SUSE Package Hub - openSUSE-2025-354

Update Info

openSUSE-2025-354

Security update for java-17-openj9

Type: security

Severity: important

Issued: 2025-09-15

Description:

This update for java-17-openj9 fixes the following issues:

Update to OpenJDK 17.0.16 with OpenJ9 0.53.0 virtual machine
Including Oracle July 2025 CPU changes

  * CVE-2025-30749 (boo#1246595), CVE-2025-30754 (boo#1246598),
    CVE-2025-50059 (boo#1246575), CVE-2025-50106 (boo#1246584)
  * OpenJ9 changes, see
    https://www.eclipse.org/openj9/docs/version0.53/

Update to OpenJDK 17.0.15 with OpenJ9 0.51.0 virtual machine

Including Oracle April 2025 CPU changes

  * CVE-2025-21587 (boo#1241274), CVE-2025-30691 (boo#1241275),
    CVE-2025-30698 (boo#1241276)
  * OpenJ9 changes, see
    https://www.eclipse.org/openj9/docs/version0.51/

References

CVE: CVE-2025-50106
CVE: CVE-2025-50059
CVE: CVE-2025-30754
CVE: CVE-2025-30749
CVE: CVE-2025-30698
CVE: CVE-2025-30691
CVE: CVE-2025-21587
Bugzilla: 1246806 trackerbug: packages embed rebuild-counter
Bugzilla: 1246598 VUL-0: CVE-2025-30754: java-10-openjdk,java-11-openjdk,java-17-openjdk,java-1_7_0-openjdk,java-1_8_0-ibm,java-1_8_0-openj9,java-1_8_0-openjdk,java-21-openjdk,java-9-openjdk: openjdk: incomplete handshake may lead to weakening TLS protections
Bugzilla: 1246595 VUL-0: CVE-2025-30749: java-10-openjdk,java-11-openjdk,java-17-openjdk,java-1_7_0-openjdk,java-1_8_0-ibm,java-1_8_0-openj9,java-1_8_0-openjdk,java-21-openjdk,java-9-openjdk: openjdk: several scenarios can lead to heap corruption
Bugzilla: 1246584 VUL-0: CVE-2025-50106: java-10-openjdk,java-11-openjdk,java-17-openjdk,java-1_7_0-openjdk,java-1_8_0-ibm,java-1_8_0-openj9,java-1_8_0-openjdk,java-21-openjdk,java-9-openjdk: openjdk: Glyph out-of-memory access and crash (Oracle CPU 2025-07)
Bugzilla: 1246575 VUL-0: CVE-2025-50059: java-10-openjdk,java-11-openjdk,java-17-openjdk,java-1_7_0-openjdk,java-1_8_0-ibm,java-1_8_0-openj9,java-1_8_0-openjdk,java-21-openjdk,java-9-openjdk: openjdk: Improve HTTP client header handling (Oracle CPU 2025-07)
Bugzilla: 1241276 VUL-0: CVE-2025-30698: java-11-openjdk,java-17-openjdk,java-1_8_0-openj9,java-1_8_0-openjdk,java-21-openjdk: openjdk: Oracle Java 2D unauthorized data access and DoS
Bugzilla: 1241275 VUL-0: CVE-2025-30691: java-21-openjdk: openjdk: Oracle Java SE Compiler Unauthorized Data Access
Bugzilla: 1241274 VUL-0: CVE-2025-21587: java-11-openjdk,java-17-openjdk,java-1_7_0-openjdk,java-1_8_0-openj9,java-1_8_0-openjdk,java-21-openjdk: openjdk: JSSE unauthorized access, deletion or modification of critical data
Bugzilla: 1235844 [Build 20250108-SELinux] java-*-openj9: openQA test fails in java because it requests execstack permission, which is not needed

Packages

java-17-openj9-17.0.16.0-bp157.2.3.1