{"id":"CLSA-2026-1786485204","summary":"Fix CVE(s): CVE-2026-47057, CVE-2026-47058, CVE-2026-47063","details":"   * OpenJDK 8u502 release, build 7 (Oracle July 2026 CPU).\n     Release notes:\n     https://openjdk.org/groups/vulnerability/advisories/2026-07-21\n     - Security fixes (8u502):\n       + CVE-2026-41254: 2D integer overflow in Little CMS CubeSize\n       + CVE-2026-46968: JSSE TLS certificate handling\n       + CVE-2026-47010: ImageIO JPEG handling\n       + CVE-2026-47021: 2D XBM image support\n       + CVE-2026-47027: Security Jar file processing\n       + CVE-2026-47057: Scripting Nashorn index handling\n       + CVE-2026-47058: Scripting DataView implementation\n       + CVE-2026-47059: 2D AWT ImagingLib\n       + CVE-2026-47063: Security Jar handling\n       + CVE-2026-60147: Security certification checking\n     (CVE-2026-46917 from the same advisory does not affect the 8u train\n      per the OpenJDK 2026-07-21 risk matrix.)\n   * debian/rules: bump gh_tag to jdk8u502-ga, version_dash_buildnr to\n     502-b07, gh_tag_aarch32 to jdk8u502-b06-aarch32-20260710.\n   * Refresh orig tarball from Ubuntu archive\n     (openjdk-8_8u502-ga~us1.orig.tar.gz,\n      sha1 553d02f135b9c68cf95a2daf0e5db367e4e0569b,\n      size 67975803 bytes; source: archive.ubuntu.com openjdk-8 8u502-ga~us1).\n   * Refresh Ubuntu quilt patches for u502 context:\n     - zero-sh.diff (upstream added a RISCV branch to os::dll_load; the\n       ZERO_SH branch and #error list are re-anchored after it)\n     - gcc14.diff (upstream adopted the UINT8** freeArray signature in\n       imageioJPEG.c, so that hunk is dropped; parse_manifest.c retained)\n     All 48 quilt patches apply cleanly (0 rejects).\n   * Ref: ELSCVE-167684, ELSCVE-167634, ELSCVE-167656","modified":"2026-10-26T09:43:57.050924779Z","published":"2026-08-11T21:53:38Z","upstream":["CVE-2026-41254","CVE-2026-46917","CVE-2026-46968","CVE-2026-47010","CVE-2026-47021","CVE-2026-47027","CVE-2026-47057","CVE-2026-47058","CVE-2026-47059","CVE-2026-47063","CVE-2026-60147"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1786485204.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47057"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47058"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47063"}],"affected":[{"package":{"name":"openjdk-8-demo","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-8-demo?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"}},{"package":{"name":"openjdk-8-doc","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-8-doc?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"}},{"package":{"name":"openjdk-8-jdk","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-8-jdk?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"}},{"package":{"name":"openjdk-8-jdk-headless","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-8-jdk-headless?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"}},{"package":{"name":"openjdk-8-jre","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-8-jre?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"}},{"package":{"name":"openjdk-8-jre-headless","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-8-jre-headless?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"}},{"package":{"name":"openjdk-8-jre-zero","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-8-jre-zero?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"}},{"package":{"name":"openjdk-8-source","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-8-source?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8u502-ga~us1-0ubuntu1~20.04+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1786485204.json"}}],"schema_version":"1.9.0"}