QSN-8674-1: OpenJDK 11 vulnerabilities
2026-08-25

Summary:
Several security issues were fixed in OpenJDK 11.

Details:
It was discovered that the JSSE component of OpenJDK 11 did not correctly
authenticate users. A remote attacker could possibly use this issue to read
or modify sensitive data. (CVE-2026-46968)

It was discovered that the JSSE component of OpenJDK 11 did not correctly
authorize users. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2026-46917)

It was discovered that the ImageIO component of OpenJDK 11 did not
correctly authorize users. A remote attacker could possibly use this issue
to read or modify sensitive data. (CVE-2026-47010)

It was discovered that the 2D component of OpenJDK 11 did not correctly
authorize users. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2026-47021, CVE-2026-47059)

It was discovered that the Libraries component of OpenJDK 11 did not
correctly authorize users. A remote attacker could possibly use this issue
to cause a denial of service. (CVE-2026-47027)

It was discovered that the Security component of OpenJDK 11 did not
correctly authenticate users. A remote attacker could possibly use this
issue to read or modify sensitive data. (CVE-2026-60147)

It was discovered that the Libraries component of OpenJDK 11 did not
correctly authenticate users. A remote attacker could possibly use this
issue to read or modify sensitive data. (CVE-2026-47063)

It was discovered that the Scripting component of OpenJDK 11 did not
correctly authenticate users. A remote attacker could possibly use this
issue to cause a denial of service or to read or modify sensitive data.
(CVE-2026-47057, CVE-2026-47058)

Lian Owen discovered that the 2D (Little CMS) component of OpenJDK 11 did
not correctly handle certain integer arithmetic. An attacker could possibly
use this issue to cause a denial of service. (CVE-2026-41254)

In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.

Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2026-07-21

Affected QuantaStor releases:
  6.8.6.015 jammy: openjdk-11-jre-headless 11.0.32+9-1ubuntu1~22.04 (fixed in 11.0.32+9-1ubuntu1~22.04)
  6.8.5.018 jammy: openjdk-11-jre-headless 11.0.31+11-1ubuntu1~22.04.2 (fixed in 11.0.32+9-1ubuntu1~22.04)
  6.8.4.038 jammy: openjdk-11-jre-headless 11.0.31+11-1ubuntu1~22.04.2 (fixed in 11.0.32+9-1ubuntu1~22.04)
  6.8.3.018 jammy: openjdk-11-jre-headless 11.0.31+11-1ubuntu1~22.04.2 (fixed in 11.0.32+9-1ubuntu1~22.04)
  6.8.2.002 jammy: openjdk-11-jre-headless 11.0.31+11-1ubuntu1~22.04.2 (fixed in 11.0.32+9-1ubuntu1~22.04)
  6.8.1.007 jammy: openjdk-11-jre-headless 11.0.31+11-1ubuntu1~22.04.2 (fixed in 11.0.32+9-1ubuntu1~22.04)
  6.8.0.205 jammy: openjdk-11-jre-headless 11.0.31+11-1ubuntu1~22.04.2 (fixed in 11.0.32+9-1ubuntu1~22.04)

CVEs: CVE-2026-60147, CVE-2026-46917, CVE-2026-47010, CVE-2026-41254, CVE-2026-47027, CVE-2026-47058, CVE-2026-47063, CVE-2026-46968, CVE-2026-47059, CVE-2026-47057, CVE-2026-47021

References:
  https://ubuntu.com/security/notices/USN-8674-1