Oracle Errata System Oracle Linux 5.11 2026-09-03T19:55:19 Oracle Linux 10 [2:1.35-13] - Backport upstream patches for CVE-2026-18477, fixes a bug where incremental restore with cyclic renames between backups may create a temporary directory at an archive-controlled path outside the extraction tree. The fix for CVE-2025-45582 already prevents exploiting this problem, so it is more a correctness and hardening change. [2:1.35-12] - Backport upstream fix for CVE-2026-5704 (file injection hidden from -t) - Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix) Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks). - Upstream fix for build with libacl 2.4.0 MODERATE Copyright 2026 Oracle, Inc. CVE-2026-18477 CVE-2026-18508 CVE-2026-5704 cpe:/o:oracle:linux:10:2:baseos_patch cpe:/o:oracle:linux:10::baseos_latest