Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security advisories
We found 128 articles for you...
217
security advisoryimportantkernelOracle Linux 7 Kernel Important Security Update ELSA-2026-50142
The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network:. Oracle Linux Security Advisory ELSA-2026-50142 http://linux.oracle.com/errata/ELSA-2026-50142.html The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network: x86_64: kernel-uek-5.4.17-2136.353.3.el7uek.x86_64.rpm kernel-uek-container-5.4.17-2136.353.3.el7uek.x86_64.rpm kernel-uek-container-debug-5.4.17-2136.353.3.el7uek.x86_64.rpm kernel-uek-debug-5.4.17-2136.353.3.el7uek.x86_64.rpm kernel-uek-debug-devel-5.4.17-2136.353.3.el7uek.x86_64.rpm kernel-uek-devel-5.4.17-2136.353.3.el7uek.x86_64.rpm kernel-uek-doc-5.4.17-2136.353.3.el7uek.noarch.rpm kernel-uek-tools-5.4.17-2136.353.3.el7uek.x86_64.rpm SRPMS: http://oss.oracle.com/ol7/SRPMS-updates/kernel-uek-5.4.17-2136.353.3.el7uek.src.rpm Related CVEs: CVE-2025-40215 Description of changes: [5.4.17-2136.353.3] - xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca) [Orabug: 38934000] - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca) [Orabug: 38934000] - Revert "xfrm: destroy xfrm_state synchronously on net exit path" (Sabrina Dubroca) [Orabug: 38934000] - Revert "IB/mlx5: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923520] - Revert "IB/core: Implement clear counters" (Sharath Srinivasan) [Orabug: 38923520] - Revert "ib/core: add SET_DEVICE_OP call for clear_hw_stats()" (Sharath Srinivasan) [Orabug: 38923520] - fs: proc: inode: delay put_pid() by RCU (Stephen Brennan) [Orabug: 38766812] [5.4.17-2136.353.2] - Revert "perf/x86: Always store regs-> ip in perf_callchain_kernel()" (Jiri Olsa) [Orabug: 38893604] - xfrm: delete x-> tunnel as we delete x (Sabrina Dubroca) [Orabug: 38730493] {CVE-2025-40215} [5.4.17-2136.352.5] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38879907] {CVE-2025-40022} [5.4.17-2136.352.4] - arm64: pensando: Must boot Ortano kernel with spin-table (Rob Gardner) [Orabug: 38821197] [5.4.17-2136.352.3] - net/sched: adjust device watchdog timer to detect stopped queue at right time (Praveen Kumar Kannoju) [Orabug: 38340278] - net/mlx5: Mark the mellanox graceful_period fix as out-of-tree change (Praveen Kumar Kannoju) [Orabug: 38252416] - infiniband/xsigo: Replace BUG_ON with WARN_ON_ONCE. (Siddh Raman Pant) [Orabug: 38418469] - infiniband/xsigo: xsvnic_main: Remove unused functions (Siddh Raman Pant) [Orabug: 38418469] - infiniband/xsigo: xve_cm: Fix mixed code warning (Siddh Raman Pant) [Orabug: 38418469] - infiniband/xsigo: xve_ethtool: Remove unused variable 'priv' (Siddh Raman Pant) [Orabug: 38418469] - infiniband/xsigo: xve_ib: Fix misleading indentation (Siddh Raman Pant) [Orabug: 38418469] - infiniband/xsigo: xve_ib: Fix mixed code warning (Siddh Raman Pant) [Orabug: 38418469] - infiniband/xsigo: xve_verbs: Remove unused label 'out_free_pd' (Siddh Raman Pant) [Orabug: 38418469] - infiniband/xsigo: xve_main: Remove unused function 'xve_napi_del' (Siddh Raman Pant) [Orabug: 38418469] - infiniband/xsigo: xve_main: Fix mixed code warning (Siddh Raman Pant) [Orabug: 38418469] - infiniband/xsigo: xve_main: Fix misleading indentation (Siddh Raman Pant) [Orabug: 38418469] - inifinibad/xsigo: xsvnic_main: Remove unused variable 'xsvnic_ethtool_ops' (Siddh Raman Pant) [Orabug: 38418469] - infiniband/xsigo: xscore_impl: Remove unused label 'err_pd' (Siddh Raman Pant) [Orabug: 38418469] - rds: Fix jiffies type in struct rds_conn_path (Siddh Raman Pant) [Orabug: 38418727] - kernel: sysctl: Remove unused variable 'zero' (Siddh Raman Pant) [Orabug: 38418727] - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537469] {CVE-2025-39964} - RDMA/cm: Base cm_id destruction timeout on CMA values (Håkon Bugge) [Orabug: 38753622] - x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756954] [5.4.17-2136.352.2] - LTS tag: v5.4.302 (Sherry Yang) - Input: pegasus-notetaker - fix potential out-of-boundsaccess (Seungjin Bae) - Input: remove third argument of usb_maxpacket() (Vincent Mailhol) - usb: deprecate the third argument of usb_maxpacket() (Vincent Mailhol) - fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38737034,38786776,38787139] {CVE-2025-40271} - pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin) - pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla) - net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao) [Orabug: 38773510] {CVE-2025-68245} - net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor) - net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon) - ALSA: usb-audio: fix uac2 clock source at terminal parser (René Rebe) - mm/page_alloc: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres) - kconfig/nconf: Initialize the default locale at startup (Jakub Horký) - kconfig/mconf: Initialize the default locale at startup (Jakub Horký) - vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730612] {CVE-2025-40248} - s390/ctcm: Fix double-kfree (Aleksei Nikiforov) - net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730650] {CVE-2025-40254} - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan) - MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki) - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773441] {CVE-2025-68229} - scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730664] {CVE-2025-40259} - Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730681] {CVE-2025-40263} - be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730691] {CVE-2025-40264} - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal) [Orabug: 38798908] {CVE-2025-68734} - EDAC/altera: Use INTTESTregister for Ethernet and USB SBE injection (Niravkumar L Rabara) - EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara) - spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede) - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang) [Orabug: 38773496] {CVE-2025-68241} - strparser: Fix signed/unsigned mismatch bug (Nate Karstens) - gcov: add support for GCC 15 (Peter Oberparleiter) - mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs) - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee) [Orabug: 38737052] {CVE-2025-40275} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes) [Orabug: 38737061] {CVE-2025-40277} - ASoC: cs4271: Fix regulator leak on probe failure (Xu Wang) - regulator: fixed: fix GPIO descriptor leak on register failure (Xu Wang) - regulator: fixed: use dev_err_probe for register (Chris Morgan) - Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen) - net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet) - net_sched: remove need_resched() from qdisc_run() (Eric Dumazet) - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman) - net/mlx5e: Fix maxrate wraparound in threshold between units (Gal Pressman) - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (Ranganath V N) - wifi: mac80211: skip rate verification for not captured PSDUs (Benjamin Berg) - net: mdio: fix resource leak in mdiobus_register_device() (Csaba Buday) - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [Orabug: 38737084] {CVE-2025-40280} - tipc: simplify the finalize work queue (Xin Long) - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Eric Dumazet) [Orabug: 38737091] {CVE-2025-40281} - sctp: get netns from asoc and ep base (Xin Long) - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions (Pauli Virtanen) - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV addresstype confusion (Pauli Virtanen) - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path (Pauli Virtanen) - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (Raphael Pinsonneault-Thibeault) [Orabug: 38737104] {CVE-2025-40283} - net: fec: correct rx_bytes statistic for the case SHIFT16 is set (Wei Fang) - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Sharique Mohammad) - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug (Tristan Lobb) - NFS4: Fix state renewals missing after boot (Joshua Watt) - compiler_types: Move unused static inline functions warning to W=2 (Peter Zijlstra) - extcon: adc-jack: Cleanup wakeup source only if it was enabled (Krzysztof Kozlowski) - tracing: Fix memory leaks in create_field_var() (Zilin Guan) - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup (Qendrim Maxhuni) [Orabug: 38773283] {CVE-2025-68192} - sctp: Prevent TOCTOU out-of-bounds write (Stefan Wiehler) [Orabug: 38747447] {CVE-2025-40331} - sctp: Hold RCU read lock while iterating over address list (Stefan Wiehler) - net: dsa: b53: stop reading ARL entries if search is done (Jonas Gorski) - net: dsa: b53: fix enabling ip multicast (Jonas Gorski) - net: dsa: b53: fix resetting speed and pause on forced link (Jonas Gorski) - net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 (Álvaro Fernández Rojas) - net: dsa/b53: change b53_force_port_config() pause argument (Russell King) - net: vlan: sync VLAN features with lower device (Hangbin Liu) - ceph: add checking of wait_for_completion_killable() return value (Viacheslav Dubeyko) - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (Albin Babu Varghese) [Orabug: 38737182] {CVE-2025-40304} - ACPI: property: Return present device nodes only on fwnode interface (Sakari Ailus) - 9p: sysfs_init: don't hardcode error to ENOMEM (Randall P. Embry) - 9p: fix /sys/fs/9p/caches overwriting itself (Randall P. Embry) - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink(Yikang Yue) - ACPICA: Update dsmethod.c to get rid of unused variable warning (Saket Dumbre) - orangefs: fix xattr related buffer overflow... (Mike Marshall) - page_pool: Clamp pool size to max 16K pages (Dragos Tatulea) - Bluetooth: bcsp: receive data only if registered (Ivan Pravdin) [Orabug: 38737213] {CVE-2025-40308} - Bluetooth: SCO: Fix UAF on sco_conn_free (Luiz Augusto von Dentz) [Orabug: 38737224] {CVE-2025-40309} - net: macb: avoid dealing with endianness in macb_set_hwaddr() (Théo Lebrun) - nfs4_setup_readdir(): insufficient locking for -> d_parent-> d_inode dereferencing (Al Viro) [Orabug: 38773245] {CVE-2025-68185} - NFSv4.1: fix mount hang after CREATE_SESSION failure (Anthony Iliopoulos) - NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia) - remoteproc: qcom: q6v5: Avoid handling handover twice (Stephan Gerhold) - sparc/module: Add R_SPARC_UA64 relocation handling (Koakuma) - net: intel: fm10k: Fix parameter idx set but not used (Brahmajit Das) - jfs: fix uninitialized waitqueue in transaction manager (Shaurya Rane) - jfs: Verify inode mode when loading from disk (Tetsuo Handa) - ipv6: np-> rxpmtu race annotation (Eric Dumazet) - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices (Krishna Kurapati) - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs (Forest Crossman) - allow finish_no_open(file, ERR_PTR(-E...)) (Al Viro) - scsi: lpfc: Define size of debugfs entry for xri rebalancing (Justin Tee) - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (Justin Tee) - selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency (Nai-Chen Cheng) - net/cls_cgroup: Fix task_get_classid() during qdisc run (Yafang Shao) - selftests: Replace sleep with slowwait (David Ahern) - selftests: Disable dad for ipv6 in fcnal-test.sh (David Ahern) - media: redrat3: use int type to store negative error codes (Rong Qianfeng) - net: sh_eth: Disable WoL if system can not suspend (Niklas Söderlund) - phy: cadence:cdns-dphy: Enable lower resolutions in dphy (Harikrishna Shenoy) - usb: gadget: f_hid: Fix zero length packet transfer (William Wu) - net: call cond_resched() less often in __release_sock() (Eric Dumazet) - ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Cryolitia Pukngae) - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms (Juraj Šarinay) - dmaengine: dw-edma: Set status for callback_result (Devendra K Verma) - dmaengine: mv_xor: match alloc_wc and free_wc (Rosen Penev) - dmaengine: sh: setup_xref error handling (Thomas Andreatta) - scsi: pm8001: Use int instead of u32 to store error codes (Rong Qianfeng) - mips: lantiq: xway: sysctrl: rename stp clock (Aleksander Jan Bajkowski) - mips: lantiq: danube: add missing device_type in pci node (Aleksander Jan Bajkowski) - mips: lantiq: danube: add missing properties to cpu node (Aleksander Jan Bajkowski) - media: fix uninitialized symbol warnings (Chelsy Ratnawat) - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption (Amber Lin) - extcon: adc-jack: Fix wakeup source leaks on device unbind (Krzysztof Kozlowski) - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call (Sungho Kim) - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. (Kuniyuki Iwashima) - net: When removing nexthops, don't call synchronize_net if it is not necessary (Christoph Paasch) - char: misc: Does not request module for miscdevice with dynamic minor (Zijun Hu) - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet (Raub Camaioni) - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register (Rodrigo Gobbi) - media: imon: make send_packet() more robust (Tetsuo Handa) [Orabug: 38773298] {CVE-2025-68194} - net: ipv6: fix field-spanning memcpy warning in AH output (Charalampos Mitrodimas) [Orabug: 38773141] {CVE-2025-40363} - bridge: Redirect to backup port when port is administratively down (Ido Schimmel) - powerpc/eeh: Use result of error_detected() in uevent (Niklas Schnelle) - x86/vsyscall: Do not require X86_PF_INSTR to emulatevsyscall (Kirill A. Shutemov) - media: pci: ivtv: Don't create fake v4l2_fh (Laurent Pinchart) - drm/amdkfd: return -ENOTTY for unsupported IOCTLs (Geoffrey Mcrae) - selftests/net: Ensure assert() triggers in psock_tpacket.c (Wake Liu) - selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 (Wake Liu) - PCI: Disable MSI on RDC PCI to PCIe bridges (Marcos Del Sol Vives) - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() (Seyediman Seyedarab) - mfd: madera: Work around false-positive -Wininitialized warning (Arnd Bergmann) - mfd: stmpe-i2c: Add missing MODULE_LICENSE (Alexander Stein) - mfd: stmpe: Remove IRQ domain upon removal (Alexander Stein) - tools/power x86_energy_perf_policy: Prefer driver HWP limits (Len Brown) - tools/power x86_energy_perf_policy: Enhance HWP enable (Len Brown) - tools/cpupower: Fix incorrect size in cpuidle_state_disable() (Kaushlendra Kumar) - hwmon: (dell-smm) Add support for Dell OptiPlex 7040 (Armin Wolf) - uprobe: Do not emulate/sstep original instruction when ip is changed (Jiri Olsa) - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Daniel Lezcano) - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 (Svyatoslav Ryhel) - tee: allow a driver to allocate a tee_device without a pool (Amirreza Zarrabi) - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() (Hans de Goede) - mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card (Sarthak Garg) - irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment (Christian Bruel) - arc: Fix __fls() const-foldability via __builtin_clzl() (Kees Cook) - cpufreq/longhaul: handle NULL policy in longhaul_exit (Dennis Beier) - selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 (Ricardo B. Marlière) - ACPI: video: force native for Lenovo 82K8 (Mario Limonciello) - memstick: Add timeout to prevent indefinite waiting (Jiayi Li) - mmc: host: renesas_sdhi: Fix the actual clock (Biju Das) - bpf: Don't use %pK through printk (Thomas Weißschuh) -spi: loopback-test: Don't use %pK through printk (Thomas Weißschuh) - soc: qcom: smem: Fix endian-unaware access of num_entries (Jens Reidel) - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. (Owen Gu) - serial: 8250_dw: handle reset control deassert error (Artem Shimko) - serial: 8250_dw: Use devm_add_action_or_reset() (Andy Shevchenko) - serial: 8250_dw: Use devm_clk_get_optional() to get the input clock (Andy Shevchenko) - can: gs_usb: increase max interface to U8_MAX (Celeste Liu) - devcoredump: Fix circular locking dependency with devcd-> mutex. (Maarten Lankhorst) - net: ravb: Enforce descriptor type ordering (Lad Prabhakar) - x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (Babu Moger) - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (Gokul Sivakumar) [Orabug: 38737292] {CVE-2025-40321} - net: phy: dp83867: Disable EEE support as not implemented (Emanuele Ghidoli) - regmap: slimbus: fix bus_context pointer in regmap init calls (Alexey Klimov) - drm/etnaviv: fix flush sequence logic (Tomeu Vizoso) - usbnet: Prevents free active kevent (Lizhi Xu) [Orabug: 38773784] {CVE-2025-68312} - wifi: ath10k: Fix memory leak on unsupported WMI command (Loic Poulain) - ASoC: qdsp6: q6asm: do not sleep while atomic (Srinivas Kandagatla) - fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (Miaoqian Lin) - fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS (Florian Fuchs) - fbdev: bitblit: bound-check glyph index in bit_putcs* (Junjie Cao) [Orabug: 38737301] {CVE-2025-40322} - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (Yuhao Jiang) [Orabug: 38687005] {CVE-2025-40211} - fbdev: atyfb: Check if pll_ops-> init_pll failed (Daniel Palmer) - net: usb: asix_devices: Check return value of usbnet_get_endpoints (Miaoqian Lin) - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() (Filipe