MGASA-2026-0572: Updated java-latest-openjdk, timezone, java-21-openjdk, java-17-openjdk packages fix security vulnerabilities
Enhance PKCS5 padding. (CVE-2026-83374) Enhance TLS certificate handling. (CVE-2026-83376) Improve C2 loop transformations. (CVE-2026-83378) Enhance LDAP logins. (CVE-2026-83380) Enhance SASL Authentication. (CVE-2026-83381) Enhance WebRowSets. (CVE-2026-83387) Enhance HTTP Client Response Handling. (CVE-2026-83395) Enhance XML Processing. (CVE-2026-83400) Enhance XPath Expressions. (CVE-2026-87290) Enhance HTTP Server. (CVE-2026-87291) Enhance Network Clients. (CVE-2026-87292) Enhance Certificate Name Checks. (CVE-2026-87294) Enhance Template Handling. (CVE-2026-87367) Enhance HTTP Client. (CVE-2026-91332) Improve ciphertext handling. (CVE-2026-91333) Enhance JPEG loading. (CVE-2026-91334) Enhance Image Handling. (CVE-2026-91335) Enhance TLS handshakes. (CVE-2026-91373) Enhance jstatd. (CVE-2026-91374) Enhance jmod handling. (CVE-2026-91375) Enhance JShell. (CVE-2026-91379) Enhance Preferences. (CVE-2026-91380) Enhance HTTP client caching. (CVE-2026-91394) Enhance diagnostic sessions. (CVE-2026-91397) Enhance SOCKS5 support. (CVE-2026-91398) Enhance MIDI file handling. (CVE-2026-91400) Enhance zipfs. (CVE-2026-91410) Enhance font rendering. (CVE-2026-91415) Enhance GIF loading. (CVE-2026-91418) Enhance HTTP server parsing. (CVE-2026-91451) Enhance HTTP server. (CVE-2026-91452) Improve HTTP headers. (CVE-2026-91453) Enhance TLS Extensions. (CVE-2026-91461) Enhance krb5 tokens. (CVE-2026-91462) Enhance krb5 client. (CVE-2026-91463) Enhance Kerberos validation. (CVE-2026-91464) Enhance C2 comparisons. (CVE-2026-91487) Enhance Certificate Constraint Checking. (CVE-2026-101516)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
- CVE-2026-101516
- CVE-2026-83374
- CVE-2026-83376
- CVE-2026-83378
- CVE-2026-83380
- CVE-2026-83381
- CVE-2026-83387
- CVE-2026-83395
- CVE-2026-83400
- CVE-2026-87290
- CVE-2026-87291
- CVE-2026-87292
- CVE-2026-87294
- CVE-2026-87367
- CVE-2026-91332
- CVE-2026-91333
- CVE-2026-91334
- CVE-2026-91335
- CVE-2026-91373
- CVE-2026-91374
- CVE-2026-91375
- CVE-2026-91379
- CVE-2026-91380
- CVE-2026-91394
- CVE-2026-91397
- CVE-2026-91398
- CVE-2026-91400
- CVE-2026-91410
- CVE-2026-91415
- CVE-2026-91418
- CVE-2026-91451
- CVE-2026-91452
- CVE-2026-91453
- CVE-2026-91461
- CVE-2026-91462
- CVE-2026-91463
- CVE-2026-91464
- CVE-2026-91487
Frequently Asked Questions
Which systems should be prioritized for review?
Review Mageia systems with java-17-openjdk, java-21-openjdk, java-latest-openjdk, or timezone installed. The advisory groups security fixes for all four packages.
Does the advisory identify exploit prerequisites or affected default configurations?
No. The supplied advisory information lists the affected components and CVEs but does not state attacker prerequisites, exposure conditions, or whether default configurations are affected.
Can I determine from this advisory alone whether an installed package version is fixed?
No. The supplied information does not include affected or fixed package version numbers. Package inventory can identify systems using the named packages, but version-level patch status requires additional package update information.