SUSE SLES12 Security Update : java-11-openjdk (SUSE-SU-2025:02563-1)

high Nessus Plugin ID 243265

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02563-1 advisory.

Upgrade to upstream tag jdk-11.0.28+6 (July 2025 CPU):

Security fixes:

- CVE-2025-30749: several scenarios can lead to heap corruption (bsc#1246595)
- CVE-2025-30754: incomplete handshake may lead to weakening TLS protections (bsc#1246598)
- CVE-2025-30761: Improve scripting supports (bsc#1246580)
- CVE-2025-50059: Improve HTTP client header handling (bsc#1246575)
- CVE-2025-50106: Glyph out-of-memory access and crash (bsc#1246584)

Changelog:

- JDK-8026976: ECParameters, Point does not match field size
- JDK-8211400: nsk.share.gc.Memory::getArrayLength returns wrong value
- JDK-8231058: VerifyOops crashes with assert(_offset >= 0) failed: offset for non comment?
- JDK-8232625: HttpClient redirect policy should be more conservative
- JDK-8258483: [TESTBUG] gtest CollectorPolicy.young_scaled_initial_ergo_vm fails if heap is too small
- JDK-8293345: SunPKCS11 provider checks on PKCS11 Mechanism are problematic
- JDK-8296631: NSS tests failing on OL9 linux-aarch64 hosts
- JDK-8301753: AppendFile/WriteFile has differences between make 3.81 and 4+
- JDK-8303770: Remove Baltimore root certificate expiring in May 2025
- JDK-8315380: AsyncGetCallTrace crash in frame::safe_for_sender
- JDK-8327476: Upgrade JLine to 3.26.1
- JDK-8328957: Update PKCS11Test.java to not use hardcoded path
- JDK-8331959: Update PKCS#11 Cryptographic Token Interface to v3.1
- JDK-8339300: CollectorPolicy.young_scaled_initial_ergo_vm gtest fails on ppc64 based platforms
- JDK-8339728: [Accessibility,Windows,JAWS] Bug in the getKeyChar method of the AccessBridge class
- JDK-8345133: Test sun/security/tools/jarsigner/ /TsacertOptionTest.java failed: Warning found in stdout
- JDK-8345625: Better HTTP connections
- JDK-8346887: DrawFocusRect() may cause an assertion failure
- JDK-8347629: Test FailOverDirectExecutionControlTest.java fails with -Xcomp
- JDK-8348110: Update LCMS to 2.17
- JDK-8348596: Update FreeType to 2.13.3
- JDK-8348598: Update Libpng to 1.6.47
- JDK-8348989: Better Glyph drawing
- JDK-8349111: Enhance Swing supports + JDK-8349594: Enhance TLS protocol support + JDK-8350469: [11u] Test AbsPathsInImage.java fails
- JDK-8239429 public clone + JDK-8350498: Remove two Camerfirma root CA certificates + JDK-8350991: Improve HTTP client header handling + JDK-8351099: Bump update version of OpenJDK: 11.0.28 + JDK-8351422: Improve scripting supports + JDK-8352302: Test sun/security/tools/jarsigner/ /TimestampCheck.java is failing + JDK-8352716: (tz) Update Timezone Data to 2025b + JDK-8356096: ISO 4217 Amendment 179 Update + JDK-8356571: Re-enable -Wtype-limits for GCC in LCMS + JDK-8359170: Add 2 TLS and 2 CS Sectigo roots + JDK-8360147: Better Glyph drawing redux

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected java-11-openjdk, java-11-openjdk-demo, java-11-openjdk-devel and / or java-11-openjdk-headless packages.

Plugin Details

Severity: High

ID: 243265

File Name: suse_SU-2025-02563-1.nasl

Version: 1.1

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 8/1/2025

Updated: 8/1/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-50106

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:java-11-openjdk-devel, p-cpe:/a:novell:suse_linux:java-11-openjdk, p-cpe:/a:novell:suse_linux:java-11-openjdk-demo, p-cpe:/a:novell:suse_linux:java-11-openjdk-headless, cpe:/o:novell:suse_linux:12

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 7/31/2025

Vulnerability Publication Date: 7/15/2025

Reference Information

CVE: CVE-2025-30749, CVE-2025-30754, CVE-2025-30761, CVE-2025-50059, CVE-2025-50106

SuSE: SUSE-SU-2025:02563-1

Detections

Analytics