Manana) - x86/bugs: Fix reporting of LFENCE retpoline (David Kaplan) - net/sched:sch_qfq: Fix null-deref in agg_dequeue (Xiang Mei) [Orabug: 38597085] {CVE-2025-40083} [5.4.17-2136.352.1] - RDMA/cm: Rate limit destroy CM ID timeout error message (Håkon Bugge) [Orabug: 38753401] - soc/pensando: giglio: hack dts to make things right (Rob Gardner) [Orabug: 38688154] - soc/pensando: Add AMD Pensando Giglio SoC support (Brad Larson) [Orabug: 38688154] - soc/pensando: psci support (David Clear) [Orabug: 38688154] - soc/pensando: Giglio SoC eMMC interrupt driver (Brad Larson) [Orabug: 38688154] [5.4.17-2136.351.3] - Reapply "cpuidle: menu: Avoid discarding useful information" (Harshvardhan Jha) [Orabug: 38715366] - fbcon: fix integer overflow in font allocation (Samasth Norway Ananda) [Orabug: 38702507] - uek-rpm: Replace check-kabi tool with kabi (Yifei Liu) [Orabug: 38673382] - uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu) [Orabug: 38673382] [5.4.17-2136.351.2] - uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu) [Orabug: 38609548] - rds: Add smp_rmb before reading c_destroy_in_prog (Håkon Bugge) [Orabug: 38352486] - uio_hv_generic: Set event for all channels on the device (Long Li) - ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel) - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng) [5.4.17-2136.351.1] - scsi: megaraid_sas: Fix concurrent access to ISR between IRQ polling and real interrupt (Sumit Saxena) [Orabug: 38630482] _______________________________________________ El-errata mailing list
Mar 09, 2026
•Important
Oracle
202
security advisoryremote code executionimportant securityopenSUSE: 2025:1126-1 Critical Security Issue: tomcat RCE Vulnerability
An update that solves two vulnerabilities can now be installed.. # Security update for tomcat Announcement ID: SUSE-SU-2025:1126-1 Release Date: 2025-04-03T11:51:52Z Rating: important References: * bsc#1239302 * bsc#1239676 Cross-References: * CVE-2024-56337 * CVE-2025-24813 CVSS scores: * CVE-2024-56337 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-56337 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-24813 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-24813 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-24813 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-24813 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.6 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Manager Server 4.3 * Web and Scripting Module 15-SP6 An update that solves twovulnerabilities can now be installed. ## Description: This update for tomcat fixes the following issues: * CVE-2025-24813: Fixed potential RCE and/or information disclosure/corruption with partial PUT (bsc#1239302) * Update to Tomcat 9.0.102 * Fixes: * launch with java 17 (bsc#1239676) * Catalina * Fix: Weak etags in the If-Range header should not match as strong etags are required. (remm) * Fix: When looking up class loader resources by resource name, the resource name should not start with '/'. If the resource name does start with '/', Tomcat is lenient and looks it up as if the '/' was not present. When the web application class loader was configured with external repositories and names starting with '/' were used for lookups, it was possible that cached 'not found' results could effectively hide lookup results using the correct resource name. (markt) * Fix: Enable the JNDIRealm to validate credentials provided to HttpServletRequest.login(String username, String password) when the realm is configured to use GSSAPI authentication. (markt) * Fix: Fix a bug in the JRE compatibility detection that incorrectly identified Java 19 and Java 20 as supporting Java 21 features. (markt) * Fix: Improve the checks for exposure to and protection against CVE-2024-56337 so that reflection is not used unless required. The checks for whether the file system is case sensitive or not have been removed. (markt) * Fix: Avoid scenarios where temporary files used for partial PUT would not be deleted. (remm) * Fix: 69602: Fix regression in releases from 12-2024 that were too strict and rejected weak etags in the If-Range header. (remm) * Fix: 69576: Avoid possible failure initializing JreCompat due to uncaught exception introduced for the check for CVE-2024-56337. (remm) * Cluster * Add: 69598: Add detection of service account token changes to the KubernetesMembershipProvider implementation and reload the token if it changes. Based on a patch by Miroslav Jezbera. (markt) *Coyote * Fix: 69575: Avoid using compression if a response is already compressed using compress, deflate or zstd. (remm) * Update: Use Transfer-Encoding for compression rather than Content-Encoding if the client submits a TE header containing gzip. (remm) * Fix: Fix a race condition in the handling of HTTP/2 stream reset that could cause unexpected 500 responses. (markt) * Other * Add: Add makensis as an option for building the Installer for Windows on non-Windows platforms. (rjung/markt) * Update: Update Byte Buddy to 1.17.1. (markt) * Update: Update Checkstyle to 10.21.3. (markt) * Update: Update SpotBugs to 4.9.1. (markt) * Update: Update JSign to 7.1. (markt) * Add: Improvements to French translations. (remm) * Add: Improvements to Japanese translations by tak7iji. (markt) * Add: Add org.apache.juli.JsonFormatter to format log as one line JSON documents. (remm) * Update to Tomcat 9.0.99 * Catalina * Update: Add tableName configuration on the DataSourcePropertyStore that may be used by the WebDAV Servlet. (remm) * Update: Improve HTTP If headers processing according to RFC 9110. Based on pull request #796 by Chenjp. (remm/markt) * Update: Allow readOnly attribute configuration on the Resources element