Linux · Security advisory · July 26, 2023

ELSA-2023-4159: Security update for 23 packages

ELSA-2023-4159, released July 26, 2023, fixes 7 CVEs across 23 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
7
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0181
78th percentile

Priority of the 7 CVEs

Patch now 0 Urgent 0 High 1 Routine 6

Fixed package versions

ProductReleaseFixed in
java-17-openjdkol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-demool 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-demo-fastdebugol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-demo-slowdebugol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-develol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-devel-fastdebugol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-devel-slowdebugol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-fastdebugol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-headlessol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-headless-fastdebugol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-headless-slowdebugol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-javadocol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-javadoc-zipol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-jmodsol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-jmods-fastdebugol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-jmods-slowdebugol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-slowdebugol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-srcol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-src-fastdebugol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-src-slowdebugol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-static-libsol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-static-libs-fastdebugol 81:17.0.8.0.7-2.0.1.el8
java-17-openjdk-static-libs-slowdebugol 81:17.0.8.0.7-2.0.1.el8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-25193 openjdk-11-demo: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers totrigger O(n^2) growth via consecutive marks dur... 7.5 0.0181 None reported
Routine CVE-2023-22049 java-1.8.0-ibm-plugin: IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This upda... 3.7 0.0147 None reported
Routine CVE-2023-22044 openjdk-17-demo: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition,Oracle GraalVM for JDK product of Oracle Java... 3.7 0.0137 None reported
Routine CVE-2023-22045 java-1.8.0-openjdk-accessibility-fastdebug: The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Develo... 3.7 0.0132 None reported
Routine CVE-2023-22036 openjdk-11-demo: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition,Oracle GraalVM for JDK product of Oracle Java... 3.7 0.0127 None reported
Routine CVE-2023-22006 openjdk-11-demo: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition,Oracle GraalVM for JDK product of Oracle Java... 3.1 0.0095 None reported
Routine CVE-2023-22041 openjdk-11-demo: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition,Oracle GraalVM for JDK product of Oracle Java... 5.1 0.0048 None reported
Showing 1 to 7 of 7 1