Thunderbird, Firefox, Node.js 22, Kernels, and Maintenance updates for Oracle Linux

Oracle Linux 6527 Published by

Oracle released a batch of errata covering security patches and maintenance fixes for distributions across versions 7, 8, 9, and 10. The Important-rated advisories address vulnerabilities in Thunderbird, Firefox, Node.js 22, FRR, LibreSwan, rsync, and the Unbreakable Enterprise Kernel alongside standard kernel releases. Lower-priority notices deliver routine improvements to PHP 7.4 and 8.2 environments, plus bug corrections for glibc, tuned, tzdata, linux-firmware, and scap-security-guide.

ELSA-2026-49621 Important: Oracle Linux 10 thunderbird security update
ELSA-2026-48033 Important: Oracle Linux 10 nodejs22 security update
ELSA-2026-48032 Important: Oracle Linux 10 nodejs-nodemon security update
ELSA-2026-47101 Important: Oracle Linux 10 firefox security update
ELSA-2026-35842 Important: Oracle Linux 10 nodejs22 security, bug fix, and enhancement update
ELSA-2026-23329 Important: Oracle Linux 10 kernel security update
ELBA-2026-42741 Oracle Linux 9 tuned bug fix and enhancement update
ELSA-2026-49524 Important: Oracle Linux 8 perl-Archive-Tar security update
ELSA-2026-47750 Low: Oracle Linux 8 php:7.4 security, bug fix, and enhancement update
ELSA-2026-49511 Important: Oracle Linux 8 frr security update
ELSA-2026-47749 Low: Oracle Linux 8 php:8.2 security, bug fix, and enhancement update
ELSA-2026-46396 Important: Oracle Linux 8 libreswan security update
ELBA-2026-500115 Oracle Linux 8 glibc bug fix update
ELBA-2026-500114 Oracle Linux 8 scap-security-guide bug fix update
ELSA-2026-500121 Important: Oracle Linux 8 Unbreakable Enterprise kernel security update
ELSA-2026-25172 Important: Oracle Linux 7 rsync security update
ELBA-2026-500116 Oracle Linux 7 linux-firmware bug fix update
ELBA-2026-20539 Oracle Linux 7 tzdata bug fix and enhancement update




ELSA-2026-49621 Important: Oracle Linux 10 thunderbird security update


Oracle Linux Security Advisory ELSA-2026-49621

http://linux.oracle.com/errata/ELSA-2026-49621.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
thunderbird-140.13.0-1.0.1.el10_2.x86_64.rpm

aarch64:
thunderbird-140.13.0-1.0.1.el10_2.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/thunderbird-140.13.0-1.0.1.el10_2.src.rpm

Related CVEs:

CVE-2026-14899
CVE-2026-15718
CVE-2026-15719
CVE-2026-16349
CVE-2026-16350
CVE-2026-16351
CVE-2026-16352
CVE-2026-16353
CVE-2026-16354
CVE-2026-16355
CVE-2026-16356
CVE-2026-16357
CVE-2026-16358
CVE-2026-16359
CVE-2026-16360
CVE-2026-16361
CVE-2026-16362
CVE-2026-16363
CVE-2026-16368
CVE-2026-16369
CVE-2026-16371
CVE-2026-16374
CVE-2026-16375
CVE-2026-16377
CVE-2026-16379
CVE-2026-16381
CVE-2026-16383
CVE-2026-16387
CVE-2026-16390
CVE-2026-16391
CVE-2026-16396
CVE-2026-16405
CVE-2026-16412

Description of changes:

[140.13.0-1.0.1]
- Add Oracle prefs

[140.13.0-1]
- Update to 140.13.0 ESR



ELSA-2026-48033 Important: Oracle Linux 10 nodejs22 security update


Oracle Linux Security Advisory ELSA-2026-48033

http://linux.oracle.com/errata/ELSA-2026-48033.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
nodejs-22.23.1-4.el10_2.x86_64.rpm
nodejs-devel-22.23.1-4.el10_2.x86_64.rpm
nodejs-docs-22.23.1-4.el10_2.noarch.rpm
nodejs-full-i18n-22.23.1-4.el10_2.x86_64.rpm
nodejs-libs-22.23.1-4.el10_2.x86_64.rpm
nodejs-npm-10.9.8-1.22.23.1.4.el10_2.x86_64.rpm

aarch64:
nodejs-22.23.1-4.el10_2.aarch64.rpm
nodejs-devel-22.23.1-4.el10_2.aarch64.rpm
nodejs-docs-22.23.1-4.el10_2.noarch.rpm
nodejs-full-i18n-22.23.1-4.el10_2.aarch64.rpm
nodejs-libs-22.23.1-4.el10_2.aarch64.rpm
nodejs-npm-10.9.8-1.22.23.1.4.el10_2.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/nodejs22-22.23.1-4.el10_2.src.rpm

Related CVEs:

CVE-2026-13149
CVE-2026-59873
CVE-2026-59874

Description of changes:

[1:22.23.1-4]
- Fix CVE-2026-13149 (npm/brace-expansion)

[1:22.23.1-3]
- Fix for CVE-2026-59873 and Fix for CVE-2026-59874 (node-tar)

[1:22.23.1-2]
- CVE-2026-42338 ip-address HTML escaping fix.

[1:22.23.1-1]
- Update to version 22.23.1

[1:22.22.2-2]
- De-bundle c-ares, libuv
- we waited for c-ares for about 4 months, so added conditional flag in
case it falls behind in future again, same for libuv



ELSA-2026-48032 Important: Oracle Linux 10 nodejs-nodemon security update


Oracle Linux Security Advisory ELSA-2026-48032

http://linux.oracle.com/errata/ELSA-2026-48032.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm

aarch64:
nodejs-nodemon-3.1.14-2.el10_2.noarch.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/nodejs-nodemon-3.1.14-2.el10_2.src.rpm

Related CVEs:

CVE-2026-13149

Description of changes:

[3.1.14-2]
- Regenerete sources.

[3.1.14-1]
- Update to version 3.1.14

[3.0.3-7]
- revert of ce0df1a

[3.0.3-6]
- deps: revert letting nodemon work with any node



ELSA-2026-47101 Important: Oracle Linux 10 firefox security update


Oracle Linux Security Advisory ELSA-2026-47101

http://linux.oracle.com/errata/ELSA-2026-47101.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
firefox-140.13.0-1.0.1.el10_2.x86_64.rpm

aarch64:
firefox-140.13.0-1.0.1.el10_2.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/firefox-140.13.0-1.0.1.el10_2.src.rpm

Related CVEs:

CVE-2026-15718
CVE-2026-15719
CVE-2026-16349
CVE-2026-16350
CVE-2026-16351
CVE-2026-16352
CVE-2026-16353
CVE-2026-16354
CVE-2026-16355
CVE-2026-16356
CVE-2026-16357
CVE-2026-16358
CVE-2026-16359
CVE-2026-16360
CVE-2026-16361
CVE-2026-16362
CVE-2026-16363
CVE-2026-16368
CVE-2026-16369
CVE-2026-16371
CVE-2026-16374
CVE-2026-16375
CVE-2026-16377
CVE-2026-16379
CVE-2026-16381
CVE-2026-16383
CVE-2026-16387
CVE-2026-16390
CVE-2026-16391
CVE-2026-16396
CVE-2026-16405
CVE-2026-16412

Description of changes:

[140.13.0-1.0.1]
- Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773]
- Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

[140.13.0-1]
- Update to 140.13.0 ESR



ELSA-2026-35842 Important: Oracle Linux 10 nodejs22 security, bug fix, and enhancement update


Oracle Linux Security Advisory ELSA-2026-35842

http://linux.oracle.com/errata/ELSA-2026-35842.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
nodejs-22.23.1-2.el10_2.x86_64.rpm
nodejs-devel-22.23.1-2.el10_2.x86_64.rpm
nodejs-docs-22.23.1-2.el10_2.noarch.rpm
nodejs-full-i18n-22.23.1-2.el10_2.x86_64.rpm
nodejs-libs-22.23.1-2.el10_2.x86_64.rpm
nodejs-npm-10.9.8-1.22.23.1.2.el10_2.x86_64.rpm

aarch64:
nodejs-22.23.1-2.el10_2.aarch64.rpm
nodejs-devel-22.23.1-2.el10_2.aarch64.rpm
nodejs-docs-22.23.1-2.el10_2.noarch.rpm
nodejs-full-i18n-22.23.1-2.el10_2.aarch64.rpm
nodejs-libs-22.23.1-2.el10_2.aarch64.rpm
nodejs-npm-10.9.8-1.22.23.1.2.el10_2.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/nodejs22-22.23.1-2.el10_2.src.rpm

