SUSE SLES15: java-1_8_0-openjdk / java-1_8_0-openjdk-demo / etc (SUSE-SU-2026:3623-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3623-1 advisory. Security issues fixed: - CVE-2026-41254: lcms2: Information disclosure or denial of service via integer overflow in CubeSize...

SUSE SLES12: java-1_8_0-openjdk / java-1_8_0-openjdk-demo / etc (SUSE-SU-2026:3622-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3622-1 advisory. - CVE-2026-41254: lcms2: Information disclosure or denial of service via integer overflow in CubeSize bsc1272459. - CVE-2026-46968: unauthorize...

SUSE-SU-2026:3623-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: Security issues fixed: - CVE-2026-41254: lcms2: Information disclosure or denial of service via integer overflow in CubeSize bsc1272459. - CVE-2026-46968: unauthorized creation, deletion or modification access to critical data bsc127222...

SUSE-SU-2026:3622-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: - CVE-2026-41254: lcms2: Information disclosure or denial of service via integer overflow in CubeSize bsc1272459. - CVE-2026-46968: unauthorized creation, deletion or modification access to critical data bsc1272224. - CVE-2026-47010:...

Security Bulletin: Updating Java in Identity Insight 9.0.0.1 for security update

Summary Identity Insight customers are advised to update OpenJDK 8 to version 8.0.502 for the security update in Java. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- IBM InfoSphere...

Security Bulletin: Updating Java in Identity Insight 10.0.0.0 for security update

Summary Identity Insight customers are advised to update OpenJDK 17 to version 17.0.20. for the security update in Java. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- IBM InfoSphere...

java-17-openjdk security update

1:17.0.20.0.8-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.20.0.8-1.1 - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8 - Add .0 to prelease 1:17.0.20.0.8-1.1 - Sync NEWS from private-gnuandrew-rhel-8.5-vanilla 1:17.0.20.0.8-1.1 - Set tzdata requires and build...

Oracle Linux 8 / 9 : java-17-openjdk (ELSA-2026-42887)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42887 advisory. 1:17.0.20.0.8-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.20.0.8-1.1 - Sync java-17-openjdk-portable.specfile from...

Alibaba Cloud Linux 3 : 0248: java-17-openjdk (ALINUX3-SA-2026:0248)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0248 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-66293: LIBPNG is a reference...

Oracle Linux 8 / 9 : java-1.8.0-openjdk (ELSA-2026-42877)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42877 advisory. 1:1.8.0.502.b07-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.502.b07-1.1 - Update to 8u502-b07 GA. - Update release notes for...

Debian dsa-6431 : openjdk-25-dbg - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6431 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6431-1 [email protected] https://www.debian.org/securit...

[SECURITY] [DSA 6431-1] openjdk-25 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6431-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 11, 2026 https://www.debian.org/security/faq -...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

EUVD-2026-55984

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15560 Openjdk-orb: unauthed class loading via iiop in eap

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15560

The CVE-2026-15560 tracks a vulnerability in the openjdk-orb JDKBridge when EAP runs with -secmgr. The issue arises during object unmarshalling where attacker-supplied CDR codebase URLs are honoured, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL ...

CVE-2026-15560 Openjdk-orb: unauthed class loading via iiop in eap

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...