Oracle Errata System Oracle Linux 5.11 2026-10-09T07:39:56 Oracle Linux 8 ruby [2.5.9-114] - Fix integer overflow in search_in_range function in regexec.c (CVE-2019-19012). Resolves: RHEL-87505 [2.5.9-113] - Fix REXML ReDoS vulnerability. (CVE-2024-49761) Resolves: RHEL-68515 [2.5.9-112] - Fix ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755. (CVE-2023-36617) Resolves: RHEL-5614 - Fix Buffer overread vulnerability in StringIO. (CVE-2024-27280) Resolves: RHEL-34125 - Fix RCE vulnerability with .rdoc_options in RDoc. (CVE-2024-27281) Resolves: RHEL-34117 - Fix Arbitrary memory address read vulnerability with Regex search. (CVE-2024-27282) Resolves: RHEL-33867 - Fix REXML DoS parsing an XML with many <s in an attribute value. (CVE-2024-35176) Resolves: RHEL-37877 [2.5.9-111] - Fix HTTP response splitting in CGI. Resolves: CVE-2021-33621 - Fix Buffer overrun in String-to-Float conversion. Resolves: CVE-2022-28739 - Fix ReDoS vulnerability in URI. Resolves: CVE-2023-28755 - Fix ReDoS vulnerability in Time. Resolves: CVE-2023-28756 [2.5.9-111] - Fix rdoc parsing of nil text tokens. Resolves: rhbz#2210326 [2.5.9-110] - Fix FTBFS due to an incompatible load directive. - Fix a fiddle import test on an optimized glibc on Power 9. - Fix by adding length limit option for methods that parses date strings. Resolves: CVE-2021-41817 - CGI::Cookie.parse no longer decodes cookie names to prevent spoofing security prefixes in cookie names. Resolves: CVE-2021-41819 [2.5.9-109] - Properly fix command injection vulnerability in Rdoc. Related: CVE-2021-31799 [2.5.9-108] - Fix command injection vulnerability in RDoc. Resolves: CVE-2021-31799 - Fix StartTLS stripping vulnerability in Net::IMAP Resolves: CVE-2021-32066 - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host. Resolves: CVE-2021-31810 [2.5.9-107] - Update to Ruby 2.5.9. * Remove Patch20: ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch; subsumed Resolves: rhbz#1757844 - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address contains leading zero Resolves: rhbz#1950308 [2.5.5-106] - Remove file with non-commercial license from did_you_mean gem. Resolves: rhbz#1846113 rubygem-abrt [0.3.0-4] - Execute test suite unconditionally. - Upload correct sources. [0.3.0-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [0.3.0-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild [0.3.0-1] - Update to abrt 0.3.0. [0.2.0-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild [0.2.0-1] - Update to abrt 0.2.0. [0.1.1-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild [0.1.1-1] - Update to abrt 0.1.1. [0.0.6-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild [0.0.6-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild rubygem-bson [4.3.0-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [4.3.0-1] - Update to bson 4.3.0. - Remove Obsoletes (rhbz#1537219) [4.2.2-3] - Rebuilt for switch to libxcrypt [4.2.2-2] - Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_2.5 [4.2.2-1] - Update to bson 4.2.2. [4.2.1-5] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild [4.2.1-4] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild [4.2.1-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild [4.2.1-2] - Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_2.4 [4.2.1-1] - Update to bson 4.2.1. rubygem-bundler [1.16.1-5] - Fix unexpected code execution in Gemfiles (CVE-2021-43809) Resolves: RHEL-87017 [1.16.1-4] - Fix Bundler dependency confusion. Resolves: CVE-2020-36327 [1.16.1-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [1.16.1-2] - Remove unnecessary executable bit. [1.16.1-1] - Update to Bundler 1.16.1. [1.16.0-1] - Update to Bundler 1.16.0. [1.13.7-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild [1.13.7-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild [1.13.7-1] - Update to Bundler 1.13.7. [1.13.6-1] - Update to Bundler 1.13.6. rubygem-mongo [2.5.1-3] - Fix Data disclosure and denial of service via query-operator injection. (CVE-2026-88030) Resolves: RHEL-259675 [2.5.1-2] - Disable tests to fix FTBFS by dropped MongoDB module. Resolves: rhbz#1710863 [2.5.1-1] - Update to mongo 2.5.1. [2.5.0-1] - Update to mongo 2.5.0. [2.4.3-2] - Escape macros in %changelog [2.4.3-1] - Update to mongo 2.4.3. [2.4.1-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild [2.4.1-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild [2.4.1-1] - Update to mongo 2.4.1. [2.4.0-1] - Update to mongo 2.4.0. rubygem-mysql2 [0.4.10-4] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [0.4.10-3] - Rebuilt for switch to libxcrypt [0.4.10-2] - F-28: rebuild for ruby25 [0.4.10-1] - New upstream release 0.4.10 [0.4.8-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild [0.4.8-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild [0.4.8-1] - New upstream release 0.4.8 (builds against MariaDB 10.2) [0.4.4-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild [0.4.4-2] - Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_2.4 [0.4.4-1] - New upstream release 0.4.4 rubygem-pg [1.0.0-3] - Fix FTBFS with PostgreSQL 10.6 and above. [1.0.0-2] - Assign a random testing port. [1.0.0-1] - Update to pg 1.0.0. [0.21.0-5] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [0.21.0-4] - Rebuilt for switch to libxcrypt [0.21.0-3] - Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_2.5 [0.21.0-2] - Fix failed tests for PostgreSQL-10. [0.21.0-1] - Update to pg 0.21.0. [0.20.0-3] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild [0.20.0-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild IMPORTANT Copyright 2026 Oracle, Inc. CVE-2026-80212 CVE-2026-88030 cpe:/a:oracle:linux:8:10:appstream_base cpe:/a:oracle:linux:8:9:appstream_base cpe:/a:oracle:linux:8::appstream