and allow configure the readOnly attribute value of the main resources. The attribute value will also be used by the default and WebDAV Servlets. (remm) * Fix: 69285: Optimise the creation of the parameter map for included requests. Based on sample code and test cases provided by John Engebretson. (markt) * Fix: 69527: Avoid rare cases where a cached resource could be set with 0 content length, or could be evicted immediately. (remm) * Fix: Fix possible edge cases (such as HTTP/1.0) with trying to detect requests without body for WebDAV LOCK and PROPFIND. (remm) * Fix: 69528: Add multi-release JAR support for the bloom archiveIndexStrategy of the Resources. (remm) * Fix: Improve checks for WEB-INF and META-INF in the WebDAVservlet. Based on a patch submitted by Chenjp. (remm) * Add: Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337, the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not. Where one or more web applications are potentially vulnerable to CVE-2024-56337 and the JVM cannot be correctly configured or it cannot be confirmed that the JVM has been correctly configured, prevent the impacted web applications from starting. (markt) * Fix: Remove unused session to client map from CrawlerSessionManagerValve. Submitted by Brian Matzon. (remm) * Fix: When using the WebDAV servlet with serveSubpathOnly set to true, ensure that the destination for any requested WebDAV operation is also restricted to the sub-path. (markt) * Fix: Generate an appropriate Allow HTTP header when the Default servlet returns a 405 (method not allowed) response in response to a DELETE request because the target resource cannot be deleted. Pull request #802 provided by Chenjp. (markt) * Code: Refactor creation of RequestDispatcher instances so that the processing of the provided path is consistent with normal request processing. (markt) * Add: Add encodedReverseSolidusHandling and encodedSolidusHandling attributes to Context to provide control over the handling of the path used to created a RequestDispatcher. (markt) * Fix: Handle a potential NullPointerException after an IOException occurs on a non-container thread during asynchronous processing. (markt) * Fix: Enhance lifecycle of temporary files used by partial PUT. (remm) * Coyote * Fix: Don't log warnings for registered HTTP/2 settings that Tomcat does not support. These settings are now silently ignored. (markt) * Fix: Avoid a rare NullPointerException when recycling the Http11InputBuffer. (markt) * Fix: Lower the log level to debug for logging an invalid socket channel when processing poller events for the NIO Connector as this may occur in normalusage. (markt) * Code: Clean-up references to the HTTP/2 stream once request processing has completed to aid GC and reduce the size of the HTTP/2 recycled request and response cache. (markt) * Add: Add a new Connector configuration attribute, encodedReverseSolidusHandling, to control how %5c sequences in URLs are handled. The default behaviour is unchanged (decode) keeping in mind that the allowBackslash attribute determines how the decoded URI is processed. (markt) * Fix: 69545: Improve CRLF skipping for the available method of the ChunkedInputFilter. (remm) * Fix: Improve the performance of repeated calls to getHeader(). Pull request #813 provided by Adwait Kumar Singh. (markt) * Fix: 69559: Ensure that the Java 24 warning regarding the use of sun.misc.Unsafe::invokeCleaner is only reported by the JRE when the code will be used. (markt) * Jasper * Fix: 69508: Correct a regression in the fix for 69382 that broke JSP include actions if both the page attribute and the body contained parameters. Pull request #803 provided by Chenjp. (markt) * Fix: 69521: Update the EL Parser to allow the full range of valid characters in an EL identifier as defined by the Java Language Specification. (markt) * Fix: 69532: Optimise the creation of ExpressionFactory instances. Patch provided by John Engebretson. (markt) * Web applications * Add: Documentation. Expand the description of the security implications of setting mapperContextRootRedirectEnabled and/or mapperDirectoryRedirectEnabled to true. (markt) * Fix: Documentation. Better document the default for the truststoreProvider attribute of a SSLHostConfig element. (markt) * Other * Update: Update to Commons Daemon 1.4.1. (markt) * Update: Update the internal fork of Commons Pool to 2.12.1. (markt) * Update: Update Byte Buddy to 1.16.1. (markt) * Update: Update UnboundID to 7.0.2. (markt) * Update: Update Checkstyle to 10.21.2. (markt) * Update: Update SpotBugs to 4.9.0. (markt) * Add: Improvements toFrench translations. (remm) * Add: Improvements to Chinese translations by leeyazhou. (markt) * Add: Improvements to Japanese translations by tak7iji. (markt) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2025-1126=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2025-1126=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-1126=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2025-1126=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2025-1126=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-1126=1 * Web and Scripting Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP6-2025-1126=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2025-1126=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-1126=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-1126=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-1126=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-1126=1 * SUSE Linux Enterprise Server 15 SP3 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2025-1126=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patchSUSE-SLE-Product-SLES-15-SP4-LTSS-2025-1126=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-1126=1 ## Package List: * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * SUSE Manager Server 4.3 (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * SUSE Enterprise Storage 7.1 (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * openSUSE Leap 15.6 (noarch) * tomcat-javadoc-9.0.102-150200.78.1 *tomcat-lib-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-docs-webapp-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-embed-9.0.102-150200.78.1 * tomcat-jsvc-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * Web and Scripting Module 15-SP6 (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 *tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * SUSE Linux Enterprise Server 15 SP3 LTSS (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch) * tomcat-lib-9.0.102-150200.78.1 * tomcat-admin-webapps-9.0.102-150200.78.1 * tomcat-webapps-9.0.102-150200.78.1 * tomcat-el-3_0-api-9.0.102-150200.78.1 * tomcat-servlet-4_0-api-9.0.102-150200.78.1 * tomcat-9.0.102-150200.78.1 * tomcat-jsp-2_3-api-9.0.102-150200.78.1 ## References: * https://www.suse.com/security/cve/CVE-2024-56337.html * https://www.suse.com/security/cve/CVE-2025-24813.html * https://bugzilla.suse.com/show_bug.cgi?id=1239302 * https://bugzilla.suse.com/show_bug.cgi?id=1239676 . Essential Apache Tomcat patch released for openSUSE addressing remote code execution and data leakage vulnerabilities. Ensure to apply it without delay for enhancedprotection.. openSUSE,tomcat,security update,remote code execution,info disclosure. . Severity: Important. LinuxSecurity.com Team
Apr 03, 2025
•Important
OpenSUSE
217
security advisoryupdatefirefoxOracle7: ELSA-2025-2699: firefox security Important Security Advisory Updates
The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2025-2699 http://linux.oracle.com/errata/ELSA-2025-2699.html The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network: x86_64: firefox-128.8.0-1.0.1.el7_9.x86_64.rpm SRPMS: http://oss.oracle.com/ol7/SRPMS-updates//firefox-128.8.0-1.0.1.el7_9.src.rpm Related CVEs: CVE-2025-1930 CVE-2025-1931 CVE-2025-1932 CVE-2025-1933 CVE-2025-1934 CVE-2025-1935 CVE-2025-1936 CVE-2025-1937 CVE-2025-1938 Description of changes: [128.8.0-1.0.1] - Update to 128.8.0 build1 [Orabug: 37700882][CVE-2025-1930][CVE-2025-1931] [CVE-2025-1932][CVE-2025-1933][CVE-2025-1934][CVE-2025-1935][CVE-2025-1936] [CVE-2025-1937][CVE-2025-1938] _______________________________________________ El-errata mailing list
Mar 19, 2025
•Important
Oracle
202
security advisorykernel updatesecurity patchopenSUSE: 2025:0919-1 important: kernel security patch issues
An update that solves four vulnerabilities can now be installed.. # Security update for the Linux Kernel (Live Patch 4 for SLE 15 SP6) Announcement ID: SUSE-SU-2025:0919-1 Release Date: 2025-03-19T07:34:11Z Rating: important References: * bsc#1231196 * bsc#1231204 * bsc#1233679 * bsc#1235452 Cross-References: * CVE-2024-46815 * CVE-2024-46818 * CVE-2024-50302 * CVE-2024-56648 CVSS scores: * CVE-2024-46815 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-46815 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-46815 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-46818 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-46818 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-46818 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-50302 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-50302 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-50302 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2024-50302 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-56648 ( SUSE ): 8.6 CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-56648 ( SUSE ): 8.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-56648 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.6 * SUSE Linux Enterprise Live Patching 15-SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves four vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 6.4.0-150600_23_22 fixes several issues. The following security issues were fixed: * CVE-2024-46818: drm/amd/display: Check gpio_id beforeused as array index (bsc#1231204). * CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231196). * CVE-2024-56648: net: hsr: avoid potential out-of-bound access in fill_frame_info() (bsc#1235452). * CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233679). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2025-919=1 * SUSE Linux Enterprise Live Patching 15-SP6 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP6-2025-919=1 ## Package List: * openSUSE Leap 15.6 (ppc64le s390x x86_64) * kernel-livepatch-6_4_0-150600_23_22-default-6-150600.2.1 * kernel-livepatch-6_4_0-150600_23_22-default-debuginfo-6-150600.2.1 * kernel-livepatch-SLE15-SP6_Update_4-debugsource-6-150600.2.1 * SUSE Linux Enterprise Live Patching 15-SP6 (ppc64le s390x x86_64) * kernel-livepatch-6_4_0-150600_23_22-default-6-150600.2.1 * kernel-livepatch-6_4_0-150600_23_22-default-debuginfo-6-150600.2.1 * kernel-livepatch-SLE15-SP6_Update_4-debugsource-6-150600.2.1 ## References: * https://www.suse.com/security/cve/CVE-2024-46815.html * https://www.suse.com/security/cve/CVE-2024-46818.html * https://www.suse.com/security/cve/CVE-2024-50302.html * https://www.suse.com/security/cve/CVE-2024-56648.html * https://bugzilla.suse.com/show_bug.cgi?id=1231196 * https://bugzilla.suse.com/show_bug.cgi?id=1231204 * https://bugzilla.suse.com/show_bug.cgi?id=1233679 * https://bugzilla.suse.com/show_bug.cgi?id=1235452 . An important patch for the Linux Kernel resolves several vulnerabilities in Fedora. Discover the details of these improvements.. openSUSE Kernel Fix, Linux Security Update, SUSE Security Advisory. . Severity: Important. LinuxSecurity.com Team
