# ELSA-2023-4158: Security update for 23 packages ELSA-2023-4158, released July 26, 2023, fixes 6 CVEs across 23 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/elsa-2023-4158 - Platform: Linux - Released: Jul 26, 2023 - Priority: High (Closes CVE-2023-25193, high severity) - CVEs: 6, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://linux.oracle.com/errata/ELSA-2023-4158.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [java-11-openjdk](https://patchblox.com/security/data/product/linux/java-11-openjdk.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-demo](https://patchblox.com/security/data/product/linux/java-11-openjdk-demo.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-demo-fastdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-demo-fastdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-demo-slowdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-demo-slowdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-devel](https://patchblox.com/security/data/product/linux/java-11-openjdk-devel.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-devel-fastdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-devel-fastdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-devel-slowdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-devel-slowdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-fastdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-fastdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-headless](https://patchblox.com/security/data/product/linux/java-11-openjdk-headless.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-headless-fastdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-headless-fastdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-headless-slowdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-headless-slowdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-javadoc](https://patchblox.com/security/data/product/linux/java-11-openjdk-javadoc.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-javadoc-zip](https://patchblox.com/security/data/product/linux/java-11-openjdk-javadoc-zip.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-jmods](https://patchblox.com/security/data/product/linux/java-11-openjdk-jmods.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-jmods-fastdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-jmods-fastdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-jmods-slowdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-jmods-slowdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-slowdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-slowdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-src](https://patchblox.com/security/data/product/linux/java-11-openjdk-src.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-src-fastdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-src-fastdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-src-slowdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-src-slowdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-static-libs](https://patchblox.com/security/data/product/linux/java-11-openjdk-static-libs.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-static-libs-fastdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-static-libs-fastdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | | [java-11-openjdk-static-libs-slowdebug](https://patchblox.com/security/data/product/linux/java-11-openjdk-static-libs-slowdebug.md) | ol 9 | 1:11.0.20.0.8-2.0.1.el9 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2023-25193](https://patchblox.com/security/data/cve/CVE-2023-25193.md) | High | openjdk-11-demo: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers totrigger O(n^2) growth via consecutive marks dur... | 7.5 | 0.0181 | | | [CVE-2023-22049](https://patchblox.com/security/data/cve/CVE-2023-22049.md) | Routine | java-1.8.0-ibm-plugin: IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This upda... | 3.7 | 0.0147 | | | [CVE-2023-22045](https://patchblox.com/security/data/cve/CVE-2023-22045.md) | Routine | java-1.8.0-openjdk-accessibility-fastdebug: The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Develo... | 3.7 | 0.0132 | | | [CVE-2023-22036](https://patchblox.com/security/data/cve/CVE-2023-22036.md) | Routine | openjdk-11-demo: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition,Oracle GraalVM for JDK product of Oracle Java... | 3.7 | 0.0127 | | | [CVE-2023-22006](https://patchblox.com/security/data/cve/CVE-2023-22006.md) | Routine | openjdk-11-demo: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition,Oracle GraalVM for JDK product of Oracle Java... | 3.1 | 0.0095 | | | [CVE-2023-22041](https://patchblox.com/security/data/cve/CVE-2023-22041.md) | Routine | openjdk-11-demo: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition,Oracle GraalVM for JDK product of Oracle Java... | 5.1 | 0.0048 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo