USN-7480-1: OpenJDK 8 vulnerabilities

USN-7480-1: OpenJDK 8 vulnerabilities
6 May 2025

Several security issues were fixed in OpenJDK 8.

Releases

• Ubuntu 25.04
• Ubuntu 24.10
• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 ESM
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM

Packages
openjdk-8 - Open Source Java implementation

Details
Alicja Kario discovered that the JSSE component of OpenJDK 8 incorrectly
handled RSA padding. An Attacker could possibly use this issue to obtain
sensitive information. (CVE-2025-21587)

It was discovered that the Compiler component of OpenJDK 8 incorrectly
handled compiler transformations. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2025-30691)

It was discovered that the 2D component of OpenJDK 8 did not properly
manage memory under certain circumstances. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2025-30698)

In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.

Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2025-04-15

Update instructions
The problem can be corrected by updating your system to the following package versions:

Ubuntu 25.04

• openjdk-8-jdk - 8u452-ga~us1-0ubuntu1~25.04
• openjdk-8-jdk-headless - 8u452-ga~us1-0ubuntu1~25.04
• openjdk-8-jre - 8u452-ga~us1-0ubuntu1~25.04
• openjdk-8-jre-headless - 8u452-ga~us1-0ubuntu1~25.04
• openjdk-8-jre-zero - 8u452-ga~us1-0ubuntu1~25.04
  Ubuntu 24.10
• openjdk-8-jdk - 8u452-ga~us1-0ubuntu1~24.10
• openjdk-8-jdk-headless - 8u452-ga~us1-0ubuntu1~24.10
• openjdk-8-jre - 8u452-ga~us1-0ubuntu1~24.10
• openjdk-8-jre-headless - 8u452-ga~us1-0ubuntu1~24.10
• openjdk-8-jre-zero - 8u452-ga~us1-0ubuntu1~24.10
  Ubuntu 24.04
• openjdk-8-jdk - 8u452-ga~us1-0ubuntu1~24.04
• openjdk-8-jdk-headless - 8u452-ga~us1-0ubuntu1~24.04
• openjdk-8-jre - 8u452-ga~us1-0ubuntu1~24.04
• openjdk-8-jre-headless - 8u452-ga~us1-0ubuntu1~24.04
• openjdk-8-jre-zero - 8u452-ga~us1-0ubuntu1~24.04
  Ubuntu 22.04
• openjdk-8-jdk - 8u452-ga~us1-0ubuntu1~22.04
• openjdk-8-jdk-headless - 8u452-ga~us1-0ubuntu1~22.04
• openjdk-8-jre - 8u452-ga~us1-0ubuntu1~22.04
• openjdk-8-jre-headless - 8u452-ga~us1-0ubuntu1~22.04
• openjdk-8-jre-zero - 8u452-ga~us1-0ubuntu1~22.04
  Ubuntu 20.04
• openjdk-8-jdk - 8u452-ga~us1-0ubuntu1~20.04
• openjdk-8-jdk-headless - 8u452-ga~us1-0ubuntu1~20.04
• openjdk-8-jre - 8u452-ga~us1-0ubuntu1~20.04
• openjdk-8-jre-headless - 8u452-ga~us1-0ubuntu1~20.04
• openjdk-8-jre-zero - 8u452-ga~us1-0ubuntu1~20.04
  Ubuntu 18.04
• openjdk-8-jdk - 8u452-ga~us1-0ubuntu1~18.04
• Available with Ubuntu Pro
• openjdk-8-jdk-headless - 8u452-ga~us1-0ubuntu1~18.04
• Available with Ubuntu Pro
• openjdk-8-jre - 8u452-ga~us1-0ubuntu1~18.04
• Available with Ubuntu Pro
• openjdk-8-jre-headless - 8u452-ga~us1-0ubuntu1~18.04
• Available with Ubuntu Pro
• openjdk-8-jre-zero - 8u452-ga~us1-0ubuntu1~18.04
• Available with Ubuntu Pro
  Ubuntu 16.04
• openjdk-8-jdk - 8u452-ga~us1-0ubuntu1~16.04.1
• Available with Ubuntu Pro
• openjdk-8-jdk-headless - 8u452-ga~us1-0ubuntu1~16.04.1
• Available with Ubuntu Pro
• openjdk-8-jre - 8u452-ga~us1-0ubuntu1~16.04.1
• Available with Ubuntu Pro
• openjdk-8-jre-headless - 8u452-ga~us1-0ubuntu1~16.04.1
• Available with Ubuntu Pro
• openjdk-8-jre-jamvm - 8u452-ga~us1-0ubuntu1~16.04.1
• Available with Ubuntu Pro
• openjdk-8-jre-zero - 8u452-ga~us1-0ubuntu1~16.04.1
• Available with Ubuntu Pro
  This update uses a new upstream release, which includes additional bug
  fixes. After a standard system update you need to restart Java
  applications to make all the necessary changes.