CLSA-2026-1786485204

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1786485204
Upstream
CVE (11)
  • CVE-2026-41254
  • CVE-2026-46917
  • CVE-2026-46968
  • CVE-2026-47010
  • CVE-2026-47021
  • CVE-2026-47027
  • CVE-2026-47057
  • CVE-2026-47058
  • CVE-2026-47059
  • CVE-2026-47063
  • CVE-2026-60147
Published
2026-08-11T21:53:38Z
Modified
2026-10-26T09:43:57Z
Summary
Fix CVE(s): CVE-2026-47057, CVE-2026-47058, CVE-2026-47063
Details
  • OpenJDK 8u502 release, build 7 (Oracle July 2026 CPU). Release notes: https://openjdk.org/groups/vulnerability/advisories/2026-07-21
    • Security fixes (8u502):
      • CVE-2026-41254: 2D integer overflow in Little CMS CubeSize
      • CVE-2026-46968: JSSE TLS certificate handling
      • CVE-2026-47010: ImageIO JPEG handling
      • CVE-2026-47021: 2D XBM image support
      • CVE-2026-47027: Security Jar file processing
      • CVE-2026-47057: Scripting Nashorn index handling
      • CVE-2026-47058: Scripting DataView implementation
      • CVE-2026-47059: 2D AWT ImagingLib
      • CVE-2026-47063: Security Jar handling
      • CVE-2026-60147: Security certification checking (CVE-2026-46917 from the same advisory does not affect the 8u train per the OpenJDK 2026-07-21 risk matrix.)
  • debian/rules: bump gh_tag to jdk8u502-ga, version_dash_buildnr to 502-b07, gh_tag_aarch32 to jdk8u502-b06-aarch32-20260710.
  • Refresh orig tarball from Ubuntu archive (openjdk-8_8u502-gaus1.orig.tar.gz, sha1 553d02f135b9c68cf95a2daf0e5db367e4e0569b, size 67975803 bytes; source: archive.ubuntu.com openjdk-8 8u502-gaus1).
  • Refresh Ubuntu quilt patches for u502 context:
    • zero-sh.diff (upstream added a RISCV branch to os::dll_load; the ZERO_SH branch and #error list are re-anchored after it)
    • gcc14.diff (upstream adopted the UINT8** freeArray signature in imageioJPEG.c, so that hunk is dropped; parse_manifest.c retained) All 48 quilt patches apply cleanly (0 rejects).
  • Ref: ELSCVE-167684, ELSCVE-167634, ELSCVE-167656
References

Affected packages

TuxCare:Ubuntu:20.04
openjdk-8-demo

Package

Name
openjdk-8-demo
Purl
pkg:deb/tuxcare/openjdk-8-demo?distro=ubuntu-20.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"
openjdk-8-doc

Package

Name
openjdk-8-doc
Purl
pkg:deb/tuxcare/openjdk-8-doc?distro=ubuntu-20.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"
openjdk-8-jdk

Package

Name
openjdk-8-jdk
Purl
pkg:deb/tuxcare/openjdk-8-jdk?distro=ubuntu-20.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"
openjdk-8-jdk-headless

Package

Name
openjdk-8-jdk-headless
Purl
pkg:deb/tuxcare/openjdk-8-jdk-headless?distro=ubuntu-20.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"
openjdk-8-jre

Package

Name
openjdk-8-jre
Purl
pkg:deb/tuxcare/openjdk-8-jre?distro=ubuntu-20.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"
openjdk-8-jre-headless

Package

Name
openjdk-8-jre-headless
Purl
pkg:deb/tuxcare/openjdk-8-jre-headless?distro=ubuntu-20.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"
openjdk-8-jre-zero

Package

Name
openjdk-8-jre-zero
Purl
pkg:deb/tuxcare/openjdk-8-jre-zero?distro=ubuntu-20.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"
openjdk-8-source

Package

Name
openjdk-8-source
Purl
pkg:deb/tuxcare/openjdk-8-source?distro=ubuntu-20.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"