{"id":"CLSA-2025-1753730595","summary":"java-17-openjdk: Fix of 25 CVEs","details":"- Update to jdk-17.0.15+6\n- Set bundled freetype provide version to 2.13.2\n- Set bundled harfbuzz provide version to 8.2.2\n- Require tzdata-java 2025a at runtime and for build\n- CVE-2025-21502: fix Hotspot component vulnerability allowing unauthorized access\n  to resources and exposure of sensitive information\n- CVE-2025-30698: fix 2D component vulnerability allowing unauthorized data access\n  and partial denial of service\n- CVE-2025-30691: fix Compiler component vulnerability allowing unauthorized data\n  access and modification (CVSS 4.8 Medium)\n- CVE-2025-21587: fix JSSE component vulnerability allowing unauthorized\n  creation/deletion/modification of critical data\n- CVE-2024-20921: fix information disclosure in Hotspot that allows remote attackers\n  to access sensitive data via untrusted input through exposed APIs or sandboxed\n  environments\n- CVE-2024-21235: fix vulnerability in Hotspot that allows remote attackers to read\n  or modify limited data via untrusted input through exposed APIs or sandboxed code\n- CVE-2024-21217: fix vulnerability in Serialization that allows remote attackers to\n  trigger partial denial of service via untrusted input through exposed APIs or\n  sandboxed code\n- CVE-2024-21210: fix vulnerability in Hotspot that allows remote attackers to modify\n  limited data via untrusted input through exposed APIs or sandboxed code.\n- CVE-2024-21208: fix security vulnerability in OpenJDK component\n- CVE-2024-21147: fix Hotspot component vulnerability allowing unauthorized data access\n- CVE-2024-21145: fix 2D component vulnerability allowing unauthorized data access\n- CVE-2024-21144: fix security vulnerability in OpenJDK component\n- CVE-2024-21140: fix Hotspot component vulnerability\n- CVE-2024-21138: fix Hotspot component vulnerability causing partial denial of service\n- CVE-2024-21131: fix vulnerability in Hotspot that allows remote attackers to modify\n  limited data via untrusted input through exposed APIs or sandboxed code\n- CVE-2024-21094: fix Hotspot component vulnerability allowing unauthorized data modification\n- CVE-2024-21085: fix Concurrency component vulnerability causing partial denial of service\n- CVE-2024-21068: fix Hotspot component vulnerability allowing unauthorized data access\n- CVE-2024-21011: fix Hotspot component vulnerability causing partial denial of service\n- CVE-2024-20918: fix information disclosure and data modification in Hotspot via untrusted input\n- CVE-2024-20952: fix information disclosure and data modification in Security via untrusted input\n- CVE-2024-20926: fix information disclosure in Scripting via untrusted input\n- CVE-2023-48161: fix buffer overflow in GifLib’s DumpSCreen2RGB function allowing local attackers\n  to access sensitive information\n- CVE-2023-22025: fix data modification in Hotspot via untrusted input through exposed\n  APIs or sandboxed code\n- CVE-2023-25193: fix O(n^2) growth vulnerability in HarfBuzz's hb-ot-layout-gsubgpos.hh\n  when processing consecutive marks","modified":"2026-05-27T11:35:09.608076156Z","published":"2025-07-28T19:23:19Z","upstream":["CVE-2023-22025","CVE-2023-25193","CVE-2023-48161","CVE-2024-20918","CVE-2024-20921","CVE-2024-20926","CVE-2024-20952","CVE-2024-21011","CVE-2024-21068","CVE-2024-21085","CVE-2024-21094","CVE-2024-21131","CVE-2024-21138","CVE-2024-21140","CVE-2024-21144","CVE-2024-21145","CVE-2024-21147","CVE-2024-21208","CVE-2024-21210","CVE-2024-21217","CVE-2024-21235","CVE-2025-21502","CVE-2025-21587","CVE-2025-30691","CVE-2025-30698"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1753730595.html"}],"affected":[{"package":{"name":"java-17-openjdk","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-demo","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-demo?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-demo-fastdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-demo-fastdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-demo-slowdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-demo-slowdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-devel-fastdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-devel-fastdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-devel-slowdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-devel-slowdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-fastdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-fastdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-headless","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-headless?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-headless-fastdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-headless-fastdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-headless-slowdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-headless-slowdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-javadoc","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-javadoc?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-javadoc-zip","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-javadoc-zip?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-jmods","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-jmods?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-jmods-fastdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-jmods-fastdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-jmods-slowdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-jmods-slowdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-slowdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-slowdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-src","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-src?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-src-fastdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-src-fastdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-src-slowdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-src-slowdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-static-libs","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-static-libs?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-static-libs-fastdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-static-libs-fastdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}},{"package":{"name":"java-17-openjdk-static-libs-slowdebug","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/java-17-openjdk-static-libs-slowdebug?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.0.15.0.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2025-1753730595.json"}}],"schema_version":"1.7.5"}