Mar 19, 2025
•Important
OpenSUSE
217
security advisorysoftware updateMySQLOracle Linux 8 ELSA-2025-1673: MySQL 8.0 Critical Security Fixes
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2025-1673 http://linux.oracle.com/errata/ELSA-2025-1673.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable LinuxNetwork: x86_64: mecab-0.996-2.module+el8.10.0+90521+d5cc5c65.x86_64.rpm mecab-devel-0.996-2.module+el8.10.0+90521+d5cc5c65.x86_64.rpm mecab-ipadic-2.7.0.20070801-17.0.1.module+el8.10.0+90521+d5cc5c65.x86_64.rpm mecab-ipadic-EUCJP-2.7.0.20070801-17.0.1.module+el8.10.0+90521+d5cc5c65.x86_64.rpm mysql-8.0.41-1.module+el8.10.0+90521+d5cc5c65.x86_64.rpm mysql-common-8.0.41-1.module+el8.10.0+90521+d5cc5c65.x86_64.rpm mysql-devel-8.0.41-1.module+el8.10.0+90521+d5cc5c65.x86_64.rpm mysql-errmsg-8.0.41-1.module+el8.10.0+90521+d5cc5c65.x86_64.rpm mysql-libs-8.0.41-1.module+el8.10.0+90521+d5cc5c65.x86_64.rpm mysql-server-8.0.41-1.module+el8.10.0+90521+d5cc5c65.x86_64.rpm mysql-test-8.0.41-1.module+el8.10.0+90521+d5cc5c65.x86_64.rpm aarch64: mecab-0.996-2.module+el8.10.0+90521+d5cc5c65.aarch64.rpm mecab-devel-0.996-2.module+el8.10.0+90521+d5cc5c65.aarch64.rpm mecab-ipadic-2.7.0.20070801-17.0.1.module+el8.10.0+90521+d5cc5c65.aarch64.rpm mecab-ipadic-EUCJP-2.7.0.20070801-17.0.1.module+el8.10.0+90521+d5cc5c65.aarch64.rpm mysql-8.0.41-1.module+el8.10.0+90521+d5cc5c65.aarch64.rpm mysql-common-8.0.41-1.module+el8.10.0+90521+d5cc5c65.aarch64.rpm mysql-devel-8.0.41-1.module+el8.10.0+90521+d5cc5c65.aarch64.rpm mysql-errmsg-8.0.41-1.module+el8.10.0+90521+d5cc5c65.aarch64.rpm mysql-libs-8.0.41-1.module+el8.10.0+90521+d5cc5c65.aarch64.rpm mysql-server-8.0.41-1.module+el8.10.0+90521+d5cc5c65.aarch64.rpm mysql-test-8.0.41-1.module+el8.10.0+90521+d5cc5c65.aarch64.rpm SRPMS: http://oss.oracle.com/ol8/SRPMS-updates//mecab-0.996-2.module+el8.10.0+90521+d5cc5c65.src.rpm http://oss.oracle.com/ol8/SRPMS-updates//mecab-ipadic-2.7.0.20070801-17.0.1.module+el8.10.0+90521+d5cc5c65.src.rpm http://oss.oracle.com/ol8/SRPMS-updates//mysql-8.0.41-1.module+el8.10.0+90521+d5cc5c65.src.rpm RelatedCVEs: CVE-2024-5535 CVE-2024-7264 CVE-2024-11053 CVE-2024-21193 CVE-2024-21194 CVE-2024-21196 CVE-2024-21197 CVE-2024-21198 CVE-2024-21199 CVE-2024-21201 CVE-2024-21203 CVE-2024-21212 CVE-2024-21213 CVE-2024-21218 CVE-2024-21219 CVE-2024-21230 CVE-2024-21231 CVE-2024-21236 CVE-2024-21237 CVE-2024-21238 CVE-2024-21239 CVE-2024-21241 CVE-2024-21247 CVE-2024-37371 CVE-2025-21490 CVE-2025-21491 CVE-2025-21494 CVE-2025-21497 CVE-2025-21500 CVE-2025-21501 CVE-2025-21503 CVE-2025-21504 CVE-2025-21505 CVE-2025-21518 CVE-2025-21519 CVE-2025-21520 CVE-2025-21521 CVE-2025-21522 CVE-2025-21523 CVE-2025-21525 CVE-2025-21529 CVE-2025-21531 CVE-2025-21534 CVE-2025-21536 CVE-2025-21540 CVE-2025-21543 CVE-2025-21546 CVE-2025-21555 CVE-2025-21559 Description of changes: mecab [0.996-2.12] - Bump version for 'mysql' module rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'AppStream' repo - Resolves: #2180411 mecab-ipadic [2.7.0.20070801-17.0.1] - Rename the LICENSE.Fedora to LICENSE.oracle [2.7.0.20070801-17] - Bump the release - Resolves: RHEL-24525 mysql [8.0.41-1] - Update to MySQL 8.0.41 _______________________________________________ El-errata mailing list
Feb 24, 2025
•Critical
Oracle
217
security advisorysecurity issuesoftware patchOracle Linux 9 ELSA-2025-1671 critical: MySQL security fix
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2025-1671 http://linux.oracle.com/errata/ELSA-2025-1671.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: mysql-8.0.41-2.el9_5.x86_64.rpm mysql-common-8.0.41-2.el9_5.x86_64.rpm mysql-errmsg-8.0.41-2.el9_5.x86_64.rpm mysql-server-8.0.41-2.el9_5.x86_64.rpm mysql-devel-8.0.41-2.el9_5.x86_64.rpm mysql-libs-8.0.41-2.el9_5.x86_64.rpm mysql-test-8.0.41-2.el9_5.x86_64.rpm aarch64: mysql-8.0.41-2.el9_5.aarch64.rpm mysql-common-8.0.41-2.el9_5.aarch64.rpm mysql-errmsg-8.0.41-2.el9_5.aarch64.rpm mysql-server-8.0.41-2.el9_5.aarch64.rpm mysql-devel-8.0.41-2.el9_5.aarch64.rpm mysql-libs-8.0.41-2.el9_5.aarch64.rpm mysql-test-8.0.41-2.el9_5.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates//mysql-8.0.41-2.el9_5.src.rpm Related CVEs: CVE-2024-5535 CVE-2024-7264 CVE-2024-11053 CVE-2024-21193 CVE-2024-21194 CVE-2024-21196 CVE-2024-21197 CVE-2024-21198 CVE-2024-21199 CVE-2024-21201 CVE-2024-21203 CVE-2024-21212 CVE-2024-21213 CVE-2024-21218 CVE-2024-21219 CVE-2024-21230 CVE-2024-21231 CVE-2024-21236 CVE-2024-21237 CVE-2024-21238 CVE-2024-21239 CVE-2024-21241 CVE-2024-21247 CVE-2024-37371 CVE-2025-21490 CVE-2025-21491 CVE-2025-21494 CVE-2025-21497 CVE-2025-21500 CVE-2025-21501 CVE-2025-21503 CVE-2025-21504 CVE-2025-21505 CVE-2025-21518 CVE-2025-21519 CVE-2025-21520 CVE-2025-21521 CVE-2025-21522 CVE-2025-21523 CVE-2025-21525 CVE-2025-21529 CVE-2025-21531 CVE-2025-21534 CVE-2025-21536 CVE-2025-21540 CVE-2025-21543 CVE-2025-21546 CVE-2025-21555 CVE-2025-21559 Description of changes: [8.0.41-2] - Fix patching of logrotate [8.0.41-1] - Update to MySQL 8.0.41 [8.0.40-1] - Update to MySQL 8.0.40 [8.0.39-1] - Rebase to version 8.0.39 [8.0.37-2] - Use signal to flush logs when rotating [8.0.37-1] - Update to MySQL 8.0.37 - Remove some legacy cmake options _______________________________________________ El-erratamailing list
Feb 24, 2025
•Critical
Oracle
100
security advisoryupdateimportantSUSE: 2025:0601-1 critical: brise argument injection and bypass
