SUSE-SU-2026:3622-1: important: Security update for java-1_8_0-openjdk
SLE-UPDATES
null at suse.de
Mon Aug 17 08:31:38 UTC 2026
# Security update for java-1_8_0-openjdk
Announcement ID: SUSE-SU-2026:3622-1
Release Date: 2026-08-14T17:05:26Z
Rating: important
References:
* bsc#1272224
* bsc#1272225
* bsc#1272227
* bsc#1272228
* bsc#1272233
* bsc#1272234
* bsc#1272235
* bsc#1272236
* bsc#1272237
* bsc#1272459
Cross-References:
* CVE-2026-41254
* CVE-2026-46968
* CVE-2026-47010
* CVE-2026-47021
* CVE-2026-47027
* CVE-2026-47057
* CVE-2026-47058
* CVE-2026-47059
* CVE-2026-47063
* CVE-2026-60147
CVSS scores:
* CVE-2026-41254 ( SUSE ): 2.1
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-41254 ( SUSE ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-41254 ( NVD ): 4.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
* CVE-2026-41254 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-46968 ( SUSE ): 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-46968 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-46968 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-47010 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-47010 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-47010 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-47021 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-47021 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-47021 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-47027 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-47027 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-47027 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-47057 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-47057 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-47057 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-47058 ( SUSE ): 9.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-47058 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-47058 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-47059 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-47059 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-47059 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-47063 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-47063 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-47063 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-60147 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-60147 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-60147 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products:
* SUSE Linux Enterprise High Performance Computing 12 SP5
* SUSE Linux Enterprise Server 12 SP5
* SUSE Linux Enterprise Server 12 SP5 LTSS
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
* SUSE Linux Enterprise Server for SAP Applications 12 SP5
An update that solves 10 vulnerabilities can now be installed.
## Description:
This update for java-1_8_0-openjdk fixes the following issues:
* CVE-2026-41254: lcms2: Information disclosure or denial of service via
integer overflow in CubeSize (bsc#1272459).
* CVE-2026-46968: unauthorized creation, deletion or modification access to
critical data (bsc#1272224).
* CVE-2026-47010: unauthorized update, insert or delete access (bsc#1272225).
* CVE-2026-47021: partial denial of service via multiple network protocols
(bsc#1272227).
* CVE-2026-47027: partial denial of service via multiple network protocols
(bsc#1272228).
* CVE-2026-47057: hang or frequently repeatable crash via multiple network
protocols (bsc#1272233).
* CVE-2026-47058: unauthorized creation, deletion or modification access to
critical data (bsc#1272234).
* CVE-2026-47059: partial denial of service via multiple network protocols
(bsc#1272235).
* CVE-2026-47063: unauthorized creation, deletion or modification access to
critical data (bsc#1272236).
* CVE-2026-60147: unauthorized update, insert or delete access (bsc#1272237).
Changes for java-1_8_0-openjdk:
* Update to version jdk8u502 (icedtea 3.40.0)
* Import of OpenJDK 8 u502 build 07
* JDK-6815126: intermittent SimulResumerTest.java failure
* JDK-8199138: Add RISC-V support to Zero
* JDK-8209362: sun/security/ssl/SSLSocketImpl/ReuseAddr.java failed due to
"BindException: Address already in use (Bind failed)"
* JDK-8246330: Add TLS Tests for Legacy ECDSA curves
* JDK-8249159: Downport test rework for SSLSocketTemplate from JDK-8224650
* JDK-8261235: C1 compilation fails with assert(res->vreg_number() == index)
failed: conversion check
* JDK-8273135: java/awt/color/ICC_ColorSpace/ /MTTransformReplacedProfile.java
crashes in liblcms.dylib with NULLSeek+0x7
* JDK-8274736: Concurrent read/close of SSLSockets causes SSLSessions to be
invalidated unnecessarily
