020 and RHEL-101174...

libsoup security update

2.72.0-12.1 - Backport patch for CVE-2025-4945 and CVE-2025-11021 2.72.0-12 - Backport patches for various CVEs Resolves: RHEL-84797 Resolves: RHEL-85888 Resolves: RHEL-87080 Resolves: RHEL-92284 2.72.0-11 - Backport patches for various CVEs, plus test improvements Resolves: RHEL-85909 Resolves:...

binutils security update

2.41-58.0.1 - Forward-port Oracle patches to 2.41-58. - Reviewed-by: Jose E. Marchesi Oracle history: August-29-2025 Bruce McCulloch - 2.41-57.0.1 - Forward-port Oracle patches to 2.41-57. Reviewed-by: Jose E. Marchesi Jun-04-2025 Bruce McCulloch - 2.41-53.0.3 - Add binutils-orabug-38018827.patch...

bind security update

32:9.16.23-34.0.1.1 - Fix warning when changing device file permissions Orabug: 36518580 32:9.16.23-34.1 - Prevent cache poisoning due to weak PRNG CVE-2025-40780 - Replace downstream fixes with upstream changes - Address various spoofing attacks CVE-2025-40778 32:9.16.23-34 - Fix failures in idn...

xorg-x11-server-Xwayland security update

23.2.7-5 - CVE fix for: CVE-2025-62229 RHEL-119974, CVE-2025-62230 RHEL-120021, CVE-2025-62231 RHEL-125017...

tigervnc security update

1.15.0-6 - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation Resolves: RHEL-119986 - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal Resolves: RHEL-120007 - Fix CVE-2025-62231: xorg-x11-server: Value overflow in Xkb...

delve and golang security update

delve 1.25.2-1.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.25.2-1 - Update to Delve 1.25.2 - Resolves: RHEL-111801 golang 1.25.3-1 - Update to Go 1.25.3 - Resolves: RHEL-121220 1.25.1-1 - Update to Go 1.25.1 - Resolves: RHEL-116850 1.25.0-2 - Revert DWARF5 defaults - Add elf...

xorg-x11-server security update

1.20.11-32 - CVE fix for: CVE-2025-62229 RHEL-119960, CVE-2025-62230 RHEL-120033, CVE-2025-62231 RHEL-125002...

kernel security update

5.14.0-611.8.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 248176...

redis security update

6.2.20-2 - rebase to 6.2.20 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 6.2.19-2 - fix ownership of /usr/lib64/redis RHEL-6784 6.2.19-1 - rebase to 6.2.19 for CVE-2025-32023 and CVE-2025-48367 6.2.18-1 - rebase to 6.2.18 for CVE-2025-21605 6.2.17-1 - rebase to 6.2.17 for...

valkey security update

8.0.6-2 - rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819...

vim security update

8.2.2637-23.0.1 - Remove upstream references Orabug: 31197557 2:8.2.2637-23 - RHEL-112005 CVE-2025-53905 vim: Vim path traversial - RHEL-112009 CVE-2025-53906 vim: Vim path traversal...

python-kdcproxy security update

1.0.0-9 - Use DNS discovery for declared realms only CVE-2025-59088 Resolves: RHEL-122779 - Fix DoS vulnerability based on unbounded TCP buffering CVE-2025-59089 Resolves: RHEL-122778...

podman security update

5.6.0-7.0.1 - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount Orabug: 36234694 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117404 6:5.6.0-7 - update to the latest content of...

openssl security update

3.5.1-4.0.1 - Enable openssl-fips-provider dependency Orabug: 36504822 - Temporary disable openssl-fips-provider dependency Orabug: 36504822 - Replace upstream references Orabug: 34340177 3.5.1.openela.0.1 - Add OpenELA specific changes 1:3.5.1-4 - Fix CVE-2025-9230 Resolves: RHEL-115929...

openssl security update

3.5.1-4.0.2fips - Update additional upstream references 3.5.1-4.0.1fips - Add FIPS package change: add fips suffix to Release and set Epoch to 10 Orabug: 35824276 - Update FIPS module name Orabug: 35824276 3.5.1-4.0.1 - Enable openssl-fips-provider dependency Orabug: 36504822 - Temporary disable...

cups security update

1:2.2.6-64 - RHEL-122666 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ippreadio Leading to Remote DoS...

lasso security update

2.7.0-11.3 - Fix CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso Resolves: RHEL-126684...

libssh security update

0.10.4-15 - Bump spec to make the 9.7 NVR higher than the 9.6 one 0.10.4-14 - Fix CVE-2025-5318 Resolves: RHEL-111732...

ipa security update

4.12.2-22.0.1.1 - Set IPAPLATFORM=rhel when build on Oracle Linux Orabug: 29516674 - Add bind to ipa-server-common Requires Orabug: 36518596 4.12.2-22.1 - Resolves: RHEL-118449 ipa: Privilege escalation from host to domain admin in FreeIPA 4.12.2-22 - Resolves: RHEL-107483 ipa-ca-install fails on...

podman security update

5.6.0-6.0.1 - Add devices on container startup, not on creation - overlay: Put should ignore ENINVAL for Unmount Orabug: 36234694 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117404 6:5.6.0-6 - update to the latest content of...

kernel security update

5.14.0-611.9.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 248176...

libtiff security update

4.4.0-15.2 - fix CVE-2025-8176: tiffdither and tiffmedian skip first line of input images RHEL-120239 4.4.0-15.1 - fix CVE-2025-9900: buffer underflow crash in TIFFReadRGBAImageOriented RHEL-112545...

