Linux · Security advisory · October 24, 2025

ELSA-2025-18815: Security update for 20 packages

ELSA-2025-18815, released October 24, 2025, fixes 2 CVEs across 20 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0069

53rd percentile

Priority of the 2 CVEs

Patch now 0
                                Urgent 0
                                High 1
                                Routine 1

Fixed package versions

Product	Release	Fixed in
java-1.8.0-openjdk	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-accessibility	ol 8	1:1.8.0.472.b08-1.0.1.el8
java-1.8.0-openjdk-accessibility	ol 9	1:1.8.0.472.b08-1.0.1.el8
java-1.8.0-openjdk-accessibility-fastdebug	ol 8	1:1.8.0.472.b08-1.0.1.el8
java-1.8.0-openjdk-accessibility-fastdebug	ol 9	1:1.8.0.472.b08-1.0.1.el8
java-1.8.0-openjdk-accessibility-slowdebug	ol 8	1:1.8.0.472.b08-1.0.1.el8
java-1.8.0-openjdk-accessibility-slowdebug	ol 9	1:1.8.0.472.b08-1.0.1.el8
java-1.8.0-openjdk-demo	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-demo	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-demo-fastdebug	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-demo-fastdebug	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-demo-slowdebug	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-demo-slowdebug	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-devel	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-devel	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-devel-fastdebug	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-devel-fastdebug	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-devel-slowdebug	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-devel-slowdebug	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-fastdebug	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-fastdebug	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-headless	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-headless	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-headless-fastdebug	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-headless-fastdebug	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-headless-slowdebug	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-headless-slowdebug	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-javadoc	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-javadoc	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-javadoc-zip	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-javadoc-zip	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-slowdebug	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-slowdebug	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-src	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-src	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-src-fastdebug	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-src-fastdebug	ol 9	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-src-slowdebug	ol 8	1:1.8.0.472.b08-1.0.1.el9
java-1.8.0-openjdk-src-slowdebug	ol 9	1:1.8.0.472.b08-1.0.1.el9

CVEs this fix closes

Priority	CVE	Title	Impact	CVSS	EPSS	Exploitation
High	CVE-2025-53066	Java(TM) SE Development Kit 21 and 1 other: Exposure of Sensitive Information to an Unauthorized Actor		7.5	0.0069	None reported
Routine	CVE-2025-53057	Java(TM) SE Development Kit 21 and 1 other: Improper Access Control		5.9	0.0053	None reported

Also fixes CVE-2025-53066

OPENSUSE-SU-2026:20947-1
java-21-openj9 on opensuse-leap 16.0
OPENSUSE-SU-2026:20943-1
java-17-openj9 on opensuse-leap 16.0
openjdk-21-demo 21.0.9+10-1~25.04
openjdk-21-demo on Ubuntu 25.04 (plucky)
openjdk-21-jdk 21.0.9+10-1~25.04
openjdk-21-jdk on Ubuntu 25.04 (plucky)
openjdk-21-jdk-headless 21.0.9+10-1~25.04
openjdk-21-jdk-headless on Ubuntu 25.04 (plucky)
openjdk-21-jre 21.0.9+10-1~25.04
openjdk-21-jre on Ubuntu 25.04 (plucky)
openjdk-21-jre-headless 21.0.9+10-1~25.04
openjdk-21-jre-headless on Ubuntu 25.04 (plucky)
openjdk-21-jre-zero 21.0.9+10-1~25.04
openjdk-21-jre-zero on Ubuntu 25.04 (plucky)

Vendor advisory

https://linux.oracle.com/errata/ELSA-2025-18815.html

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo