Alicja Kario discovered that the JSSE component of OpenJDK 11 incorrectly handled RSA padding. An Attacker could possibly use this issue to obtain sensitive information. (CVE-2025-21587) It was discovered that the Compiler component of OpenJDK 11 incorrectly handled compiler transformations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-30691) It was discovered that the 2D component of OpenJDK 11 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-30698) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2025-04-15
End of life: 9/16/2025, Latest version: 24
A flaw was found in the Pack200 archive format in OpenJDK. The NativeUnpack class did not properly validate the memory size when allocating a buffer, potentially leading to an excessive memory allocation and denial of service condition.
End of life: 3/18/2025, Latest version: 23.0.2
It was discovered that readfile() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.
A denial of service flaw was found in the Murmur hash function implementation, as being used by various Java implementations. A specially-crafted set of keys could trigger Murmur hash function collisions, which degrade hash table items insert performance by changing hash table operations complexity from an expected/average O(n) to the worst case O(n^2). Reporters were able to find colliding strings efficiently using equivalent substrings.
As various web application frameworks for Java automatically pre-fill certain arrays with data from the HTTP request (such as GET or POST parameters) for Java web applications, a remote attacker could use this flaw to make the Java virtual machine to use an excessive amount of CPU time by sending a POST request with a large number parameters which hash to the same value.
A different vulnerability than CVE-2012-2739.
References: [1] http://www.openwall.com/lists/oss-security/2012/11/23/4 [2] http://www.ocert.org/advisories/ocert-2012-001.html [3] http://2012.appsec-forum.ch/conferences/#c17 [4] https://www.131002.net/data/talks/appsec12slides.pdf [5] http://asfws12.files.wordpress.com/2012/11/asfws2012-jeanphilippeaumasson-martinbosslet-hashfloodingdosreloaded.pdf
A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.
It was discovered that the Libraries component did not properly restrict the use of privileged annotations. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Pack200 increase loading time due to improper header validation vulnerability in OpenJDK.
Oracle CPU advisory - July 2024: https://www.oracle.com/security-alerts/cpujul2024.html#AppendixJAVA
An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw allows an attacker with access to the container to modify the /etc/passwd and escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
The OpenJDK 11 packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.<br>This release of the Red Hat build of OpenJDK 11 (11.0.24) for portable Linux serves as a replacement for the Red Hat build of OpenJDK 11 (11.0.23) and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.<br>Security Fix(es):<br><li> OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147)</li> <li> OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131)</li> <li> OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138)</li> <li> OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140)</li> <li> OpenJDK: Pack200 increase loading time due to improper header validation (8322106) (CVE-2024-21144)</li> <li> OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
It was found that the ResponseBodyHandlers class implementation in the Networking/HTTP client component of OpenJDK failed to check for special characters embedded in file name parameters. A malicious user able to make a Java application perform an HTTP request to an attacker provided URL could use this flaw to possibly carry out a path traversal attack.
End of life: 9/17/2024, Latest version: 22.0.2
End of life: 9/17/2024, Latest version: 22.0.2
It was discovered that the computeNextExponential() method in the Libraries component of OpenJDK failed to comply with the documentation, returning sometimes negative numbers.
It was discovered that the DOMRSAPSSSignatureMethod and DOMSignatureMethod classes in the Security component of OpenJDK could log private keys used for digital signature in debug logs, possibly leading the exposure of sensitive information to unstrusted parties.
It was discovered that the Libraries component in OpenJDK failed to properly handle ZIP archives that contain a file and directory entry with the same name within the ZIP file. This could lead to integrity issues when extracting data from such archives. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
A flaw was found in the PKIX certification path validation algorithm in the JSSE component of OpenJDK. A malicious remote client could use this flaw to craft a X.509 certificate and cause denial of service in a Java application processing such certificate.
The OpenJDK 8 packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.<br>This release of the Red Hat build of OpenJDK 8 (8u402) for Windows serves as a replacement for the Red Hat build of OpenJDK 8 (8u392) and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.<br>Security Fix(es):<br><li> OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918)</li> <li> OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952)</li> <li> OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919)</li> <li> OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921)</li> <li> OpenJDK: arbitrary Java code execution in Nashorn (8314284) (CVE-2024-20926)</li> <li> OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
End of life: 3/19/2024, Latest version: 21.0.2
End of life: 3/19/2024, Latest version: 21.0.2
A flaw was found in the Serialization component of OpenJDK handled serialization filter. A process-wide filter could have been modified by setting jdk.serialFilter system property at runtime, possibly leading to a bypass of the intended filter during deserialization.
A flaw was found in the way the Hotspot component of OpenJDK processed classes with fields that needed to be written to in Rewriter::scanmethod(). A specially-crafted Java class file could use this flaw to crash Java virtual machine.
It was discovered that the ObjectInputStream class implementation in the Serialization component of OpenJDK did not sufficiently validate data read from the input serialized stream when reading serialized exceptions. A specially-crafted serialized stream could use this flaw to bypass certain deserialization restrictions (defined via jdk.serialFilter system or security property).
It was discovered that the ObjectInputStream class implementation in the Serialization component of OpenJDK did not check superclasses against the deserialization filter (defined via jdk.serialFilter system or security property) in cases when those classes were available locally and not included in the serialized stream. A specially-crafted serialized stream could possibly use this flaw to bypass class deserialization restrictions.
A flaw was found in the way the TIFFFaxDecompressor, TIFFLZWDecompressor, and TIFFPackBitsDecompressor classes implementations in the ImageIO component of OpenJDK handled memory allocations when processing TIFF images. A specially-crafted TIFF image with a small size could cause a Java application to allocate an excessive amount of memory when opened.
A flaw was found in the way the BMPImageReader class implementation in the ImageIO component of OpenJDK preformed memory allocations when reading palette information from BMP images. A specially-crafted BMP file could cause a Java application to consume an excessive amount of memory when opened.
A flaw was found in the Pattern class implementation in the Libraries component of OpenJDK. A specially crated input could cause the Pattern class to raise an unexpected exception while performing regular expression matching, possibly causing a Java application using the class to misbehave.
End of life: 9/19/2023, Latest version: 20.0.2
End of life: 9/19/2023, Latest version: 20.0.2