* bsc#1234597 * bsc#1235573 Cross-References: * CVE-2024-45337 . # Security update for brise Announcement ID: SUSE-SU-2025:0601-1 Release Date: 2025-02-20T09:14:15Z Rating: important References: * bsc#1234597 * bsc#1235573 Cross-References: * CVE-2024-45337 * CVE-2025-21613 CVSS scores: * CVE-2024-45337 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-45337 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2025-21613 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-21613 ( NVD ): 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear * CVE-2025-21613 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * Desktop Applications Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves two vulnerabilities can now be installed. ## Description: This update for brise fixes the following issues: * CVE-2025-21613: Fixed argument injection via the URL field (bsc#1235573). * CVE-2024-45337: Fixed authorization bypass in golang.org/x/crypto via the ServerConfig.PublicKeyCallback callback (bsc#1234597). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-601=1 SUSE-2025-601=1 * Desktop Applications Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP6-2025-601=1 ## Package List: * openSUSE Leap 15.6 (noarch) * rime-schema-soutzoe-20230603+git.5fdd2d6-150600.3.8.1 *rime-schema-emoji-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-bopomofo-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-wugniu-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-luna-pinyin-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-wubi-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-stenotype-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-pinyin-simp-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-terra-pinyin-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-cantonese-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-default-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-quick-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-custom-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-essay-simp-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-essay-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-ipa-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-scj-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-all-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-double-pinyin-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-array-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-combo-pinyin-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-middle-chinese-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-prelude-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-cangjie-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-stroke-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-extra-20230603+git.5fdd2d6-150600.3.8.1 * Desktop Applications Module 15-SP6 (noarch) * rime-schema-soutzoe-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-emoji-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-bopomofo-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-wugniu-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-luna-pinyin-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-wubi-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-stenotype-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-pinyin-simp-20230603+git.5fdd2d6-150600.3.8.1 *rime-schema-terra-pinyin-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-cantonese-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-default-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-quick-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-custom-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-essay-simp-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-essay-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-ipa-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-scj-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-all-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-double-pinyin-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-array-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-combo-pinyin-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-middle-chinese-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-prelude-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-cangjie-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-stroke-20230603+git.5fdd2d6-150600.3.8.1 * rime-schema-extra-20230603+git.5fdd2d6-150600.3.8.1 ## References: * https://www.suse.com/security/cve/CVE-2024-45337.html * https://www.suse.com/security/cve/CVE-2025-21613.html * https://bugzilla.suse.com/show_bug.cgi?id=1234597 * https://bugzilla.suse.com/show_bug.cgi?id=1235573 . Vital security upgrade for brise addressing two significant vulnerabilities and improving overall system protection.. brise security,SUSE updates,critical issues,software security. . Severity: Important. LinuxSecurity.com Team
Feb 21, 2025
•Important
SuSE
217
security advisorysecurity updateupdateOracle Linux 9 ELSA-2025-1066: Important firefox security update
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2025-1066 http://linux.oracle.com/errata/ELSA-2025-1066.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: firefox-128.7.0-1.0.1.el9_5.x86_64.rpm firefox-x11-128.7.0-1.0.1.el9_5.x86_64.rpm aarch64: firefox-128.7.0-1.0.1.el9_5.aarch64.rpm firefox-x11-128.7.0-1.0.1.el9_5.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates//firefox-128.7.0-1.0.1.el9_5.src.rpm Related CVEs: CVE-2025-1009 CVE-2025-1010 CVE-2025-1011 CVE-2025-1012 CVE-2025-1013 CVE-2025-1014 CVE-2025-1016 CVE-2025-1017 Description of changes: [128.7.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [128.7.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [128.7.0-1] - Update to 128.7.0 build1 _______________________________________________ El-errata mailing list
Feb 06, 2025
•Important
Oracle
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!