From el-errata at oss.oracle.com Mon Nov 2 06:15:01 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:15:01 -0800 Subject: [El-errata] ELSA-2026-55774 Moderate: Oracle Linux 7 java-1.8.0-openjdk security update Message-ID: Oracle Linux Security Advisory ELSA-2026-55774 http://linux.oracle.com/errata/ELSA-2026-55774.html The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network: x86_64: java-1.8.0-openjdk-1.8.0.504.b01-1.0.1.el7_9.i686.rpm java-1.8.0-openjdk-1.8.0.504.b01-1.0.1.el7_9.x86_64.rpm java-1.8.0-openjdk-accessibility-1.8.0.504.b01-1.0.1.el7_9.i686.rpm java-1.8.0-openjdk-accessibility-1.8.0.504.b01-1.0.1.el7_9.x86_64.rpm java-1.8.0-openjdk-demo-1.8.0.504.b01-1.0.1.el7_9.i686.rpm java-1.8.0-openjdk-demo-1.8.0.504.b01-1.0.1.el7_9.x86_64.rpm java-1.8.0-openjdk-devel-1.8.0.504.b01-1.0.1.el7_9.i686.rpm java-1.8.0-openjdk-devel-1.8.0.504.b01-1.0.1.el7_9.x86_64.rpm java-1.8.0-openjdk-headless-1.8.0.504.b01-1.0.1.el7_9.i686.rpm java-1.8.0-openjdk-headless-1.8.0.504.b01-1.0.1.el7_9.x86_64.rpm java-1.8.0-openjdk-javadoc-1.8.0.504.b01-1.0.1.el7_9.noarch.rpm java-1.8.0-openjdk-javadoc-zip-1.8.0.504.b01-1.0.1.el7_9.noarch.rpm java-1.8.0-openjdk-src-1.8.0.504.b01-1.0.1.el7_9.i686.rpm java-1.8.0-openjdk-src-1.8.0.504.b01-1.0.1.el7_9.x86_64.rpm SRPMS: http://oss.oracle.com/ol7/SRPMS-updates/java-1.8.0-openjdk-1.8.0.504.b01-1.0.1.el7_9.src.rpm Related CVEs: CVE-2026-60589 CVE-2026-61308 CVE-2026-70907 Description of changes: [1.8.0.504.b01-1.0.1] - update to open-jdk 8u504-b01 (GA) [Orabug: 39966086] - Security update for CVE-2026-60589 CVE-2026-61308 and CVE-2026-70907 From el-errata at oss.oracle.com Mon Nov 2 06:19:53 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:19:53 -0800 Subject: [El-errata] ELBA-2026-500560 Oracle Linux 8 leapp-repository bug fix update Message-ID: Oracle Linux Bug Fix Advisory ELBA-2026-500560 http://linux.oracle.com/errata/ELBA-2026-500560.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: leapp-upgrade-el8toel9-0.23.0-2.0.20.el8_10.noarch.rpm leapp-upgrade-el8toel9-deps-0.23.0-2.0.20.el8_10.noarch.rpm leapp-upgrade-el8toel9-fapolicyd-0.23.0-2.0.20.el8_10.noarch.rpm aarch64: leapp-upgrade-el8toel9-0.23.0-2.0.20.el8_10.noarch.rpm leapp-upgrade-el8toel9-deps-0.23.0-2.0.20.el8_10.noarch.rpm leapp-upgrade-el8toel9-fapolicyd-0.23.0-2.0.20.el8_10.noarch.rpm SRPMS: http://oss.oracle.com/ol8/SRPMS-updates/leapp-repository-0.23.0-2.0.20.el8_10.src.rpm Description of changes: [0.23.0-2.0.20] - Fix repo name parsing for OSMH use case [Orabug: 40233752] From el-errata at oss.oracle.com Mon Nov 2 06:19:56 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:19:56 -0800 Subject: [El-errata] ELSA-2026-92157 Critical: Oracle Linux 8 mod_auth_openidc:2.3 security update Message-ID: Oracle Linux Security Advisory ELSA-2026-92157 http://linux.oracle.com/errata/ELSA-2026-92157.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: cjose-0.6.1-6.module+el8.10.0+91088+2d069dc4.x86_64.rpm cjose-devel-0.6.1-6.module+el8.10.0+91088+2d069dc4.x86_64.rpm mod_auth_openidc-2.4.9.4-9.module+el8.10.0+91088+2d069dc4.x86_64.rpm aarch64: cjose-0.6.1-6.module+el8.10.0+91088+2d069dc4.aarch64.rpm cjose-devel-0.6.1-6.module+el8.10.0+91088+2d069dc4.aarch64.rpm mod_auth_openidc-2.4.9.4-9.module+el8.10.0+91088+2d069dc4.aarch64.rpm SRPMS: http://oss.oracle.com/ol8/SRPMS-updates/cjose-0.6.1-6.module+el8.10.0+91088+2d069dc4.src.rpm http://oss.oracle.com/ol8/SRPMS-updates/mod_auth_openidc-2.4.9.4-9.module+el8.10.0+91088+2d069dc4.src.rpm Related CVEs: CVE-2026-53939 Description of changes: cjose [0.6.1-6] - CVE-2026-53939 mod_auth_openidc:2.3/cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption Resolves: RHEL-287898 mod_auth_openidc [2.4.9.4-9] - Resolves: RHEL-248080 CVE-2026-54789 Denial of Service via malformed state cookie parsing From el-errata at oss.oracle.com Mon Nov 2 06:19:59 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:19:59 -0800 Subject: [El-errata] ELSA-2026-92209 Important: Oracle Linux 8 kernel security, bug fix, and enhancement update Message-ID: Oracle Linux Security Advisory ELSA-2026-92209 http://linux.oracle.com/errata/ELSA-2026-92209.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: bpftool-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-abi-stablelists-4.18.0-553.180.1.el8_10.noarch.rpm kernel-core-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-cross-headers-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-debug-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-debug-core-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-debug-devel-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-debug-modules-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-debug-modules-extra-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-devel-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-doc-4.18.0-553.180.1.el8_10.noarch.rpm kernel-headers-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-modules-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-modules-extra-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-tools-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-tools-libs-4.18.0-553.180.1.el8_10.x86_64.rpm