Summary
It was discovered that the JSSE component of OpenJDK 25 did not correctly
authenticate users. A remote attacker could possibly use this issue to read or
modify sensitive data. (CVE-2026-46968)
It was discovered that the JSSE component of OpenJDK 25 did not correctly
authorize users. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2026-46917)
It was discovered that the ImageIO component of OpenJDK 25 did not correctly
authorize users. A remote attacker could possibly use this issue to read or
modify sensitive data. (CVE-2026-47010)
It was discovered that the 2D component of OpenJDK 25 did not correctly
authorize users. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2026-47021, CVE-2026-47059)
It was discovered that the Libraries component of OpenJDK 25 did not correctly
authorize users. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2026-47027)
It was discovered that the Security component of OpenJDK 25 did not correctly
authenticate users. A remote attacker could possibly use this issue to read or
modify sensitive data. (CVE-2026-60147)
It was discovered that the Libraries component of OpenJDK 25 did not correctly
authenticate users. A remote attacker could possibly use this issue to read or
modify sensitive data. (CVE-2026-47063)
Lian Owen discovered that the 2D (Little CMS) component of OpenJDK 25 did not
correctly handle certain integer arithmetic. An attacker could possibly use
this issue to cause a denial of service. (CVE-2026-41254)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | openjdk-25 | 25.0.4+7-1~22.04 |
| Ubuntu · 24.04 LTS 24.04:LTS | openjdk-25 | 25.0.4+7-1~24.04 |
| Ubuntu · 26.04 LTS 26.04:LTS | openjdk-25 | 25.0.4+7-1~26.04 |
Vulnerabilities 9
-
High 7.5
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 6.5
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 5.9
Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u49…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 5.3
Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491,…
-
Medium 4.0
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
References
-
report
https://ubuntu.com/security/CVE-2026-41254
-
report
https://ubuntu.com/security/CVE-2026-46917
-
report
https://ubuntu.com/security/CVE-2026-46968
-
report
https://ubuntu.com/security/CVE-2026-47010
-
report
https://ubuntu.com/security/CVE-2026-47021
-
report
https://ubuntu.com/security/CVE-2026-47027
-
report
https://ubuntu.com/security/CVE-2026-47059
-
report
https://ubuntu.com/security/CVE-2026-47063
-
report
https://ubuntu.com/security/CVE-2026-60147