🛡️ SUSE-SU-2025:0279-1 — java-21-openjdk (CVE-2025-21502)
Description
Security update for java-21-openjdk
This update for java-21-openjdk fixes the following issues:
Upgrade to upstream tag jdk-21.0.6+7 (January 2025 CPU)
Security fixes:
- CVE-2025-21502: Enhance array handling (JDK-8330045, bsc#1236278)
Other changes:
- JDK-6942632: Hotspot should be able to use more than 64 logical processors on Windows
- JDK-8028127: Regtest java/security/Security/SynchronizedAccess.java is incorrect
- JDK-8195675: Call to insertText with single character from custom Input Method ignored
- JDK-8207908: JMXStatusTest.java fails assertion intermittently
- JDK-8225220: When the Tab Policy is checked,the scroll button direction displayed incorrectly.
- JDK-8240343: JDI stopListening/stoplis001 'FAILED: listening is successfully stopped without starting listening'
- JDK-8283214: [macos] Screen magnifier does not show the magnified text for JComboBox
- JDK-8296787: Unify debug printing format of X.509 cert serial numbers
- JDK-8296972: [macos13] java/awt/Frame/MaximizedToIconified/MaximizedToIconified.java: getExtendedState() != 6 as expected.
- JDK-8306446: java/lang/management/ThreadMXBean/Locks.java transient failures
- JDK-8308429: jvmti/StopThread/stopthrd007 failed with 'NoClassDefFoundError: Could not initialize class jdk.internal.misc.VirtualThreads'
- JDK-8309218: java/util/concurrent/locks/Lock/OOMEInAQS.java still times out with ZGC, Generational ZGC, and SerialGC
- JDK-8311301: MethodExitTest may fail with stack buffer overrun
- JDK-8311656: Shenandoah: Unused ShenandoahSATBAndRemarkThreadsClosure::_claim_token
- JDK-8312518: [macos13] setFullScreenWindow() shows black screen on macOS 13 & above
- JDK-8313374: --enable-ccache's CCACHE_BASEDIR breaks builds
- JDK-8313878: Exclude two compiler/rtm/locking tests on ppc64le
- JDK-8315701: [macos] Regression: KeyEvent has different keycode on different keyboard layouts
- JDK-8316428: G1: Nmethod count statistics only count last code root set iterated
- JDK-8316893: Compile without -fno-delete-null-pointer-checks
- JDK-8316895: SeenThread::print_action_queue called on a null pointer
- JDK-8316907: Fix nonnull-compare warnings
- JDK-8317116: Provide layouts for multiple test UI in PassFailJFrame
- JDK-8317575: AArch64: C2_MacroAssembler::fast_lock uses rscratch1 for cmpxchg result
- JDK-8318105: [jmh] the test java.security.HSS failed with 2 active threads
- JDK-8318442: java/net/httpclient/ManyRequests2.java fails intermittently on Linux
- JDK-8319640: ClassicFormat::parseObject (from DateTimeFormatter) does not conform to the javadoc and may leak DateTimeException
- JDK-8319673: Few security tests ignore VM flags
- JDK-8319678: Several tests from corelibs areas ignore VM flags
- JDK-8319960: RISC-V: compiler/intrinsics/TestInteger/LongUnsignedDivMod.java failed with 'counts: Graph contains wrong number of nodes'
- JDK-8319970: AArch64: enable tests compiler/intrinsics/Test(Long|Integer)UnsignedDivMod.java on aarch64
- JDK-8319973: AArch64: Save and restore FPCR in the call stub
- JDK-8320192: SHAKE256 does not work correctly if n >= 137
- JDK-8320397: RISC-V: Avoid passing t0 as temp register to MacroAssembler:: cmpxchg_obj_header/cmpxchgptr
- JDK-8320575: generic type information lost on mandated parameters of record's compact constructors
- JDK-8320586: update manual test/jdk/TEST.groups
- JDK-8320665: update jdk_core at open/test/jdk/TEST.groups
- JDK-8320673: PageFormat/CustomPaper.java has no Pass/Fail buttons; multiple instructions
- JDK-8320682: [AArch64] C1 compilation fails with 'Field too big for insn'
- JDK-8320892: AArch64: Restore FPU control state after JNI
- JDK-8321299: runtime/logging/ClassLoadUnloadTest.java doesn't reliably trigger class unloading
- JDK-8321470: ThreadLocal.nextHashCode can be static final
- JDK-8321474: TestAutoCreateSharedArchiveUpgrade.java should be updated with JDK 21
- JDK-8321543: Update NSS to version 3.96
- JDK-8321550: Update several runtime/cds tests to use vm flags or mark as flagless
- JDK-8321616: Retire binary test vectors in test/jdk/java/util/zip/ZipFile
- JDK-8321940: Improve CDSHeapVerifier in handling of interned strings
- JDK-8322166: Files.isReadable/isWritable/isExecutable expensive when file does not exist
- JDK-8322754: click JComboBox when dialog about to close causes IllegalComponentStateException
- JDK-8322809: SystemModulesMap::classNames and moduleNames arrays do not match the order
- JDK-8322830: Add test case for ZipFile opening a ZIP with no entries
- JDK-8323562: SaslInputStream.read() may return wrong value
- JDK-8323688: C2: Fix UB of jlong overflow in PhaseIdealLoop::is_counted_loop()
- JDK-8324841: PKCS11 tests still skip execution
- JDK-8324861: Exceptions::wrap_dynamic_exception() doesn't have ResourceMark
- JDK-8325038: runtime/cds/appcds/ProhibitedPackage.java can fail with UseLargePages
- JDK-8325399: Add tests for virtual threads doing Selector operations
- JDK-8325506: Ensure randomness is only read from provided SecureRandom object
- JDK-8325525: Creat
Affected software
SUSE-SU-2025:0279-1 is recorded against 1 package.
- java-21-openjdk (fixed in 21.0.6.0-150600.3.9.1)
Timeline and source
Published on 28 January 2025 and last revised on 4 February 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.
References
www.suse.com (Advisory)
bugzilla.suse.com (Report)
www.suse.com (Web)
Details
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| java-21-openjdk | — | 21.0.6.0-150600.3.9.1 |
References
Similar Threats
- Unknown ALSA-2026:42895
- Unknown CLSA-2026-1778051357
- Unknown ALSA-2026:9689
- Unknown CLSA-2026-1771408532
- Unknown ALSA-2026:0928
Free Vulnerability Check
Is your site affected by SUSE-SU-2025:0279-1?
BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against SUSE-SU-2025:0279-1 and other known CVE records.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.