kernel security update

6.12.0-124.8.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

haproxy security update

2.8.14-1.1 - Fix denial of service vulnerability in mjson library CVE-2025-11230 Resolves: RHEL-126664...

go-rpm-macros security update

3.6.0-12 - Rebuilt to include Go1.25.3 to address CVE-2025-47906 - Resolves: RHEL-125569...

sssd security update

2.9.7-4.0.1.1 - Restore default debug level for ssscache Orabug: 32810448 Fri Oct 17 2025 Tomas Halman [email protected] - 2.9.7.4.1 - Resolves: RHEL-120298 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems...

firefox security update

140.5.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 140.5.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 140.5.0-1 - Update to 140.5.0 ESR...

webkit2gtk3 security update

2.50.1-1 - Update to 2.50.1 2.50.0-1 - Update to 2.50.0 2.48.5-1 - Update to 2.48.5 2.48.3-1 - Update to 2.48.3 2.48.2-1 - Update to 2.48.2 - Reenable JIT 2.48.1-1 - Update to 2.48.1 2.48.0-1 - Update to 2.48.0 2.46.6-1 - Update to 2.46.6 2.46.5-1 - Update to 2.46.5 2.46.4-1 - Update to 2.46.4...

shadow-utils security update

2:4.15.0-8 - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-93172...

sqlite security update

3.34.1-9 - Fixes CVE-2025-6965...

gimp security update

2:3.0.4-1.1 - fix CVE-2025-10920 - fix CVE-2025-10921 - fix CVE-2025-10922 - fix CVE-2025-10923 - fix CVE-2025-10924 - fix CVE-2025-10925 - fix CVE-2025-10934...

runc security update

4:1.3.0-4 - rename errors.go to errorslinux.go - Related: RHEL-122400 4:1.3.0-3 - Add relevant patches to CVEs - Resolves: RHEL-122400 4:1.3.0-2 - fix CVE-2025-31133 CVE-2025-52565 CVE-2025-52881 - Resolves: RHEL-122400 - Resolves: RHEL-122403 - Resolves: RHEL-122414...

mingw-expat security update

2.5.0-1 - Rebase to version 2.5.0 - Fix the following CVEs CVE-2023-52425 CVE-2024-28757 CVE-2024-45490 CVE-2024-45491 CVE-2024-45492 CVE-2024-50602 CVE-2024-8176 CVE-2025-59375 - Resolves: RHEL-114628...

pcs security update

0.11.10-1.el97.1 - Fixed CVE-2025-59830, CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919 by updating bundled rubygem rack Resolves: RHEL-120945, RHEL-121035, RHEL-123630, RHEL-123642, RHEL-124938 0.11.10-1 - Rebased pcs to the latest sources see CHANGELOG.md Resolves: RHEL-77194,...

squid security update

7:5.5-22.1 - Resolves: RHEL-122492 - squid: Squid vulnerable to information disclosure via authentication credential leakage in error handling CVE-2025-62168 7:5.5-22 - Resolves: RHEL-77084 - squid crashes with noteDestinationsEnd check failed...

libssh security update

0.9.6-16 - Fix CVE-2025-5372 Resolves: RHEL-121232...

kernel security update

4.18.0-553.85.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

glibc security update

2.39-58.0.1 - Forward port Oracle changes to 2.39-58. - Reviewed-by: Jose E. Marchesi Oracle history: August-29-2025 Cupertino Miranda - 2.39-54.0.1 - Forward port Oracle changes. Reviewed-by: Jose E. Marchesi August-7-2025 Cupertino Miranda - 2.39-46.0.1 - Forward port Oracle changes. Reviewed-b...

expat security update

2.5.0-1 - Rebase to version 2.5.0 - Fix CVE-2025-59375 - Resolves: RHEL-114618...

thunderbird security update

140.5.0-2.0.1 - Fix prefs for new nss Orabug: 37079820 - Add Oracle prefs file 140.5.0 - Add OpenELA debranding 140.5.0-2 - Update to 140.5.0 ESR...

lasso security update

2.6.0-14 - Fixing CVE-2025-47151 Resolves: RHEL-126687 CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso...

postgresql security update

9.2.24-9.0.7 - Restrict psql meta-commands in plain-text dumps Orabug: 38442031CVE-2025-8714 9.2.24-9.0.5 - Resolves CVE-2025-1094: Improper neutralization of quoting syntax in certain - libpq functions Orabug: 37843176...

squid security update

7:3.5.20-17.0.9.13 - Fixes CVE-2025-62168, squid: Squid vulnerable to information disclosure via - authentication credential leakage in error handling Orabug: 38587551 7:3.5.20-17.0.7.13 - Fixes CVE-2025-54574, add URN access disabling config options Orabug: 38350105 7:3.5.20-17.0.5.13 - Fixed cv...

kernel security update

4.18.0-553.84.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

grub2 security update

2.06-114.0.1 - Update grub2 dependencies to match new Secure Boot certificate chain of trust Orabug: 37766761 - Fix typo in SBAT metadata Orabug: 37693946 - Allow installation of grub2 only with shim-aa64 that allows booting it Orabug: 37693946 - net/dns: Fix removal of DNS server Orabug: 3753962...

shadow-utils security update

2:4.9-15 - nss.c: shadowlogfd to stderr. Resolves: RHEL-83431 - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-70844 and RHEL-72940...

zziplib security update

0.13.71-12 - Fix a directory traversal issue in unzip-mem Resolves: RHEL-6266...

container-tools:ol8 security update

slirp4netns 1.2.3-1 - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.3 - Related: Jira:RHEL-2110 1.2.2-1 - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.2 - Related: Jira:RHEL-2110 1.2.1-1 - update to...