elsa-2026-42899

oracle_linux

Description

[25.0.4.0.7-1.1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:25.0.4.0.7-1.0] - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188880 - Resolves: RHEL-212293 - Resolves: RHEL-212297 [1:25.0.3.0.9-3.2] - Add family option with name argument to alternatives install lines (OPENJDK-4854) - Resolves: RHEL-211053 [1:25.0.3.0.9-3.1] - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test 'x'' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test 'x'' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155330 - Related: RHEL-156040 - Resolves: RHEL-149785 - Resolves: RHEL-211047 - Resolves: RHEL-211051

Timeline

Published: unknown
Last Modified: unknown

CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "cves": [
    "CVE-2026-41254",
    "CVE-2026-46917",
    "CVE-2026-46968",
    "CVE-2026-47010",
    "CVE-2026-47021",
    "CVE-2026-47027",
    "CVE-2026-47059",
    "CVE-2026-47063",
    "CVE-2026-60147"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "IMPORTANT"
  },
  "description": "[25.0.4.0.7-1.1.0.1]\n- Add Oracle vendor bug URL [Orabug: 34340155]\n\n[1:25.0.4.0.7-1.0]\n- Update to jdk-25.0.4+7 (GA)\n- Update release notes to 25.0.4+7\n- Bump freetype version to 2.14.3 following JDK-8385390\n- Bump giflib version to 6.1.3 following JDK-8384902\n- Bump HarfBuzz version to 14.2.0 following JDK-8385490\n- Bump lcms2 version to 2.19.1 following JDK-8375065  JDK-8383354\n- Bump libpng version to 1.6.58 following JDK-8384495\n- Require tzdata 2026b due to upstream inclusion of JDK-8383175\n- Drop local copy of JDK-8375294 EOPNOTSUPP patch\n- Obsolete old RHEL releases (9.7.0-z, 10.1-z)\n- Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed\n- Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269)\n- Make zone string debug output optional in TestTranslations\n- Sync the copy of the portable specfile with the latest update\n- ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **\n- Resolves: RHEL-188880\n- Resolves: RHEL-212293\n- Resolves: RHEL-212297\n\n[1:25.0.3.0.9-3.2]\n- Add family option with name argument to alternatives install lines (OPENJDK-4854)\n- Resolves: RHEL-211053\n\n[1:25.0.3.0.9-3.1]\n- Cleanup tagging and gating scripts to appease shellcheck:\n- * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.\n- * scripts/builds/check_signatures.sh: Quote variable usage.\n- * scripts/builds/waive_issue.sh: Remove redundant 'test 'x'' usage.\n- * scripts/builds/waive_leapp_issue.sh: Likewise.\n- * scripts/builds/waive_rpminspect.sh: Likewise.\n- * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable.\n- * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test 'x'' usage.\n- Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file\n- Specify portablerelease and rpmrelease (always 0 for portables) in the Release field\n- Add 25u backports of JDK-8347901  JDK-8378713 C2 performance fixes\n- Sync the copy of the portable specfile with the latest update\n- Related: RHEL-155330\n- Related: RHEL-156040\n- Resolves: RHEL-149785\n- Resolves: RHEL-211047\n- Resolves: RHEL-211051",
  "id": "ELSA-2026-42899",
  "ovalId": "oval:com.oracle.elsa:def:202642899",
  "source": "oracle_linux",
  "title": "ELSA-2026-42899:  java-25-openjdk security update (IMPORTANT)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-42899.html"
}

View JSON API Download JSON

elsa-2026-42899

Raw JSON Data