kernel-tools-libs-devel-4.18.0-553.180.1.el8_10.x86_64.rpm perf-4.18.0-553.180.1.el8_10.x86_64.rpm python3-perf-4.18.0-553.180.1.el8_10.x86_64.rpm aarch64: bpftool-4.18.0-553.180.1.el8_10.aarch64.rpm kernel-cross-headers-4.18.0-553.180.1.el8_10.aarch64.rpm kernel-headers-4.18.0-553.180.1.el8_10.aarch64.rpm kernel-tools-4.18.0-553.180.1.el8_10.aarch64.rpm kernel-tools-libs-4.18.0-553.180.1.el8_10.aarch64.rpm kernel-tools-libs-devel-4.18.0-553.180.1.el8_10.aarch64.rpm perf-4.18.0-553.180.1.el8_10.aarch64.rpm python3-perf-4.18.0-553.180.1.el8_10.aarch64.rpm SRPMS: http://oss.oracle.com/ol8/SRPMS-updates/kernel-4.18.0-553.180.1.el8_10.src.rpm Related CVEs: CVE-2026-72288 CVE-2026-72289 CVE-2026-90011 CVE-2026-98222 Description of changes: [4.18.0-553.180.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3 - Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772] [4.18.0-553.180.1] - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (Mohammadfaiz Bawa) [RHEL-252475] {CVE-2026-72289} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243811] {CVE-2026-72288} - scsi: target: iscsi: Reserve a terminator byte for the login payload (CKI Backport Bot) [RHEL-285567] {CVE-2026-90011} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279488] {CVE-2026-98222} - arp: do not assume dev_hard_header() does not change skb->head (Guillaume Nault) [RHEL-271136] - ip6_gre: make ip6gre_header() robust (Guillaume Nault) [RHEL-271136] - ipv4: ip_gre: make ipgre_header() robust (Guillaume Nault) [RHEL-271135] From el-errata at oss.oracle.com Mon Nov 2 06:20:01 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:20:01 -0800 Subject: [El-errata] ELSA-2026-92376 Important: Oracle Linux 8 nodejs:24 security, bug fix, and enhancement update Message-ID: Oracle Linux Security Advisory ELSA-2026-92376 http://linux.oracle.com/errata/ELSA-2026-92376.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: nodejs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.x86_64.rpm nodejs-devel-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.x86_64.rpm nodejs-docs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.noarch.rpm nodejs-full-i18n-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.x86_64.rpm nodejs-libs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.x86_64.rpm nodejs-nodemon-3.1.14-2.module+el8.10.0+91054+4b1a799c.noarch.rpm nodejs-packaging-2021.06-6.module+el8.10.0+91054+4b1a799c.noarch.rpm nodejs-packaging-bundler-2021.06-6.module+el8.10.0+91054+4b1a799c.noarch.rpm npm-11.19.0-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5.noarch.rpm v8-13.6-devel-13.6.233.17-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5.x86_64.rpm aarch64: nodejs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.aarch64.rpm nodejs-devel-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.aarch64.rpm nodejs-docs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.noarch.rpm nodejs-full-i18n-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.aarch64.rpm nodejs-libs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.aarch64.rpm nodejs-nodemon-3.1.14-2.module+el8.10.0+91054+4b1a799c.noarch.rpm nodejs-packaging-2021.06-6.module+el8.10.0+91054+4b1a799c.noarch.rpm nodejs-packaging-bundler-2021.06-6.module+el8.10.0+91054+4b1a799c.noarch.rpm npm-11.19.0-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5.noarch.rpm v8-13.6-devel-13.6.233.17-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5.aarch64.rpm SRPMS: http://oss.oracle.com/ol8/SRPMS-updates/nodejs-24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5.src.rpm http://oss.oracle.com/ol8/SRPMS-updates/nodejs-nodemon-3.1.14-2.module+el8.10.0+91054+4b1a799c.src.rpm http://oss.oracle.com/ol8/SRPMS-updates/nodejs-packaging-2021.06-6.module+el8.10.0+91054+4b1a799c.src.rpm Related CVEs: CVE-2026-101911 CVE-2026-102276 CVE-2026-102277 CVE-2026-102278 CVE-2026-105481 CVE-2026-105482 CVE-2026-105483 CVE-2026-106069 CVE-2026-106071 CVE-2026-106072 CVE-2026-106073 CVE-2026-106074 CVE-2026-111497 Description of changes: nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging From el-errata at oss.oracle.com Mon Nov 2 06:20:07 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:20:07 -0800 Subject: [El-errata] ELSA-2026-92427 Important: Oracle Linux 8 .NET 9.0 security, bug fix, and enhancement update Message-ID: Oracle Linux Security Advisory ELSA-2026-92427 http://linux.oracle.com/errata/ELSA-2026-92427.