Related CVEs:

CVE-2026-6733
CVE-2026-9678
CVE-2026-11525
CVE-2026-12151
CVE-2026-42338
CVE-2026-48615
CVE-2026-48618
CVE-2026-48619
CVE-2026-48928
CVE-2026-48930
CVE-2026-48933
CVE-2026-48934
CVE-2026-48935

Description of changes:

[1:22.23.1-2]
- CVE-2026-42338 ip-address HTML escaping fix.

[1:22.23.1-1]
- Update to version 22.23.1

[1:22.22.2-2]
- De-bundle c-ares, libuv
- we waited for c-ares for about 4 months, so added conditional flag in
case it falls behind in future again, same for libuv



ELSA-2026-23329 Important: Oracle Linux 10 kernel security update


Oracle Linux Security Advisory ELSA-2026-23329

http://linux.oracle.com/errata/ELSA-2026-23329.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
kernel-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-abi-stablelists-6.12.0-211.34.1.el10_2.noarch.rpm
kernel-core-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-cross-headers-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-debug-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-debug-core-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-debug-devel-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-debug-devel-matched-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-debug-modules-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-debug-modules-core-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-debug-modules-extra-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-debug-uki-virt-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-devel-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-devel-matched-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-doc-6.12.0-211.34.1.el10_2.noarch.rpm
kernel-headers-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-modules-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-modules-core-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-modules-extra-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-modules-extra-matched-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-tools-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-tools-libs-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-tools-libs-devel-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-uki-virt-6.12.0-211.34.1.el10_2.x86_64.rpm
kernel-uki-virt-addons-6.12.0-211.34.1.el10_2.x86_64.rpm
libperf-6.12.0-211.34.1.el10_2.x86_64.rpm
perf-6.12.0-211.34.1.el10_2.x86_64.rpm
python3-perf-6.12.0-211.34.1.el10_2.x86_64.rpm
rtla-6.12.0-211.34.1.el10_2.x86_64.rpm
rv-6.12.0-211.34.1.el10_2.x86_64.rpm

aarch64:
kernel-cross-headers-6.12.0-211.34.1.el10_2.aarch64.rpm
kernel-headers-6.12.0-211.34.1.el10_2.aarch64.rpm
kernel-tools-6.12.0-211.34.1.el10_2.aarch64.rpm
kernel-tools-libs-6.12.0-211.34.1.el10_2.aarch64.rpm
kernel-tools-libs-devel-6.12.0-211.34.1.el10_2.aarch64.rpm
libperf-6.12.0-211.34.1.el10_2.aarch64.rpm
perf-6.12.0-211.34.1.el10_2.aarch64.rpm
python3-perf-6.12.0-211.34.1.el10_2.aarch64.rpm
rtla-6.12.0-211.34.1.el10_2.aarch64.rpm
rv-6.12.0-211.34.1.el10_2.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/kernel-6.12.0-211.34.1.el10_2.src.rpm

Related CVEs:

CVE-2025-38653
CVE-2025-68366
CVE-2026-31613
CVE-2026-31709
CVE-2026-43322
CVE-2026-43329
CVE-2026-46243

Description of changes:

[6.12.0-211.34.1]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64

Open62541, doctl, Kernel 7.1.6, Perl Ecosystem, ABRT, and Coreutils updates for Fedora

Libpq, systemd, python3, Thunderbird, Kernel, Ansible, Satellite, and JBoss updates for RHEL

Windows

Linux

macOS

Community

  • gavindi
    Mt. Sync is a native GNOME desktop application that puts ...
  • Lexonight
    Hey everyone,Wanted to share a project I've been b ...
  • SeveG
    need some help here... situationPC= Packard BellOS= win1 ...