SUSE update for java-1_8_0-ibm
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2025-21587 CVE-2025-30691 CVE-2025-30698 CVE-2025-4447 |
| CWE-ID | CWE-20 CWE-121 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
SUSE Linux Enterprise Server 15 SP5 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 SP3 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 SP4 Operating systems & Components / Operating system Legacy Module Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing LTSS 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing ESPOS 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system java-1_8_0-ibm-devel Operating systems & Components / Operating system package or component java-1_8_0-ibm-demo Operating systems & Components / Operating system package or component java-1_8_0-ibm-src Operating systems & Components / Operating system package or component java-1_8_0-ibm-plugin Operating systems & Components / Operating system package or component java-1_8_0-ibm-32bit Operating systems & Components / Operating system package or component java-1_8_0-ibm-devel-32bit Operating systems & Components / Operating system package or component java-1_8_0-ibm-alsa Operating systems & Components / Operating system package or component java-1_8_0-ibm Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) Improper input validation
EUVDB-ID: #VU107520
Risk: Medium
CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2025-21587
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the JSSE component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
MitigationUpdate the affected package java-1_8_0-ibm to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server 15 SP5: LTSS
SUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
Legacy Module: 15-SP6
openSUSE Leap: 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP3 - SP6
SUSE Linux Enterprise Server 15: SP3 - SP6
SUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP4
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4
SUSE Linux Enterprise High Performance Computing 15: SP3 - SP4
SUSE Enterprise Storage: 7.1
java-1_8_0-ibm-devel: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-demo: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-src: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-plugin: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-32bit: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-devel-32bit: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-alsa: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm: before 1.8.0_sr8.45-150000.3.101.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp5:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:legacy_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-demo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-src:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-plugin:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-devel-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-alsa:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-202501788-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Improper input validation
EUVDB-ID: #VU107522
Risk: Medium
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2025-30691
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Compiler component in Oracle Java SE. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
MitigationUpdate the affected package java-1_8_0-ibm to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server 15 SP5: LTSS
SUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
Legacy Module: 15-SP6
openSUSE Leap: 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP3 - SP6
SUSE Linux Enterprise Server 15: SP3 - SP6
SUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP4
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4
SUSE Linux Enterprise High Performance Computing 15: SP3 - SP4
SUSE Enterprise Storage: 7.1
java-1_8_0-ibm-devel: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-demo: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-src: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-plugin: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-32bit: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-devel-32bit: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-alsa: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm: before 1.8.0_sr8.45-150000.3.101.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp5:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:legacy_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-demo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-src:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-plugin:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-devel-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-alsa:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-202501788-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Improper input validation
EUVDB-ID: #VU107521
Risk: Medium
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2025-30698
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the 2D component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
MitigationUpdate the affected package java-1_8_0-ibm to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server 15 SP5: LTSS
SUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
Legacy Module: 15-SP6
openSUSE Leap: 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP3 - SP6
SUSE Linux Enterprise Server 15: SP3 - SP6
SUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP4
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4
SUSE Linux Enterprise High Performance Computing 15: SP3 - SP4
SUSE Enterprise Storage: 7.1
java-1_8_0-ibm-devel: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-demo: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-src: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-plugin: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-32bit: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-devel-32bit: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-alsa: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm: before 1.8.0_sr8.45-150000.3.101.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp5:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:legacy_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-demo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-src:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-plugin:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-devel-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-alsa:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-202501788-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Stack-based buffer overflow
EUVDB-ID: #VU112132
Risk: Medium
CVSSv4.0: 3.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2025-4447
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability occurs when modifying a file on disk that is read when the JVM starts. A local user can trigger stack-based buffer overflow and execute arbitrary code on the target system.
MitigationUpdate the affected package java-1_8_0-ibm to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server 15 SP5: LTSS
SUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
Legacy Module: 15-SP6
openSUSE Leap: 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP3 - SP6
SUSE Linux Enterprise Server 15: SP3 - SP6
SUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP4
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4
SUSE Linux Enterprise High Performance Computing 15: SP3 - SP4
SUSE Enterprise Storage: 7.1
java-1_8_0-ibm-devel: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-demo: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-src: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-plugin: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-32bit: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-devel-32bit: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm-alsa: before 1.8.0_sr8.45-150000.3.101.1
java-1_8_0-ibm: before 1.8.0_sr8.45-150000.3.101.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp5:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:legacy_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-demo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-src:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-plugin:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-devel-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm-alsa:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:java-1_8_0-ibm:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-202501788-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
