Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 45. Security issues fixed: - Oracle April 15 2025 CPU (bsc#1242208) * CVE-2025-21587: unauthorized access, deletion and modification of critical data via the JSSE component (bsc#1241274). * CVE-2025-30691: unauthorized access to data via the Compiler component (bsc#1241275). * CVE-2025-30698: unauthorized access to data and ability to cause a partial DoS via the 2D component (bsc#1241276). - IBM Security Update May 2025 * CVE-2025-4447: stack based buffer overflow in Eclipse OpenJ9 through modification of file that is read when the JVM starts (bsc#1243429). Other changes and issues fixed: - Security: * Avoid memory leak during aes cipher initialization operations for IBMJCEPlus and IBMJCEPlusProviders provider. * Changing the default of the com.ibm.security.spnego.msinterop property from true to false. * Deserializing a com.ibm.crypto.provider.rsaprivatecrtkey object causes a java.io.invalidobjectexception to be thrown. * Failed to read private key from a JKS keystore, specified as JCEKS keystore. * HTTPS channel binding support. * Keytool listing PKCS12 keystore issue. * On Linux systems, use gcc11.2 to compile IBM PKCS11 library. * Support has been added to the IBM Java XMLDSigRI security provider for the EdDSA (Edwards-curve Digital Signature Algorithm). * Updates to XDH Key Agreement, AESGCM Algorithms in IBMJCEPlus and IBMJCEPlusFIPS providers. - Class Libraries: * Update timezone information to the latest tzdata2025a. - Java Virtual Machine: * A SIGSEGV/GPF event received while processing verifyerror. * Crash while resolving MethodHandleNatives. * NoSuchMethodException or NoClassDefFoundError when loading classes. - JIT Compiler: * Assert in the JIT Compiler, badILOp. * Reduced MD5 performance.
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for java-1_8_0-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 45. Security issues fixed: - Oracle April 15 2025 CPU (bsc#1242208) * CVE-2025-21587: unauthorized access, deletion and modification of critical data via the JSSE component (bsc#1241274). * CVE-2025-30691: unauthorized access to data via the Compiler component (bsc#1241275). * CVE-2025-30698: unauthorized access to data and ability to cause a partial DoS via the 2D component (bsc#1241276). - IBM Security Update May 2025 * CVE-2025-4447: stack based buffer overflow in Eclipse OpenJ9 through modification of file that is read when the JVM starts (bsc#1243429). Other changes and issues fixed: - Security: * Avoid memory leak during aes cipher initialization operations for IBMJCEPlus and IBMJCEPlusProviders provider. * Changing the default of the com.ibm.security.spnego.msinterop property from true to false. * Deserializing a com.ibm.crypto.provider.rsaprivatecrtkey object causes a java.io.invalidobjectexception to be thrown. * Failed to read private key from a JKS keystore, specified as JCEKS keystore. * HTTPS channel binding support. * Keytool listing PKCS12 keystore issue. * On Linux systems, use gcc11.2 to compile IBM PKCS11 library. * Support has been added to the IBM Java XMLDSigRI security provider for the EdDSA (Edwards-curve Digital Signature Algorithm). * Updates to XDH Key Agreement, AESGCM Algorithms in IBMJCEPlus and IBMJCEPlusFIPS providers. - Class Libraries: * Update timezone information to the latest tzdata2025a. - Java Virtual Machine: * A SIGSEGV/GPF event received while processing verifyerror. * Crash while resolving MethodHandleNatives. * NoSuchMethodException or NoClassDefFoundError when loading classes. - JIT Compiler: * Assert in the JIT Compiler, badILOp. * Reduced MD5 performance.
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1241274
- https://bugzilla.suse.com/1241275
- https://bugzilla.suse.com/1241276
- https://bugzilla.suse.com/1242208
- https://bugzilla.suse.com/1243429
- https://www.suse.com/security/cve/CVE-2025-21587
- https://www.suse.com/security/cve/CVE-2025-30691
- https://www.suse.com/security/cve/CVE-2025-30698
- https://www.suse.com/security/cve/CVE-2025-4447
- https://www.suse.com/support/update/announcement/2025/suse-su-202501770-1/