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: aspnetcore-runtime-9.0-9.0.22-1.0.1.el8_10.x86_64.rpm aspnetcore-runtime-dbg-9.0-9.0.22-1.0.1.el8_10.x86_64.rpm aspnetcore-targeting-pack-9.0-9.0.22-1.0.1.el8_10.x86_64.rpm dotnet-apphost-pack-9.0-9.0.22-1.0.1.el8_10.x86_64.rpm dotnet-hostfxr-9.0-9.0.22-1.0.1.el8_10.x86_64.rpm dotnet-runtime-9.0-9.0.22-1.0.1.el8_10.x86_64.rpm dotnet-runtime-dbg-9.0-9.0.22-1.0.1.el8_10.x86_64.rpm dotnet-sdk-9.0-9.0.123-1.0.1.el8_10.x86_64.rpm dotnet-sdk-9.0-source-built-artifacts-9.0.123-1.0.1.el8_10.x86_64.rpm dotnet-sdk-aot-9.0-9.0.123-1.0.1.el8_10.x86_64.rpm dotnet-sdk-dbg-9.0-9.0.123-1.0.1.el8_10.x86_64.rpm dotnet-targeting-pack-9.0-9.0.22-1.0.1.el8_10.x86_64.rpm dotnet-templates-9.0-9.0.123-1.0.1.el8_10.x86_64.rpm netstandard-targeting-pack-2.1-9.0.123-1.0.1.el8_10.x86_64.rpm aarch64: aspnetcore-runtime-9.0-9.0.22-1.0.1.el8_10.aarch64.rpm aspnetcore-runtime-dbg-9.0-9.0.22-1.0.1.el8_10.aarch64.rpm aspnetcore-targeting-pack-9.0-9.0.22-1.0.1.el8_10.aarch64.rpm dotnet-apphost-pack-9.0-9.0.22-1.0.1.el8_10.aarch64.rpm dotnet-hostfxr-9.0-9.0.22-1.0.1.el8_10.aarch64.rpm dotnet-runtime-9.0-9.0.22-1.0.1.el8_10.aarch64.rpm dotnet-runtime-dbg-9.0-9.0.22-1.0.1.el8_10.aarch64.rpm dotnet-sdk-9.0-9.0.123-1.0.1.el8_10.aarch64.rpm dotnet-sdk-9.0-source-built-artifacts-9.0.123-1.0.1.el8_10.aarch64.rpm dotnet-sdk-aot-9.0-9.0.123-1.0.1.el8_10.aarch64.rpm dotnet-sdk-dbg-9.0-9.0.123-1.0.1.el8_10.aarch64.rpm dotnet-targeting-pack-9.0-9.0.22-1.0.1.el8_10.aarch64.rpm dotnet-templates-9.0-9.0.123-1.0.1.el8_10.aarch64.rpm netstandard-targeting-pack-2.1-9.0.123-1.0.1.el8_10.aarch64.rpm SRPMS: http://oss.oracle.com/ol8/SRPMS-updates/dotnet9.0-9.0.123-1.0.1.el8_10.src.rpm Related CVEs: CVE-2026-114148 Description of changes: [9.0.123-1.0.1] - Add support for Oracle Linux [9.0.123-1] - Update to .NET SDK 9.0.123 and Runtime 9.0.22 - Resolves: RHEL-291723 From el-errata at oss.oracle.com Mon Nov 2 06:20:04 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:20:04 -0800 Subject: [El-errata] ELSA-2026-92420 Important: Oracle Linux 8 .NET 8.0 security, bug fix, and enhancement update Message-ID: Oracle Linux Security Advisory ELSA-2026-92420 http://linux.oracle.com/errata/ELSA-2026-92420.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: aspnetcore-runtime-8.0-8.0.33-1.0.1.el8_10.x86_64.rpm aspnetcore-runtime-dbg-8.0-8.0.33-1.0.1.el8_10.x86_64.rpm aspnetcore-targeting-pack-8.0-8.0.33-1.0.1.el8_10.x86_64.rpm dotnet-apphost-pack-8.0-8.0.33-1.0.1.el8_10.x86_64.rpm dotnet-hostfxr-8.0-8.0.33-1.0.1.el8_10.x86_64.rpm dotnet-runtime-8.0-8.0.33-1.0.1.el8_10.x86_64.rpm dotnet-runtime-dbg-8.0-8.0.33-1.0.1.el8_10.x86_64.rpm dotnet-sdk-8.0-8.0.133-1.0.1.el8_10.x86_64.rpm dotnet-sdk-8.0-source-built-artifacts-8.0.133-1.0.1.el8_10.x86_64.rpm dotnet-sdk-dbg-8.0-8.0.133-1.0.1.el8_10.x86_64.rpm dotnet-targeting-pack-8.0-8.0.33-1.0.1.el8_10.x86_64.rpm dotnet-templates-8.0-8.0.133-1.0.1.el8_10.x86_64.rpm aarch64: aspnetcore-runtime-8.0-8.0.33-1.0.1.el8_10.aarch64.rpm aspnetcore-runtime-dbg-8.0-8.0.33-1.0.1.el8_10.aarch64.rpm aspnetcore-targeting-pack-8.0-8.0.33-1.0.1.el8_10.aarch64.rpm dotnet-apphost-pack-8.0-8.0.33-1.0.1.el8_10.aarch64.rpm dotnet-hostfxr-8.0-8.0.33-1.0.1.el8_10.aarch64.rpm dotnet-runtime-8.0-8.0.33-1.0.1.el8_10.aarch64.rpm dotnet-runtime-dbg-8.0-8.0.33-1.0.1.el8_10.aarch64.rpm dotnet-sdk-8.0-8.0.133-1.0.1.el8_10.aarch64.rpm dotnet-sdk-8.0-source-built-artifacts-8.0.133-1.0.1.el8_10.aarch64.rpm dotnet-sdk-dbg-8.0-8.0.133-1.0.1.el8_10.aarch64.rpm dotnet-targeting-pack-8.0-8.0.33-1.0.1.el8_10.aarch64.rpm dotnet-templates-8.0-8.0.133-1.0.1.el8_10.aarch64.rpm SRPMS: http://oss.oracle.com/ol8/SRPMS-updates/dotnet8.0-8.0.133-1.0.1.el8_10.src.rpm Related CVEs: CVE-2026-111497 CVE-2026-114148 Description of changes: [8.0.133-1.0.1] - Add support for Oracle Linux [8.0.133-1] - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: -RHEL-291714 From el-errata at oss.oracle.com Mon Nov 2 06:20:09 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:20:09 -0800 Subject: [El-errata] ELSA-2026-92615 Important: Oracle Linux 8 aspell security update Message-ID: Oracle Linux Security Advisory ELSA-2026-92615 http://linux.oracle.com/errata/ELSA-2026-92615.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: aspell-0.60.6.1-23.el8_10.i686.rpm aspell-0.60.6.1-23.el8_10.x86_64.rpm aspell-devel-0.60.6.1-23.el8_10.i686.rpm aspell-devel-0.60.6.1-23.el8_10.x86_64.rpm aarch64: aspell-0.60.6.1-23.el8_10.aarch64.rpm aspell-devel-0.60.6.1-23.el8_10.aarch64.rpm SRPMS: http://oss.oracle.com/ol8/SRPMS-updates/aspell-0.60.6.1-23.el8_10.src.rpm Related CVEs: CVE-2026-103658 Description of changes: [12:0.60.6.1-23] - Backport fix for CVE-2026-103658 From el-errata at oss.oracle.com Mon Nov 2 06:20:14 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:20:14 -0800 Subject: [El-errata] ELSA-2026-92639 Important: Oracle Linux 8 python-pillow security update Message-ID: Oracle Linux Security Advisory ELSA-2026-92639 http://linux.oracle.com/errata/ELSA-2026-92639.