Summary
Jinfeng Guo discovered that the Security component of OpenJDK 17 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 17 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2025-10-21
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | openjdk-17 | 17.0.17+10-1~22.04 |
| Ubuntu · 24.04 LTS 24.04:LTS | openjdk-17 | 17.0.17+10-1~24.04 |
| Ubuntu · 25.10 | openjdk-17 | 17.0.17+10-1~25.10 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | openjdk-17 | 17.0.17+10-1~18.04 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | openjdk-17 | 17.0.17+10-1~20.04 |
Vulnerabilities 2
-
High 7.5
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 5.9
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…