SUSE-SU-2025:03262-1: java-1_8_0-ibm&distro=openSUSE Leap 15.6

Vulnerability summary

SUSE-SU-2025:03262-1 is a vulnerability in java-1_8_0-ibm&distro=openSUSE Leap 15.6 with no CVSS score yet.

Timeline

1. 18-09-2025
   PublishedVulnerability first disclosed.
2. 04-02-2026
   Last modifiedVulnerability information updated.

Description

Security update for java-1_8_0-ibm This update for java-1_8_0-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 50. Security issues fixed: - Oracle July 15 2025 CPU (bsc#1247754). - CVE-2025-30749: heap corruption allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246595). - CVE-2025-30754: incomplete handshake allows unauthenticated attacker with network access via TLS to gain unauthorized update, insert, delete and read access to sensitive data (bsc#1246598). - CVE-2025-30761: issue in the Scripting component allows unauthenticated attacker with network access to gain unauthorized creation, deletion or modification access to critical data (bsc#1246580). - CVE-2025-50059: issue in the Networking component allows unauthenticated attacker with network access to gain unauthorized access to critical data (bsc#1246575). - CVE-2025-50106: Glyph out-of-memory access allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246584). Other issues fixed: - Class Libraries: - Oracle Security Fix 8348989: Better Glyph drawing. - Removal of Baltimore root certificate and TWO CAMERFIRMA root CA certificates from CACERTS. - Update timezone information to the latest TZDATA2025B. - Java Virtual Machine: - Assertion failure at copyforwardscheme.cpp. - JIT Compiler: - GC assert due to an invalid object reference. - SIGILL from JIT compiled method. - Unexpected behaviour with very large arrays. - Security: - Deserialization of a serialized RSAPrivateCrtKey is throwing an exception. - EDDSAsignature fails when doing multiple update. - HTTPS channel binding support. - IBMJCEPlus provider supports post quantum cryptography algorithms ML-KEM (key encapsulation) and ML-DSA (digital signature). - Key certificate management: Extended key usage cannot be set without having key usage extension in certificate request. - MessageDigest.update API does not throw the correct exception. - Oracle Security Fix 8349594: Enhance TLS protocol support. - Problem getting key in PKCS12 keystore on MAC. - TLS support for the EDDSA signature algorithm. - Wrong algorithm name returned for EDDSA keys. - z/OS Extentions: - IBMJCEHybridException with hybrid provider in GCM mode.

No weakness data has been published for this record.