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: python3-pillow-5.1.1-33.el8_10.i686.rpm python3-pillow-5.1.1-33.el8_10.x86_64.rpm python3-pillow-devel-5.1.1-33.el8_10.i686.rpm python3-pillow-devel-5.1.1-33.el8_10.x86_64.rpm python3-pillow-doc-5.1.1-33.el8_10.noarch.rpm python3-pillow-tk-5.1.1-33.el8_10.x86_64.rpm aarch64: python3-pillow-5.1.1-33.el8_10.aarch64.rpm python3-pillow-devel-5.1.1-33.el8_10.aarch64.rpm python3-pillow-doc-5.1.1-33.el8_10.noarch.rpm python3-pillow-tk-5.1.1-33.el8_10.aarch64.rpm SRPMS: http://oss.oracle.com/ol8/SRPMS-updates/python-pillow-5.1.1-33.el8_10.src.rpm Related CVEs: CVE-2026-96640 CVE-2026-112391 CVE-2026-112392 CVE-2026-112397 CVE-2026-112402 CVE-2026-112405 CVE-2026-112406 CVE-2026-112892 CVE-2026-112894 CVE-2026-112895 Description of changes: [5.1.1-33] - CVE-2026-112892 python-pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder Resolves: RHEL-290437 [5.1.1-32] - CVE-2026-96640 python-pillow: pillow: Denial of Service via duplicate page references in PDF files Resolves: RHEL-289281 [5.1.1-31] - CVE-2026-112406 python-pillow: pillow: Denial of Service via infinite loop during PDF page rewriting Resolves: RHEL-287839 [5.1.1-30] - CVE-2026-112402 python-pillow: pillow: Denial of service via double free during image transformation Resolves: RHEL-287157 [5.1.1-29] - CVE-2026-112894 python-pillow: pillow: Denial of Service via crafted multi-frame image conversion Resolves: RHEL-287147 [5.1.1-28] - CVE-2026-112895 python-pillow: pillow: Denial of service via crafted PDF during append operations Resolves: RHEL-287152 [5.1.1-27] - CVE-2026-112392 python-pillow: pillow: Denial of Service via zero-size images in rank filters Resolves: RHEL-287128 [5.1.1-26] - Security fix for CVE-2026-112397 Resolves: RHEL-287137 [5.1.1-25] - CVE-2026-112391 python-pillow: Pillow: Denial of Service via unbounded recursion in PDF parser Resolves: RHEL-287109 [5.1.1-24] - CVE-2026-112405 python-pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() Resolves: RHEL-287123 From el-errata at oss.oracle.com Mon Nov 2 06:20:12 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:20:12 -0800 Subject: [El-errata] ELSA-2026-92616 Important: Oracle Linux 8 httpd:2.4 security, bug fix, and enhancement update Message-ID: Oracle Linux Security Advisory ELSA-2026-92616 http://linux.oracle.com/errata/ELSA-2026-92616.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: httpd-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm httpd-devel-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm httpd-filesystem-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.noarch.rpm httpd-manual-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.noarch.rpm httpd-tools-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm mod_http2-1.15.7-10.module+el8.10.0+91023+3994037c.7.x86_64.rpm mod_ldap-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm mod_md-2.0.8-8.module+el8.10.0+91092+d4ec9ae3.4.x86_64.rpm mod_proxy_html-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm mod_session-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm mod_ssl-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.x86_64.rpm aarch64: httpd-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm httpd-devel-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm httpd-filesystem-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.noarch.rpm httpd-manual-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.noarch.rpm httpd-tools-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm mod_http2-1.15.7-10.module+el8.10.0+91023+3994037c.7.aarch64.rpm mod_ldap-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm mod_md-2.0.8-8.module+el8.10.0+91092+d4ec9ae3.4.aarch64.rpm mod_proxy_html-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm mod_session-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm mod_ssl-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.aarch64.rpm SRPMS: http://oss.oracle.com/ol8/SRPMS-updates/httpd-2.4.37-65.0.1.module+el8.10.0+91092+d4ec9ae3.8.src.rpm http://oss.oracle.com/ol8/SRPMS-updates/mod_http2-1.15.7-10.module+el8.10.0+91023+3994037c.7.src.rpm http://oss.oracle.com/ol8/SRPMS-updates/mod_md-2.0.8-8.module+el8.10.0+91092+d4ec9ae3.4.src.rpm Related CVEs: CVE-2026-33006 CVE-2026-46729 CVE-2026-48005 CVE-2026-56153 CVE-2026-56154 CVE-2026-63045 CVE-2026-63292 CVE-2026-63686 CVE-2026-63718 CVE-2026-73636 CVE-2026-73637 CVE-2026-93546 Description of changes: httpd [2.4.37-65.0.1.8] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-65.8] - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointer dereference can cause a child process crash (CVE-2026-33007) - Resolves: RHEL-175088 - httpd:2.4/httpd: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) - Resolves: RHEL-175620 - httpd:2.4/httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) - Resolves: RHEL-175055 - httpd: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) mod_http2 mod_md [1:2.0.8-8.4] - Resolves: RHEL-251674 - fix segfault when await_valid times out and prevent repeated CSR submission after restart [1:2.0.8-8.3] - Resolves: RHEL-247701 - fix CPU spikes from CVE-2025-55753 patch From el-errata at oss.oracle.com Mon Nov 2 06:20:16 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:20:16 -0800 Subject: [El-errata] ELSA-2026-92869 Important: Oracle Linux 8 tomcat security update Message-ID: Oracle Linux Security Advisory ELSA-2026-92869 http://linux.oracle.com/errata/ELSA-2026-92869.