Ubuntu alert USN-8674-1 (openjdk-lts)
| From: | noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-8674-1] OpenJDK 11 vulnerabilities | |
| Date: | Wed, 26 Aug 2026 11:00:49 +0000 | |
| Message-ID: | <E1wzBNB-0001GN-PV@lists.ubuntu.com> | |
| Cc: | noreply+usn-bot@canonical.com |
========================================================================== Ubuntu Security Notice USN-8674-1 August 25, 2026 openjdk-lts vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in OpenJDK 11. Software Description: - openjdk-lts: Open Source Java implementation Details: It was discovered that the JSSE component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-46968) It was discovered that the JSSE component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-46917) It was discovered that the ImageIO component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-47010) It was discovered that the 2D component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-47021, CVE-2026-47059) It was discovered that the Libraries component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-47027) It was discovered that the Security component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-60147) It was discovered that the Libraries component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-47063) It was discovered that the Scripting component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-47057, CVE-2026-47058) Lian Owen discovered that the 2D (Little CMS) component of OpenJDK 11 did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-41254) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-... Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS openjdk-11-jdk 11.0.32+9-1ubuntu1~26.04 openjdk-11-jdk-headless 11.0.32+9-1ubuntu1~26.04 openjdk-11-jre 11.0.32+9-1ubuntu1~26.04 openjdk-11-jre-headless 11.0.32+9-1ubuntu1~26.04 openjdk-11-jre-zero 11.0.32+9-1ubuntu1~26.04 Ubuntu 24.04 LTS openjdk-11-jdk 11.0.32+9-1ubuntu1~24.04 openjdk-11-jdk-headless 11.0.32+9-1ubuntu1~24.04 openjdk-11-jre 11.0.32+9-1ubuntu1~24.04 openjdk-11-jre-headless 11.0.32+9-1ubuntu1~24.04 openjdk-11-jre-zero 11.0.32+9-1ubuntu1~24.04 Ubuntu 22.04 LTS openjdk-11-jdk 11.0.32+9-1ubuntu1~22.04 openjdk-11-jdk-headless 11.0.32+9-1ubuntu1~22.04 openjdk-11-jre 11.0.32+9-1ubuntu1~22.04 openjdk-11-jre-headless 11.0.32+9-1ubuntu1~22.04 openjdk-11-jre-zero 11.0.32+9-1ubuntu1~22.04 Ubuntu 20.04 LTS openjdk-11-jdk 11.0.32+9-1ubuntu1~20.04 Available with Ubuntu Pro openjdk-11-jdk-headless 11.0.32+9-1ubuntu1~20.04 Available with Ubuntu Pro openjdk-11-jre 11.0.32+9-1ubuntu1~20.04 Available with Ubuntu Pro openjdk-11-jre-headless 11.0.32+9-1ubuntu1~20.04 Available with Ubuntu Pro openjdk-11-jre-zero 11.0.32+9-1ubuntu1~20.04 Available with Ubuntu Pro Ubuntu 18.04 LTS openjdk-11-jdk 11.0.32+9-1ubuntu1~18.04 Available with Ubuntu Pro openjdk-11-jdk-headless 11.0.32+9-1ubuntu1~18.04 Available with Ubuntu Pro openjdk-11-jre 11.0.32+9-1ubuntu1~18.04 Available with Ubuntu Pro openjdk-11-jre-headless 11.0.32+9-1ubuntu1~18.04 Available with Ubuntu Pro openjdk-11-jre-zero 11.0.32+9-1ubuntu1~18.04 Available with Ubuntu Pro This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any running Java applications to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8674-1 CVE-2026-41254, CVE-2026-46917, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47057, CVE-2026-47058, CVE-2026-47059, CVE-2026-47063, CVE-2026-60147 Package Information: https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.32+... https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.32+... https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.32+...
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmqOxykACgkQcpJm3tlz hgHdnBAAr6t7uYSjLsMU/DR1oVqETWoKQrkTYr6V8FtzvbyXLv6jeCZ+wTOiS3Yj u7fgNyQaBwCY0wMaA4dlgZa6DvrrwWaV1TtkTO70c5DTcyhJmx+3pYYfd0MqIU+7 8iYR1y4/AIbKI/k+LprqKSc+P1gaW/zkA8Tdke/PgHm54w9qZloKtxJbRLkE9f5w HgX2zz6nHuBm62zDcTcO+kBvGbJHBUpD0RQ+sQaH8pfxYzTQWXq1dcYo4zUdrw5B DdaFBLiwK+j+r4fo8l41hctOgDuZ7WmN45ewMV863uPPLxfBnEtXPg1xGShy7AkK pWE1pZFj10WlcYbzI1BO5InM3SD+30/0jTEXG2n0s06h5MeuknRQjius38V6GnE6 aqfUtYfGlubOmoT3kp9Ml3vKWZ8PKVeMOQAuTIH3mB2FnYexlFR54spVkvow4hae fNkCRRFjn+922V/HtTgUMQX5PKClTwkDj67/FPBpuCsh8SRqMWfU4XSF+eY/A0fI 6Vq/urmRnQ4QUHm7H5DomC9MWJth7OjH5AA08t3xhepu3XHSsfAWdkkJOVgPsFkO wYX4KW8rYBUOYttouWAm+qKzqGcZwCGSeghMAfeocSItSjBpYXwrPIo6fIWrqbQ3 i5nhbOqL0Zwp3acNMn69F4JLxJBcgJZIqdptQzMP/aJITlW0GdI= =fdOk -----END PGP SIGNATURE-----