SUSE-SU-2026:4677-1

SUSE-SU-2026:4677-1 · Security update for the Java stack

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

This update for Java fixes the following issues: This update introduces new libraries and refines existing Java tools to improve security, compatibility, stability, and formatting. ant (Updated to version 1.10.18): - Security issues fixed: - CVE-2021-36374: Fixed excessive memory allocation when reading specially crafted ZIP archives or derived formats (bsc#1188469) - CVE-2025-7962: Fixed improper neutralization of line breaks to prevent SMTP injection (bsc#1246873) - CVE-2026-78254: Fixed path traversal in FTP and SCP tasks that could allow arbitrary file writes (bsc#1280015) - Other changes and bugs fixed: * Breaking changes: + FTPS tasks now use encrypted data channels by default. + FTP and SCP tasks now prevent files or directories from being written outside the target directory by default. * Other changes: + Added package `ant-junit5` that allows tests to be launched and run using the JUnit 5 framework. + Improved support for reproducible builds by standardizing timestamps, file modification times, and timezone handling. + Upgraded the jakarta.mail dependency to version 2.0.2. + Added an option to the 'record' task to create log files relative to the project directory. * Bugs fixed: + Fixed compatibility and startup issues when running on newer Java versions. + Fixed network handling issues in FTP and SCP tasks, including proper support for IPv6 addresses. + Improved security in email tasks by verifying TLS server certificates and enforcing STARTTLS encryption. + Improved report generation performance in JUnit launcher tasks. + Fixed regressions and edge cases in resource mapping, path conversion, and command execution. json-simple (Updated to version 2.3.1): - Updated to a newer version that makes reading and writing structured web data (JSON) safer and more reliable. - Added a 'pretty-printing' feature to format web data so it is easier to read. - Made reading and writing data safer when multiple tasks are running simultaneously. - Made looking up data more flexible, allowing the tool to automatically handle different format types (like numbers and text). junit5 (Updated to version 5.14.4): - Fixed an issue where tests could conflict or run incorrectly when executed at the same time. - Corrected test behavior on newer versions of Java so they run reliably. - Improved test reports so that test names are clearer, unique, and easier to distinguish from one another. - Added features to customize how test names are generated and better capture testing outputs. maven-doxia, maven-doxia-sitetools (Updated to version 2.1.0): - Added support for displaying the last modification date and author on generated web pages. - Added support for displaying interactive diagrams (such as flowcharts or charts) directly on web pages. - Improved formatting and layout for modern documents, including better tables, lists, and links. maven-surefire, maven-surefire-plugins (Updated to version 3.5.6): - Fixed a bug that caused software testing tasks to fail abruptly with an unexpected error [bsc#1273185]. - Added timestamps to testing reports so you can see exactly when tests ran. - Made running multiple tests at the same time much more reliable, preventing mixed-up report results. - Added the ability to immediately stop testing once a failure is detected (saving time). objectweb-asm (Updated to version 9.10.1): - Added support for newer Java versions, including bytecode support up to Java 27. - Prevented out-of-memory errors when processing invalid or corrupted class files. - Improved bytecode analysis and verification to correctly handle valid Java code and prevent unexpected analysis errors - Improved compliance with FIPS 140-3 security standards during class serialization. - Corrected package import ranges to prevent dependency conflicts in OSGi environments. - Fixed unexpected crashes and errors in code generation and inspection utilities. plexus-archiver (Updated to version 4.14.0): - Added support for following symbolic links when collecting files for archives. - Reduced memory usage when creating ZIP archives to prevent out-of-memory errors during large builds. - Fixed an issue where reading file attributes on Windows systems could cause unexpected errors. - Improved ZIP archive handling, fixing checksum calculation errors, negative timestamp issues, and file permissions. - Replaced compression components with Apache Commons Compress to eliminate vulnerable dependencies. - Added Java Module System (JPMS) support for compatibility with modern Java versions. - Updated dependencies, including commons-io to 2.22.0, xz to 1.12, and zstd-jni to 1.5.7-15. plexus-build-api (Updated to version 1.2.0): - Updated dependencies for compatibility with modern build and injection tools. plexus-cipher (Updated to version 2.1.0): - Updated dependencies for compatibility with modern build and injection tools. plexus-classworlds (Updated to version 2.12.1): - Fixed file pattern matching (glob matching) when loading classes and resources. - Restored backward compatibility with legacy Maven 2 configurations. - Added support for registering filtered class realms. - Implemented clean resource shutdown support (Closeable) for class loaders. - Added support for the PPC64LE architecture. - Added Java Module System (JPMS) support for compatibility with modern Java versions. - Updated dependencies, including jakarta.xml.bind-api, log4j-api, and ant. plexus-compiler (Updated to version 2.17.1): - Fixed a security issue (Zip Slip) that could allow arbitrary file overwrite during archive extraction. - Fixed an unexpected crash (ConcurrentModificationException) when processing compiler arguments concurrently. - Fixed compiler diagnostics and warning reporting to ensure multi-line messages and warning categories are properly displayed. - Fixed Java version detection when custom options or newer Java versions are present. - Fixed an issue where the Eclipse Java Compiler (ECJ) failed to detect annotation processors configured in the processor path. - Added support for quoting compiler argument files to safely handle paths containing spaces. - Fixed cross-drive file path handling on Windows systems. - Added Java Module System (JPMS) support for compatibility with modern Java versions. - Updated dependencies, including Google Guava to 33.7.1 and Eclipse Java Compiler (ECJ) to 3.46.100. plexus-containers (Updated to version 2.2.0): - Added the plexus-metadata-generator Ant task and command-line interface to generate component metadata. - Added the plexus-metadata-generator-ant package capability. plexus-i18n (Updated to version 1.2.0): - Corrected language translation lookup to prevent unintentionally falling back to the system default locale. - Added Java Module System (JPMS) support for compatibility with modern Java versions. - Updated internal dependencies. plexus-interactivity (Updated to version 1.6.0): - Upgraded the terminal reader dependency to JLine 3 for improved console and terminal interaction. - Added Java Module System (JPMS) support for compatibility with modern Java versions. - Updated dependencies, including Sisu Inject to 1.1.0 and Guice to 5.1.0. plexus-interpolation (Updated to version 1.30.0): - Fixed caching issues in string and regular expression interpolators to significantly improve evaluation performance and consistency. - Added support for feedback value sources and delimiter tracking. - Added Java Module System (JPMS) support for compatibility with modern Java versions. - Updated internal dependencies. plexus-io (Updated to version 3.8.0): - Improved performance by caching Unix user and group lookups. - Fixed file handling to properly follow symbolic links when configured. - Fixed an issue where temporary files were left unclosed, preventing file-not-found errors. - Improved resilience when querying file attributes on network file system

Fix available

Published

2026-10-15T05:56:19Z

Updated

2026-10-15T18:00:06.753263208Z

Stack: system

Check your server →