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: tomcat-9.0.121-1.el8_10.noarch.rpm tomcat-admin-webapps-9.0.121-1.el8_10.noarch.rpm tomcat-docs-webapp-9.0.121-1.el8_10.noarch.rpm tomcat-el-3.0-api-9.0.121-1.el8_10.noarch.rpm tomcat-jsp-2.3-api-9.0.121-1.el8_10.noarch.rpm tomcat-lib-9.0.121-1.el8_10.noarch.rpm tomcat-servlet-4.0-api-9.0.121-1.el8_10.noarch.rpm tomcat-webapps-9.0.121-1.el8_10.noarch.rpm aarch64: tomcat-9.0.121-1.el8_10.noarch.rpm tomcat-admin-webapps-9.0.121-1.el8_10.noarch.rpm tomcat-docs-webapp-9.0.121-1.el8_10.noarch.rpm tomcat-el-3.0-api-9.0.121-1.el8_10.noarch.rpm tomcat-jsp-2.3-api-9.0.121-1.el8_10.noarch.rpm tomcat-lib-9.0.121-1.el8_10.noarch.rpm tomcat-servlet-4.0-api-9.0.121-1.el8_10.noarch.rpm tomcat-webapps-9.0.121-1.el8_10.noarch.rpm SRPMS: http://oss.oracle.com/ol8/SRPMS-updates/tomcat-9.0.121-1.el8_10.src.rpm Related CVEs: CVE-2026-65182 CVE-2026-65637 CVE-2026-65905 CVE-2026-65927 CVE-2026-68525 CVE-2026-68569 Description of changes: [1:9.0.121-1] - Resolves: RHEL-255793 tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) - Resolves: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183) - Resolves: RHEL-271822 tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637) - Resolves: RHEL-271900 tomcat: Limited replay attack possible with DIGEST authentication (CVE-2026-65905) - Resolves: RHEL-271775 tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) - Resolves: DoS in WebSocket chat example (CVE-2026-66299) - Resolves: Servlet role references can bypass declarative role constraints (CVE-2026-66422) - Resolves: RHEL-271798 tomcat: Unauthorized resource access via FORM authentication bypass(CVE-2026-68525) - Resolves: RHEL-271749 tomcat: Principal lookup could fail open in some cases (CVE-2026-68569) - Resolves: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763) - Resolves: Default to Moderate (Impact missing upstream) (CVE-2026-73180) From el-errata at oss.oracle.com Mon Nov 2 06:23:23 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:23:23 -0800 Subject: [El-errata] ELSA-2026-91056 Moderate: Oracle Linux 9 libXi security update Message-ID: Oracle Linux Security Advisory ELSA-2026-91056 http://linux.oracle.com/errata/ELSA-2026-91056.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: libXi-1.7.10-8.el9_8.1.x86_64.rpm libXi-devel-1.7.10-8.el9_8.1.x86_64.rpm libXi-1.7.10-8.el9_8.1.i686.rpm libXi-devel-1.7.10-8.el9_8.1.i686.rpm aarch64: libXi-1.7.10-8.el9_8.1.aarch64.rpm libXi-devel-1.7.10-8.el9_8.1.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates/libXi-1.7.10-8.el9_8.1.src.rpm Related CVEs: CVE-2026-93543 Description of changes: [1.7.10-8.1] - CVE fix for CVE-2026-93541, CVE-2026-93542, CVE-2026-93543 Resolves: RHEL-270061 From el-errata at oss.oracle.com Mon Nov 2 06:23:26 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:23:26 -0800 Subject: [El-errata] ELSA-2026-92378 Important: Oracle Linux 9 nodejs:24 security, bug fix, and enhancement update Message-ID: Oracle Linux Security Advisory ELSA-2026-92378 http://linux.oracle.com/errata/ELSA-2026-92378.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: nodejs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.x86_64.rpm nodejs-devel-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.x86_64.rpm nodejs-docs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.noarch.rpm nodejs-full-i18n-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.x86_64.rpm nodejs-libs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.x86_64.rpm nodejs-nodemon-3.1.14-3.module+el9.8.0+91009+5d530ccd.noarch.rpm nodejs-packaging-2021.06-6.module+el9.8.0+91009+5d530ccd.noarch.rpm nodejs-packaging-bundler-2021.06-6.module+el9.8.0+91009+5d530ccd.noarch.rpm npm-11.19.0-1.24.21.0.1.0.1.module+el9.8.0+91091+c060d8b4.noarch.rpm v8-13.6-devel-13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91091+c060d8b4.x86_64.rpm aarch64: nodejs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.aarch64.rpm nodejs-devel-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.aarch64.rpm nodejs-docs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.noarch.rpm nodejs-full-i18n-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.aarch64.rpm nodejs-libs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.aarch64.rpm nodejs-nodemon-3.1.14-3.module+el9.8.0+91009+5d530ccd.noarch.rpm nodejs-packaging-2021.06-6.module+el9.8.0+91009+5d530ccd.noarch.rpm nodejs-packaging-bundler-2021.06-6.module+el9.8.0+91009+5d530ccd.noarch.rpm npm-11.19.0-1.24.21.0.1.0.1.module+el9.8.0+91091+c060d8b4.noarch.rpm v8-13.6-devel-13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91091+c060d8b4.