Source: openjfx X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerabilities were published for openjfx. CVE-2026-91385[0]: | Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM | Enterprise Edition product of Oracle Java SE (component: JavaFX). | Supported versions that are affected are Oracle Java SE: 8u503; | Oracle JavaFX: 21.0.12, 25.0.4 and 27; Oracle GraalVM Enterprise | Edition: 21.3.19.1.1. Easily exploitable vulnerability allows | unauthenticated attacker with network access via multiple protocols | to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM | Enterprise Edition. Successful attacks require human interaction | from a person other than the attacker. Successful attacks of this | vulnerability can result in unauthorized update, insert or delete | access to some of Oracle Java SE, Oracle JavaFX, Oracle GraalVM | Enterprise Edition accessible data as well as unauthorized read | access to a subset of Oracle Java SE, Oracle JavaFX, Oracle GraalVM | Enterprise Edition accessible data. Note: This vulnerability applies | to Java deployments, typically in clients running sandboxed Java Web | Start applications or sandboxed Java applets, that load and run | untrusted code (e.g., code that comes from the internet) and rely on | the Java sandbox for security. This vulnerability does not apply to | Java deployments, typically in servers, that load and run only | trusted code (e.g., code installed by an administrator). CVSS 3.1 | Base Score 5.4 (Confidentiality and Integrity impacts). CVSS | Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). CVE-2026-91402[1]: | Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM | Enterprise Edition product of Oracle Java SE (component: JavaFX). | Supported versions that are affected are Oracle Java SE: 8u503; | Oracle JavaFX: 21.0.12, 25.0.4 and 27; Oracle GraalVM Enterprise | Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows | unauthenticated attacker with network access via multiple protocols | to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM | Enterprise Edition. Successful attacks require human interaction | from a person other than the attacker. Successful attacks of this | vulnerability can result in unauthorized read access to a subset of | Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition | accessible data. Note: This vulnerability applies to Java | deployments, typically in clients running sandboxed Java Web Start | applications or sandboxed Java applets, that load and run untrusted | code (e.g., code that comes from the internet) and rely on the Java | sandbox for security. This vulnerability does not apply to Java | deployments, typically in servers, that load and run only trusted | code (e.g., code installed by an administrator). CVSS 3.1 Base Score | 3.1 (Confidentiality impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). https://openjdk.org/groups/vulnerability/advisories/2026-10-20 If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-91385 https://www.cve.org/CVERecord?id=CVE-2026-91385 [1] https://security-tracker.debian.org/tracker/CVE-2026-91402 https://www.cve.org/CVERecord?id=CVE-2026-91402 Please adjust the affected versions in the BTS as needed.
