An update of the openjdk21 package has been released.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03262-1 advisory.

    Update to Java 8.0 Service Refresh 8 Fix Pack 50.

    Security issues fixed:

    - Oracle July 15 2025 CPU (bsc#1247754).
    - CVE-2025-30749: heap corruption allows unauthenticated attacker with network access to compromise and     takeover Java       applications that load and run untrusted code (bsc#1246595).
    - CVE-2025-30754: incomplete handshake allows unauthenticated attacker with network access via TLS to gain     unauthorized       update, insert, delete and read access to sensitive data (bsc#1246598).
    - CVE-2025-30761: issue in the Scripting component allows unauthenticated attacker with network access to     gain       unauthorized creation, deletion or modification access to critical data (bsc#1246580).
    - CVE-2025-50059: issue in the Networking component allows unauthenticated attacker with network access to     gain       unauthorized access to critical data (bsc#1246575).
    - CVE-2025-50106: Glyph out-of-memory access allows unauthenticated attacker with network access to     compromise and       takeover Java applications that load and run untrusted code (bsc#1246584).

    Other issues fixed:

    - Class Libraries:
      - Oracle Security Fix 8348989: Better Glyph drawing.
      - Removal of Baltimore root certificate and TWO CAMERFIRMA root         CA certificates from CACERTS.
      - Update timezone information to the latest TZDATA2025B.
    - Java Virtual Machine:
      - Assertion failure at copyforwardscheme.cpp.
    - JIT Compiler:
      - GC assert due to an invalid object reference.
      - SIGILL from JIT compiled method.
      - Unexpected behaviour with very large arrays.
    - Security:
      - Deserialization of a serialized RSAPrivateCrtKey is throwing         an exception.
      - EDDSAsignature fails when doing multiple update.
      - HTTPS channel binding support.
      - IBMJCEPlus provider supports post quantum cryptography algorithms         ML-KEM (key encapsulation) and ML-DSA (digital signature).
      - Key certificate management: Extended key usage cannot be set         without having key usage extension in certificate request.
      - MessageDigest.update API does not throw the correct exception.
      - Oracle Security Fix 8349594: Enhance TLS protocol support.
      - Problem getting key in PKCS12 keystore on MAC.
      - TLS support for the EDDSA signature algorithm.
      - Wrong algorithm name returned for EDDSA keys.
    - z/OS Extentions:
      - IBMJCEHybridException with hybrid provider in GCM mode.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:10873 advisory.

    * JDK: Better Glyph drawing (CVE-2025-30749)
    * JDK: Enhance TLS protocol support (CVE-2025-30754)
    * JDK: Improve HTTP client header handling (CVE-2025-50059)
    * JDK: Better Glyph drawing redux (CVE-2025-50106)

    Bug Fix(es):

    * In Rocky Linux 9 and Rocky Linux 10 systems, the default graphical display system is Wayland. The use of     Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a     screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire     package, which the JDK can use to take screen captures in Wayland systems (Rocky Linux-102683, Rocky     Linux-102684, Rocky Linux-102685)
    * On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the     G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes     that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead     to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion     being used changes mid-operation. This update resolves this issue by always using the same NUMA node and     associated G1AllocRegion object throughout an operation. (Rocky Linux-90307, Rocky Linux-90308, Rocky     Linux-90311)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the SQLcl (jgit) component of Oracle Database Server. Supported versions that are     affected are 23.4-23.9. Difficult to exploit vulnerability allows low privileged attacker having Valid     account privilege with network access via HTTP to compromise SQLcl (jgit). Successful attacks require     human interaction from a person other than the attacker. Successful attacks of this vulnerability can     result in unauthorized access to critical data or complete access to all SQLcl (jgit) accessible data.
    (CVE-2025-4949)

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.19 and 23.4-23.9. Easily exploitable vulnerability allows low privileged attacker     having Authenticated User privilege with logon to the infrastructure where RDBMS (Python) executes to     compromise RDBMS (Python). Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in takeover of RDBMS (Python).
    (CVE-2024-12254, CVE-2024-12718, CVE-2024-6923, CVE-2024-8088, CVE-2025-1795, CVE-2025-4138,     CVE-2025-4330, CVE-2025-4435, CVE-2025-4517)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     19.3-19.28, 21.3-21.19 and 23.4-23.9. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or modification access to critical data or all Java VM     accessible data. (CVE-2025-61881)

  - Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are     affected are 19.3-19.28, 21.3-21.19 and 23.4-23.9. Easily exploitable vulnerability allows unauthenticated     attacker with network access via Bonjour to compromise Portable Clusterware. While the vulnerability is in     Portable Clusterware, attacks may significantly impact additional products (scope change). Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Portable Clusterware     accessible data. (CVE-2025-53047)

  - Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are     affected are 23.4-23.9. Easily exploitable vulnerability allows high privileged attacker having DBA     privilege with network access via Oracle Net to compromise Unified Audit. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Unified Audit     accessible data. (CVE-2025-61749)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-10867 advisory.

    [1:17.0.16.0.8-2.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:17.0.16.0.8-2]
    - Update to jdk-17.0.16+8
    - Add to .gitignore openjdk-17.0.16+8.tar.xz
    - Set updatever to 16
    - Set buildver to 8
    - Update sources to openjdk-17.0.16+8.tar.xz
    - Resolves: RHEL-101793
    - Resolves: RHEL-102273
    - Require tzdata-java 2025b at runtime and for build
    - Set bundled freetype provide version to 2.13.3
    - Set bundled harfbuzz provide version to 10.4.0
    - Set bundled lcms2 provide version to 2.17.0
    - Set bundled libpng provide version to 1.6.47
    - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
    - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:10873 advisory.

    * JDK: Better Glyph drawing (CVE-2025-30749)
      * JDK: Enhance TLS protocol support (CVE-2025-30754)
      * JDK: Improve HTTP client header handling (CVE-2025-50059)
      * JDK: Better Glyph drawing redux (CVE-2025-50106)


    Bug Fix(es):

      * In AlmaLinuxand AlmaLinux systems, the default graphical display system is Wayland. The use of Wayland     in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen     capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire     package, which the JDK can use to take screen captures in Wayland systems (AlmaLinux-102683,     AlmaLinux-102684, AlmaLinux-102685)
      * On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In     the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code     assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling     can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the     G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same     NUMA node and associated G1AllocRegion object throughout an operation. (AlmaLinux-90307, AlmaLinux-90308,     AlmaLinux-90311)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
255217	Photon OS 4.0: Openjdk21 PHSA-2025-4.0-0860	Nessus	PhotonOS Local Security Checks	2025/8/26	2025/8/26	high
265423	SUSE SLES15 / openSUSE 15 Security Update : java-1_8_0-ibm (SUSE-SU-2025:03262-1)	Nessus	SuSE Local Security Checks	2025/9/19	2025/9/19	high
266686	RockyLinux 10 : java-21-openjdk (RLSA-2025:10873)	Nessus	Rocky Linux Local Security Checks	2025/10/6	2025/10/6	high
271256	Oracle Database Server (October 2025 CPU)	Nessus	Databases	2025/10/23	2026/2/24	high
242177	Oracle Linux 8 / 9 : java-17-openjdk (ELSA-2025-10867)	Nessus	Oracle Linux Local Security Checks	2025/7/16	2025/7/17	high
243202	AlmaLinux 10 : java-21-openjdk (ALSA-2025:10873)	Nessus	Alma Linux Local Security Checks	2025/7/30	2025/10/9	high

检测

插件搜索

high

high

high

high

high

high