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates/nodejs-24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4.src.rpm http://oss.oracle.com/ol9/SRPMS-updates/nodejs-nodemon-3.1.14-3.module+el9.8.0+91009+5d530ccd.src.rpm http://oss.oracle.com/ol9/SRPMS-updates/nodejs-packaging-2021.06-6.module+el9.8.0+91009+5d530ccd.src.rpm Related CVEs: CVE-2026-101911 CVE-2026-102276 CVE-2026-102277 CVE-2026-102278 CVE-2026-105481 CVE-2026-105482 CVE-2026-105483 CVE-2026-106069 CVE-2026-106071 CVE-2026-106072 CVE-2026-106073 CVE-2026-106074 CVE-2026-111497 Description of changes: nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging From el-errata at oss.oracle.com Mon Nov 2 06:23:28 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:23:28 -0800 Subject: [El-errata] ELSA-2026-92429 Important: Oracle Linux 9 .NET 9.0 security, bug fix, and enhancement update Message-ID: Oracle Linux Security Advisory ELSA-2026-92429 http://linux.oracle.com/errata/ELSA-2026-92429.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: aspnetcore-runtime-9.0-9.0.22-1.0.1.el9_8.x86_64.rpm aspnetcore-runtime-dbg-9.0-9.0.22-1.0.1.el9_8.x86_64.rpm aspnetcore-targeting-pack-9.0-9.0.22-1.0.1.el9_8.x86_64.rpm dotnet-apphost-pack-9.0-9.0.22-1.0.1.el9_8.x86_64.rpm dotnet-hostfxr-9.0-9.0.22-1.0.1.el9_8.x86_64.rpm dotnet-runtime-9.0-9.0.22-1.0.1.el9_8.x86_64.rpm dotnet-runtime-dbg-9.0-9.0.22-1.0.1.el9_8.x86_64.rpm dotnet-sdk-9.0-9.0.123-1.0.1.el9_8.x86_64.rpm dotnet-sdk-9.0-source-built-artifacts-9.0.123-1.0.1.el9_8.x86_64.rpm dotnet-sdk-aot-9.0-9.0.123-1.0.1.el9_8.x86_64.rpm dotnet-sdk-dbg-9.0-9.0.123-1.0.1.el9_8.x86_64.rpm dotnet-targeting-pack-9.0-9.0.22-1.0.1.el9_8.x86_64.rpm dotnet-templates-9.0-9.0.123-1.0.1.el9_8.x86_64.rpm netstandard-targeting-pack-2.1-9.0.123-1.0.1.el9_8.x86_64.rpm aarch64: aspnetcore-runtime-9.0-9.0.22-1.0.1.el9_8.aarch64.rpm aspnetcore-runtime-dbg-9.0-9.0.22-1.0.1.el9_8.aarch64.rpm aspnetcore-targeting-pack-9.0-9.0.22-1.0.1.el9_8.aarch64.rpm dotnet-apphost-pack-9.0-9.0.22-1.0.1.el9_8.aarch64.rpm dotnet-hostfxr-9.0-9.0.22-1.0.1.el9_8.aarch64.rpm dotnet-runtime-9.0-9.0.22-1.0.1.el9_8.aarch64.rpm dotnet-runtime-dbg-9.0-9.0.22-1.0.1.el9_8.aarch64.rpm dotnet-sdk-9.0-9.0.123-1.0.1.el9_8.aarch64.rpm dotnet-sdk-9.0-source-built-artifacts-9.0.123-1.0.1.el9_8.aarch64.rpm dotnet-sdk-aot-9.0-9.0.123-1.0.1.el9_8.aarch64.rpm dotnet-sdk-dbg-9.0-9.0.123-1.0.1.el9_8.aarch64.rpm dotnet-targeting-pack-9.0-9.0.22-1.0.1.el9_8.aarch64.rpm dotnet-templates-9.0-9.0.123-1.0.1.el9_8.aarch64.rpm netstandard-targeting-pack-2.1-9.0.123-1.0.1.el9_8.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates/dotnet9.0-9.0.123-1.0.1.el9_8.src.rpm Related CVEs: CVE-2026-114148 Description of changes: [9.0.123-1.0.1] - Add support for Oracle Linux [9.0.123-1] - Update to .NET SDK 9.0.123 and Runtime 9.0.22 - Resolves: RHEL-291727 From el-errata at oss.oracle.com Mon Nov 2 06:23:30 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:23:30 -0800 Subject: [El-errata] ELSA-2026-92458 Important: Oracle Linux 9 aspell security update Message-ID: Oracle Linux Security Advisory ELSA-2026-92458 http://linux.oracle.com/errata/ELSA-2026-92458.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: aspell-0.60.8-9.el9_8.i686.rpm aspell-0.60.8-9.el9_8.x86_64.rpm aspell-devel-0.60.8-9.el9_8.i686.rpm aspell-devel-0.60.8-9.el9_8.x86_64.rpm aarch64: aspell-0.60.8-9.el9_8.aarch64.rpm aspell-devel-0.60.8-9.el9_8.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates/aspell-0.60.8-9.el9_8.src.rpm Related CVEs: CVE-2026-103658 Description of changes: [12:0.60.8-9] - Backport fix for CVE-2026-103658 From el-errata at oss.oracle.com Mon Nov 2 06:23:32 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:23:32 -0800 Subject: [El-errata] ELSA-2026-92492 Important: Oracle Linux 9 .NET 8.0 security, bug fix, and enhancement update Message-ID: Oracle Linux Security Advisory ELSA-2026-92492 http://linux.oracle.com/errata/ELSA-2026-92492.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: aspnetcore-runtime-8.0-8.0.33-1.0.1.el9_8.x86_64.rpm aspnetcore-runtime-dbg-8.0-8.0.33-1.0.1.el9_8.x86_64.rpm aspnetcore-targeting-pack-8.0-8.0.33-1.0.1.el9_8.x86_64.rpm dotnet-apphost-pack-8.0-8.0.33-1.0.1.el9_8.x86_64.rpm dotnet-hostfxr-8.0-8.0.33-1.0.1.el9_8.x86_64.rpm dotnet-runtime-8.0-8.0.33-1.0.1.el9_8.x86_64.rpm dotnet-runtime-dbg-8.0-8.0.33-1.0.1.el9_8.x86_64.rpm dotnet-sdk-8.0-8.0.133-1.0.1.el9_8.x86_64.rpm dotnet-sdk-8.0-source-built-artifacts-8.0.133-1.0.1.el9_8.x86_64.rpm dotnet-sdk-dbg-8.0-8.0.133-1.0.1.el9_8.x86_64.rpm dotnet-targeting-pack-8.0-8.0.33-1.0.1.el9_8.x86_64.rpm dotnet-templates-8.0-8.0.133-1.0.1.el9_8.x86_64.rpm aarch64: aspnetcore-runtime-8.0-8.0.33-1.0.1.el9_8.aarch64.rpm aspnetcore-runtime-dbg-8.0-8.0.33-1.0.1.el9_8.aarch64.rpm aspnetcore-targeting-pack-8.0-8.0.33-1.0.1.el9_8.aarch64.rpm dotnet-apphost-pack-8.0-8.0.33-1.0.1.el9_8.aarch64.rpm dotnet-hostfxr-8.0-8.0.33-1.0.1.el9_8.aarch64.rpm dotnet-runtime-8.0-8.0.33-1.0.1.el9_8.aarch64.rpm dotnet-runtime-dbg-8.0-8.0.33-1.0.1.el9_8.aarch64.rpm dotnet-sdk-8.0-8.0.133-1.0.1.el9_8.aarch64.rpm dotnet-sdk-8.0-source-built-artifacts-8.0.133-1.0.1.el9_8.aarch64.rpm dotnet-sdk-dbg-8.0-8.0.133-1.0.1.el9_8.aarch64.rpm dotnet-targeting-pack-8.0-8.0.33-1.0.1.el9_8.aarch64.rpm dotnet-templates-8.0-8.0.133-1.0.1.el9_8.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates/dotnet8.0-8.0.133-1.0.1.el9_8.src.rpm Related CVEs: CVE-2026-111497 CVE-2026-114148 Description of changes: [8.0.133-1.0.1] - Add support for Oracle Linux [8.0.133-1] - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: RHEL-291717 From el-errata at oss.oracle.com Mon Nov 2 06:23:34 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:23:34 -0800 Subject: [El-errata] ELSA-2026-92907 Moderate: Oracle Linux 9 curl security update Message-ID: Oracle Linux Security Advisory ELSA-2026-92907 http://linux.oracle.com/errata/ELSA-2026-92907.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: curl-7.76.1-40.el9_8.9.x86_64.rpm curl-minimal-7.76.1-40.el9_8.9.x86_64.rpm libcurl-7.76.1-40.el9_8.9.i686.rpm libcurl-7.76.1-40.el9_8.9.x86_64.rpm libcurl-devel-7.76.1-40.el9_8.9.i686.rpm libcurl-devel-7.76.1-40.el9_8.9.x86_64.rpm libcurl-minimal-7.76.1-40.el9_8.9.i686.rpm libcurl-minimal-7.76.1-40.el9_8.9.x86_64.rpm aarch64: curl-7.76.1-40.el9_8.9.aarch64.rpm curl-minimal-7.76.1-40.el9_8.9.aarch64.rpm libcurl-7.76.1-40.el9_8.9.aarch64.rpm libcurl-devel-7.76.1-40.el9_8.9.aarch64.rpm libcurl-minimal-7.76.1-40.el9_8.9.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates/curl-7.76.1-40.el9_8.9.src.rpm Related CVEs: CVE-2026-8932 Description of changes: [7.76.1-40.el9_8.9] - fix incomplete mTLS config in connection reuse (CVE-2026-8932) From el-errata at oss.oracle.com Mon Nov 2 06:23:36 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:23:36 -0800 Subject: [El-errata] ELSA-2026-93072 Important: Oracle Linux 9 bind9.18 security update Message-ID: Oracle Linux Security Advisory ELSA-2026-93072 http://linux.oracle.com/errata/ELSA-2026-93072.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: bind9.18-9.18.29-14.el9_8.12.x86_64.rpm bind9.18-chroot-9.18.29-14.el9_8.12.x86_64.rpm bind9.18-devel-9.18.29-14.el9_8.12.i686.rpm bind9.18-devel-9.18.29-14.el9_8.12.x86_64.rpm bind9.18-dnssec-utils-9.18.29-14.el9_8.12.x86_64.rpm bind9.18-doc-9.18.29-14.el9_8.12.noarch.rpm bind9.18-libs-9.18.29-14.el9_8.12.i686.rpm bind9.18-libs-9.18.29-14.el9_8.12.x86_64.rpm bind9.18-utils-9.18.29-14.el9_8.12.x86_64.rpm aarch64: bind9.18-9.18.29-14.el9_8.12.aarch64.rpm bind9.18-chroot-9.18.29-14.el9_8.12.aarch64.rpm bind9.18-devel-9.18.29-14.el9_8.12.aarch64.rpm bind9.18-dnssec-utils-9.18.29-14.el9_8.12.aarch64.rpm bind9.18-doc-9.18.29-14.el9_8.12.noarch.rpm bind9.18-libs-9.18.29-14.el9_8.12.aarch64.rpm bind9.18-utils-9.18.29-14.el9_8.12.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates/bind9.18-9.18.29-14.el9_8.12.src.rpm Related CVEs: CVE-2026-19630 CVE-2026-94300 CVE-2026-96888 CVE-2026-97313 Description of changes: [32:9.18.29-14.12] - Prevent arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300) - Fix Denial of service via assertion failure in RPZ query processing (CVE-2026-97313) - Prevent Denial of Service via assertion failure during redirect processing (CVE-2026-96888) - Prevent Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630) From el-errata at oss.oracle.com Mon Nov 2 06:24:50 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:24:50 -0800 Subject: [El-errata] ELBA-2026-90804 Oracle Linux 10 openmpi, opensm, perftest, rdma-core, rshim, and ucx bug fix and enhancement update Message-ID: Oracle Linux Bug Fix Advisory ELBA-2026-90804 http://linux.oracle.com/errata/ELBA-2026-90804.html The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network: x86_64: ibacm-61.0-2.el10_2.x86_64.rpm infiniband-diags-61.0-2.el10_2.x86_64.rpm iwpmd-61.0-2.el10_2.x86_64.rpm libibumad-61.0-2.el10_2.x86_64.rpm libibverbs-61.0-2.el10_2.x86_64.rpm libibverbs-utils-61.0-2.el10_2.x86_64.rpm librdmacm-61.0-2.el10_2.x86_64.rpm librdmacm-utils-61.0-2.el10_2.x86_64.rpm openmpi-5.0.9-2.el10_2.x86_64.rpm openmpi-devel-5.0.9-2.el10_2.x86_64.rpm openmpi-java-5.0.9-2.el10_2.x86_64.rpm opensm-3.3.24-14.el10_2.x86_64.rpm opensm-devel-3.3.24-14.el10_2.x86_64.rpm opensm-libs-3.3.24-14.el10_2.x86_64.rpm perftest-25.10.0.0.128-2.el10_2.x86_64.rpm python3-openmpi-5.0.9-2.el10_2.x86_64.rpm python3-pyverbs-61.0-2.el10_2.x86_64.rpm rdma-core-61.0-2.el10_2.x86_64.rpm rdma-core-devel-61.0-2.el10_2.x86_64.rpm rshim-2.0.17-7.el10_2.x86_64.rpm srp_daemon-61.0-2.el10_2.x86_64.rpm ucx-1.19.1-3.el10_2.x86_64.rpm ucx-cma-1.19.1-3.el10_2.x86_64.rpm ucx-devel-1.19.1-3.el10_2.x86_64.rpm ucx-ib-1.19.1-3.el10_2.x86_64.rpm ucx-rdmacm-1.19.1-3.el10_2.x86_64.rpm aarch64: ibacm-61.0-2.el10_2.aarch64.rpm infiniband-diags-61.0-2.el10_2.aarch64.rpm iwpmd-61.0-2.el10_2.aarch64.rpm libibumad-61.0-2.el10_2.aarch64.rpm libibverbs-61.0-2.el10_2.aarch64.rpm libibverbs-utils-61.0-2.el10_2.aarch64.rpm librdmacm-61.0-2.el10_2.aarch64.rpm librdmacm-utils-61.0-2.el10_2.aarch64.rpm openmpi-5.0.9-2.el10_2.aarch64.rpm openmpi-devel-5.0.9-2.el10_2.aarch64.rpm openmpi-java-5.0.9-2.el10_2.aarch64.rpm opensm-3.3.24-14.el10_2.aarch64.rpm opensm-devel-3.3.24-14.el10_2.aarch64.rpm opensm-libs-3.3.24-14.el10_2.aarch64.rpm perftest-25.10.0.0.128-2.el10_2.aarch64.rpm python3-openmpi-5.0.9-2.el10_2.aarch64.rpm python3-pyverbs-61.0-2.el10_2.aarch64.rpm rdma-core-61.0-2.el10_2.aarch64.rpm rdma-core-devel-61.0-2.el10_2.aarch64.rpm