Ubuntu: OpenJDK 25 Important Security Fix for USN-7884-1

ubuntu

November 25, 2025

Several security issues were fixed in OpenJDK 25.

Summary

Several security issues were fixed in OpenJDK 25.

Software Description:

- openjdk-25: Open Source Java implementation

Details:

Jinfeng Guo discovered that the Security component of OpenJDK 25 did not

correctly handle certain representations of encoded strings. An

unauthenticated remote attacker could possibly use this issue to modify

files or leak sensitive information. (CVE-2025-53057)

Darius Bohni discovered that the JAXP component of OpenJDK 25 was

vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote

attacker could possibly use this issue to modify files or leak sensitive

information. (CVE-2025-53066)

Yakov Shafranovich discovered that the Libraries component of OpenJDK 21

contained an issue where certain Strings built with StringBuilder returned

an incorrect result for String.equals() checks. An unauthenticated remote

attacker could possibly use this issue to update, insert, or delete

accessible data. (CVE-2025-61748)

In addition to security fixes,...

Read the Full Advisory

Topics Covered

security advisory information leak remote access Ubuntu important openjdk

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  openjdk-25-jdk                  25.0.1+8-1~25.10
  openjdk-25-jdk-headless         25.0.1+8-1~25.10
  openjdk-25-jre                  25.0.1+8-1~25.10
  openjdk-25-jre-headless         25.0.1+8-1~25.10
  openjdk-25-jre-zero             25.0.1+8-1~25.10

Ubuntu 25.04
  openjdk-25-jdk                  25.0.1+8-1~25.04
  openjdk-25-jdk-headless         25.0.1+8-1~25.04
  openjdk-25-jre                  25.0.1+8-1~25.04
  openjdk-25-jre-headless         25.0.1+8-1~25.04
  openjdk-25-jre-zero             25.0.1+8-1~25.04

Ubuntu 24.04 LTS
  openjdk-25-jdk                  25.0.1+8-1~24.04
  openjdk-25-jdk-headless         25.0.1+8-1~24.04
  openjdk-25-jre                  25.0.1+8-1~24.04
  openjdk-25-jre-headless         25.0.1+8-1~24.04
  openjdk-25-jre-zero             25.0.1+8-1~24.04

Ubuntu 22.04 LTS
  openjdk-25-jdk                  25.0.1+8-1~22.04
  openjdk-25-jdk-headless         25.0.1+8-1~22.04
  openjdk-25-jre                  25.0.1+8-1~22.04
  openjdk-25-jre-headless         25.0.1+8-1~22.04
  openjdk-25-jre-zero             25.0.1+8-1~22.04

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java applications
to make all the necessary changes.