* JDK-8280158: New test from JDK-8274736 failed with/without patch in JDK11u
* JDK-8298873: Update IllegalRecordVersion.java for changes to TLS
implementation
* JDK-8301189: validate-source fails after JDK-8298873
* JDK-8314730: GHA: Drop libfreetype6-dev transitional package in favor of
libfreetype-dev
* JDK-8321489: Update LCMS to 2.16
* JDK-8336451: [11u] GHA macos-13 and macos-15 builders are unable to resolve
local hostname
* JDK-8348110: Update LCMS to 2.17
* JDK-8351359: OperatingSystemMXBean: values from getCpuLoad and
getProcessCpuLoad are stale after 24.8 days (Windows)
* JDK-8363966: GHA: Switch cross-compiling sysroots to Debian trixie
* JDK-8368041: Enhance TLS certificate handling
* JDK-8369996: Testcase java/net/Socket/B8312065.java fails on Mac, AIX and
Solaris
* JDK-8372351: Add 2 WISeKey roots
* JDK-8374058: Enhance JPEG handling
* JDK-8374888: Implement internal test cache to help UserIterCount test
performance
* JDK-8375065: Update LCMS to 2.18
* JDK-8377158: Enhance XBM image support
* JDK-8377498: Improve HttpServer handling
* JDK-8377833: Enhance Jar file processing
* JDK-8378631: Update Zlib Data Compression Library to Version 1.3.2
* JDK-8378687: Improve delegation of HttpURLConnection
* JDK-8379684: Bump update version of OpenJDK: 8u502
* JDK-8380377: [8u] Problem list CAInterop.java#teliarootcav2
* JDK-8380672: Improve certification checking
* JDK-8380689: distrust/Chunghwa.java test fails with a compilation error
* JDK-8380947: Add pull request template
* JDK-8381039: Enhance AWT ImagingLib
* JDK-8381049: Enhance Jar handling
* JDK-8381185: Improve Nashorn index handling
* JDK-8381195: Enhance Dataview Implementation
* JDK-8381519: Enhance Der Value Handling
* JDK-8381796: Enhance Certificate parsing
* JDK-8383175: (tz) Update Timezone Data to 2026b
* JDK-8383354: Update LCMS to 2.19.1
* JDK-8383473: Follow on from tzdata2026b time change to include temporary
hack BC time change
* JDK-8384158: GHA: Downgrade Windows GHA runners to windows-2022 temporarily
* AArch32 port
* JDK-8385332: aarch32 started to crash after 8261235
* Drop broken classes.jsa (embedded build path failed java -Xshare:on
-version)
* Unset CFLAGS/CXXFLAGS after configure to avoid warnings
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server 12 SP5 LTSS
zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-3622=1
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-3622=1
## Package List:
* SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* java-1_8_0-openjdk-headless-1.8.0.502-27.131.1
* java-1_8_0-openjdk-demo-1.8.0.502-27.131.1
* java-1_8_0-openjdk-debuginfo-1.8.0.502-27.131.1
* java-1_8_0-openjdk-1.8.0.502-27.131.1
* java-1_8_0-openjdk-devel-1.8.0.502-27.131.1
* java-1_8_0-openjdk-debugsource-1.8.0.502-27.131.1
* java-1_8_0-openjdk-devel-debuginfo-1.8.0.502-27.131.1
* java-1_8_0-openjdk-headless-debuginfo-1.8.0.502-27.131.1
* java-1_8_0-openjdk-demo-debuginfo-1.8.0.502-27.131.1
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)
* java-1_8_0-openjdk-1.8.0.502-27.131.1
* java-1_8_0-openjdk-demo-1.8.0.502-27.131.1
* java-1_8_0-openjdk-devel-1.8.0.502-27.131.1
* java-1_8_0-openjdk-headless-1.8.0.502-27.131.1
* java-1_8_0-openjdk-debuginfo-1.8.0.502-27.131.1
* java-1_8_0-openjdk-debugsource-1.8.0.502-27.131.1
* java-1_8_0-openjdk-devel-debuginfo-1.8.0.502-27.131.1
* java-1_8_0-openjdk-headless-debuginfo-1.8.0.502-27.131.1
* java-1_8_0-openjdk-demo-debuginfo-1.8.0.502-27.131.1
## References:
* https://www.suse.com/security/cve/CVE-2026-41254.html
* https://www.suse.com/security/cve/CVE-2026-46968.html
* https://www.suse.com/security/cve/CVE-2026-47010.html
* https://www.suse.com/security/cve/CVE-2026-47021.html
* https://www.suse.com/security/cve/CVE-2026-47027.html
* https://www.suse.com/security/cve/CVE-2026-47057.html
* https://www.suse.com/security/cve/CVE-2026-47058.html
* https://www.suse.com/security/cve/CVE-2026-47059.html
* https://www.suse.com/security/cve/CVE-2026-47063.html
* https://www.suse.com/security/cve/CVE-2026-60147.html
* https://bugzilla.suse.com/show_bug.cgi?id=1272224
* https://bugzilla.suse.com/show_bug.cgi?id=1272225
* https://bugzilla.suse.com/show_bug.cgi?id=1272227
* https://bugzilla.suse.com/show_bug.cgi?id=1272228
* https://bugzilla.suse.com/show_bug.cgi?id=1272233
* https://bugzilla.suse.com/show_bug.cgi?id=1272234
* https://bugzilla.suse.com/show_bug.cgi?id=1272235
* https://bugzilla.suse.com/show_bug.cgi?id=1272236
* https://bugzilla.suse.com/show_bug.cgi?id=1272237
* https://bugzilla.suse.com/show_bug.cgi?id=1272459
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20260817/a90f6ba4/attachment.htm>
More information about the sle-updates
mailing list