rshim-2.0.17-7.el10_2.aarch64.rpm srp_daemon-61.0-2.el10_2.aarch64.rpm ucx-1.19.1-3.el10_2.aarch64.rpm ucx-cma-1.19.1-3.el10_2.aarch64.rpm ucx-devel-1.19.1-3.el10_2.aarch64.rpm ucx-ib-1.19.1-3.el10_2.aarch64.rpm ucx-rdmacm-1.19.1-3.el10_2.aarch64.rpm SRPMS: http://oss.oracle.com/ol10/SRPMS-updates/openmpi-5.0.9-2.el10_2.src.rpm http://oss.oracle.com/ol10/SRPMS-updates/opensm-3.3.24-14.el10_2.src.rpm http://oss.oracle.com/ol10/SRPMS-updates/perftest-25.10.0.0.128-2.el10_2.src.rpm http://oss.oracle.com/ol10/SRPMS-updates/rdma-core-61.0-2.el10_2.src.rpm http://oss.oracle.com/ol10/SRPMS-updates/rshim-2.0.17-7.el10_2.src.rpm http://oss.oracle.com/ol10/SRPMS-updates/ucx-1.19.1-3.el10_2.src.rpm Description of changes: openmpi [3:5.0.9-2] - Bump release for rebuild - Resolves: RHEL-275734 [3:5.0.9-1] - Bump Epoch - Resolves: RHEL-275734 [2:5.0.9-1] - Update to release 5.0.9 - Resolves: RHEL-95332, RHEL-99262 [2:5.0.2-7] - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 [2:5.0.2-6] - Rebuilt with java-21-openjdk as default JDK: https://issues.redhat.com/browse/RHEL-34597 opensm [1:3.3.24-14] - Bump release for rebuild Resolves: RHEL-275732 [1:3.3.24-13] - Add Epoch: 1 to the spec file Resolves: RHEL-275732 perftest [1:25.10.0.0.128-2] - Bump release for rebuild rdma-core [1:61.0-2] - Bump release for rebuild and fix rpmdeps rshim [1:2.0.17-7] - Bump epoch to overcome erroneous ovs-doca build ucx [1:1.19.1-3] - Bump release for rebuild - Resolves: RHEL-275731 [1:1.19.1-2] - Add Epoch: 1 to the ucx spec file - Resolves: RHEL-275731 From el-errata at oss.oracle.com Mon Nov 2 06:24:52 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Sun, 01 Nov 2026 22:24:52 -0800 Subject: [El-errata] ELSA-2026-92862 Important: Oracle Linux 10 tomcat security, bug fix, and enhancement update Message-ID: Oracle Linux Security Advisory ELSA-2026-92862 http://linux.oracle.com/errata/ELSA-2026-92862.html The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network: x86_64: tomcat-10.1.49-5.el10_2.noarch.rpm tomcat-admin-webapps-10.1.49-5.el10_2.noarch.rpm tomcat-docs-webapp-10.1.49-5.el10_2.noarch.rpm tomcat-el-5.0-api-10.1.49-5.el10_2.noarch.rpm tomcat-jsp-3.1-api-10.1.49-5.el10_2.noarch.rpm tomcat-lib-10.1.49-5.el10_2.noarch.rpm tomcat-servlet-6.0-api-10.1.49-5.el10_2.noarch.rpm tomcat-webapps-10.1.49-5.el10_2.noarch.rpm aarch64: tomcat-10.1.49-5.el10_2.noarch.rpm tomcat-admin-webapps-10.1.49-5.el10_2.noarch.rpm tomcat-docs-webapp-10.1.49-5.el10_2.noarch.rpm tomcat-el-5.0-api-10.1.49-5.el10_2.noarch.rpm tomcat-jsp-3.1-api-10.1.49-5.el10_2.noarch.rpm tomcat-lib-10.1.49-5.el10_2.noarch.rpm tomcat-servlet-6.0-api-10.1.49-5.el10_2.noarch.rpm tomcat-webapps-10.1.49-5.el10_2.noarch.rpm SRPMS: http://oss.oracle.com/ol10/SRPMS-updates/tomcat-10.1.49-5.el10_2.src.rpm Related CVEs: CVE-2026-65182 CVE-2026-65905 CVE-2026-65927 CVE-2026-68525 CVE-2026-68569 CVE-2026-68763 Description of changes: [1:10.1.49-5] - Resolves: RHEL-264918 tomcat: Stalled TLS handshake when the server's first flight is too large - Resolves: RHEL-255786 tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) - Resolves: RHEL-271888 tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905) - Resolves: RHEL-271766 tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) - Resolves: RHEL-271791 tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525) - Resolves: RHEL-271741 tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569) - Resolves: RHEL-271720 tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763) From el-errata at oss.oracle.com Mon Nov 2 19:36:04 2026 From: el-errata at oss.oracle.com (Errata Announcements for Oracle Linux) Date: Mon, 2 Nov 2026 23:36:04 +0400 Subject: [El-errata] New Ksplice updates for RHCK 9 (ELSA-2026-68570) Message-ID: Synopsis: ELSA-2026-68570 can now be patched using Ksplice CVEs: CVE-2026-31663 CVE-2026-63917 CVE-2026-63921 CVE-2026-64582 CVE-2026-68159 CVE-2026-68426 CVE-2026-72243 CVE-2026-72463 Users with Oracle Linux Premier Support can now use Ksplice to patch against the latest Oracle Linux Security Advisory, ELSA-2026-68570. More information about this errata can be found at https://linux.oracle.com/errata/ELSA-2026-68570.html INSTALLING THE UPDATES We recommend that all users of Ksplice Uptrack running RHCK 9 install these updates. On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf, these updates will be installed automatically and you do not need to take any action. Alternatively, you can install these updates by running: # /usr/sbin/uptrack-upgrade -y DESCRIPTION * CVE-2026-31663, CVE-2026-72463: Use-after-free in XFRM asynchronous receive. * CVE-2026-63917, CVE-2026-63921: Use-after-free in virtual IPv6 tunneling driver. * CVE-2026-64582: Use-after-free in RDMA RXE mmap. * CVE-2026-68159: Out-of-bounds memory access in Ceph OSD map decoding. * CVE-2026-68426: Use-after-free in XFRM asynchronous transmit. * CVE-2026-72243: Permission bypass in SELinux TCP Fast Open checks. SUPPORT Ksplice support is available at ksplice-support_ww at oracle.com.