{"schemaVersion":3,"id":"USN-7882-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"openjdk-lts vulnerabilities\n\nJinfeng Guo discovered that the Security component of OpenJDK 11 did not\ncorrectly handle certain representations of encoded strings. An\nunauthenticated remote attacker could possibly use this issue to modify\nfiles or leak sensitive information. (CVE-2025-53057)\n\nDarius Bohni discovered that the JAXP component of OpenJDK 11 was\nvulnerable to a XML External Entity (XEE) attack. An unauthenticated\nremote attacker could possibly use this issue to modify files or leak\nsensitive information. (CVE-2025-53066)\n\nIn addition to security fixes, the updated packages contain bug fixes, new\nfeatures, and possibly incompatible changes.\n\nPlease see the following for more information:\nhttps://openjdk.org/groups/vulnerability/advisories/2025-10-21","dates":{"published":"2025-11-24T00:52:17.000Z","modified":"2026-04-27T18:26:52.009Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"openjdk-lts","name":"openjdk-lts","label":"openjdk-lts","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openjdk-lts","purlType":"deb","versions":[{"text":"< 11.0.29+7-1ubuntu1~18.04","noFixRecorded":false,"fixedIn":null},{"text":"< 11.0.29+7-1ubuntu1~20.04","noFixRecorded":false,"fixedIn":null},{"text":"< 11.0.29+7-1ubuntu1~22.04","noFixRecorded":false,"fixedIn":null},{"text":"< 11.0.29+7-1ubuntu1~24.04","noFixRecorded":false,"fixedIn":null},{"text":"< 11.0.29+7-1ubuntu1~25.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 11.0.29+7-1ubuntu1~18.04 | < 11.0.29+7-1ubuntu1~20.04 | < 11.0.29+7-1ubuntu1~22.04 | < 11.0.29+7-1ubuntu1~24.04 | < 11.0.29+7-1ubuntu1~25.10","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-7882-1","label":"ubuntu.com/security/notices/USN-7882-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-53057","label":"ubuntu.com/security/CVE-2025-53057","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2025-53066","label":"ubuntu.com/security/CVE-2025-53066","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2025-53057","CVE-2025-53066"],"downstream":[],"duplicates":[],"related":["CVE-2025-53057","CVE-2025-53066"]},"timeline":[{"kind":"published","date":"2025-11-24T00:52:17.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-27T18:26:52.009Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T02:26:46.281Z","stale":false,"partial":false}}