Ubuntu 25.10: OpenJDK 21 Critical Remote Attack Threat USN-7885-1

ubuntu

November 25, 2025

Several security issues were fixed in OpenJDK 21.

Summary

Several security issues were fixed in OpenJDK 21.

Software Description:

- openjdk-21: Open Source Java implementation

Details:

Jinfeng Guo discovered that the Security component of OpenJDK 21 did not

correctly handle certain representations of encoded strings. An

unauthenticated remote attacker could possibly use this issue to modify

files or leak sensitive information. (CVE-2025-53057)

Darius Bohni discovered that the JAXP component of OpenJDK 21 was

vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote

attacker could possibly use this issue to modify files or leak sensitive

information. (CVE-2025-53066)

Yakov Shafranovich discovered that the Libraries component of OpenJDK 21

contained an issue where certain Strings built with StringBuilder returned

an incorrect result for String.equals() checks. An unauthenticated remote

attacker could possibly use this issue to update, insert, or delete

accessible data. (CVE-2025-61748)

In addition to security fixes, ...

Read the Full Advisory

Topics Covered

security advisory information leak critical remote attack Ubuntu openjdk

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  openjdk-21-jdk                  21.0.9+10-1~25.10
  openjdk-21-jdk-headless         21.0.9+10-1~25.10
  openjdk-21-jre                  21.0.9+10-1~25.10
  openjdk-21-jre-headless         21.0.9+10-1~25.10
  openjdk-21-jre-zero             21.0.9+10-1~25.10

Ubuntu 25.04
  openjdk-21-jdk                  21.0.9+10-1~25.04
  openjdk-21-jdk-headless         21.0.9+10-1~25.04
  openjdk-21-jre                  21.0.9+10-1~25.04
  openjdk-21-jre-headless         21.0.9+10-1~25.04
  openjdk-21-jre-zero             21.0.9+10-1~25.04

Ubuntu 24.04 LTS
  openjdk-21-jdk                  21.0.9+10-1~24.04
  openjdk-21-jdk-headless         21.0.9+10-1~24.04
  openjdk-21-jre                  21.0.9+10-1~24.04
  openjdk-21-jre-headless         21.0.9+10-1~24.04
  openjdk-21-jre-zero             21.0.9+10-1~24.04

Ubuntu 22.04 LTS
  openjdk-21-jdk                  21.0.9+10-1~22.04
  openjdk-21-jdk-headless         21.0.9+10-1~22.04
  openjdk-21-jre                  21.0.9+10-1~22.04
  openjdk-21-jre-headless         21.0.9+10-1~22.04
  openjdk-21-jre-zero             21.0.9+10-1~22.04

Ubuntu 20.04 LTS
  openjdk-21-jdk                  21.0.9+10-1~20.04
                                  Available with Ubuntu Pro
  openjdk-21-jdk-headless         21.0.9+10-1~20.04
                                  Available with Ubuntu Pro
  openjdk-21-jre                  21.0.9+10-1~20.04
                                  Available with Ubuntu Pro
  openjdk-21-jre-headless         21.0.9+10-1~20.04
                                  Available with Ubuntu Pro
  openjdk-21-jre-zero             21.0.9+10-1~20.04
                                  Available with Ubuntu Pro

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java applications
to make all the necessary changes.