Ubuntu alert USN-7902-1 (openjdk-25-crac)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7902-1] CRaC JDK 25 vulnerabilities
Date:
             
 
Tue, 02 Dec 2025 01:57:27 +0000
Message-ID:
             
 
<E1vQFdv-000520-R0@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7902-1
December 01, 2025

openjdk-25-crac vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10

Summary:

Several security issues were fixed in CRaC JDK 25.

Software Description:
- openjdk-25-crac: Open Source Java implementation with Coordinated Restore at Checkpoints

Details:

Jinfeng Guo discovered that the Security component of CRaC JDK 25 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)

Darius Bohni discovered that the JAXP component of CRaC JDK 25 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)

Yakov Shafranovich discovered that the Libraries component of CRaC JDK
25 contained an issue where certain Strings built with StringBuilder
returned an incorrect result for String.equals() checks. An unauthenticated
remote attacker could possibly use this issue to update, insert, or
delete accessible data. (CVE-2025-61748)

In addition to security fixes, the updated packages contain bug fixes,
new features, and possibly incompatible changes.

Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2025-...

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  openjdk-25-crac-jdk             25.0.1+8-0ubuntu1~25.10
  openjdk-25-crac-jdk-headless    25.0.1+8-0ubuntu1~25.10
  openjdk-25-crac-jre             25.0.1+8-0ubuntu1~25.10
  openjdk-25-crac-jre-headless    25.0.1+8-0ubuntu1~25.10
  openjdk-25-crac-jre-zero        25.0.1+8-0ubuntu1~25.10

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java
applications to make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7902-1
  CVE-2025-53057, CVE-2025-53066, CVE-2025-61748

Package Information:
  https://launchpad.net/ubuntu/+source/openjdk-25-crac/25.0...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmkuRwIACgkQcpJm3tlz
hgFkwQ//evEwJpxBESotF+XiHopDpdbzWAWLZmH/zgyblbx8R140HFRVgLqXD2DU
2hrhYmoKMX4LotzHvPxs1xkCkWRwT+fHQ4oK1VbRVvhGvAvkh/nsqN3XgPchpANp
9bLRcTLZ0LbMxRekn07LAMKos7bmvinxVxdpiWpxLrbEPJ0xriR3No1ZsBaNn+M3
NQBvRJKaIXtkyeNyJ372jX3vtTBeAP0xxuPmqR0DWcsQaXjZ/JAs4ZPhFTMcj6HF
IU1Gun89EOADkqpeDyAJ4xfqKOlQ6jFt3C+GPO1jJ1AIL5J518sEcUFcc73w4rKe
kh5Hhm4lElCI1Tv1d2s+YLk5ma8lSFgYVWZNr1sKICsWOEj0QQ/wCyZAHL3OQ3fg
NZZFMtVrDsanMSe7V2K2VtLrPN3BvdJFnpk4uIblDl3dS8H2a23iWEJQ0/1ds4UY
gkljDq9PwopNsuJMwvy5/II7eKfTm+oK1x/l48B8cAs7A10esUXWcJhQ6aZj3pWH
7As/jAoQBfGqnRSdZ/nu/OPvGz5ECVDBVbMzFJncUnxLVQpCyAzWocmlOgoTYnMA
j7EBuJsy/dg4qhuJtSbSYNrglv6r98e9b85eMgZiGvFJIrQ4RN0+KO9GXWNFHcch
BKYTVrgQaAREUE6r93doVJlj1HV1rqRaJVTBpFW97hWQ6XFGou0=
=ARXe
-----END PGP SIGNATURE-----