{"id":"CLSA-2026-1788346723","aliases":[],"status":"published","title":"java-1.8.0-openjdk: Fix of 10 CVEs","description":"- Build with devtoolset-7 on aarch64 as well as 32-bit ARM. Upstream refuses\n  to build HotSpot on aarch64 with GCC \u003c 5 (JDK-8360869), and el7 ships GCC\n  4.8.5, so the aarch64 build failed in configure. The devtoolset-7 machinery\n  was already present but gated on %{arm}, which does not cover aarch64.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-16T20:46:53Z","modified":"2026-10-26T09:31:48Z","fixes":[{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-accessibility","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-accessibility-debug","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-debug","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-demo","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-demo-debug","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-devel","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-devel-debug","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-headless","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-headless-debug","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-javadoc","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-javadoc-debug","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-javadoc-zip","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-javadoc-zip-debug","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-src","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-src-debug","fixed_in":["1:1.8.0.502.b07-1.el7_9.tuxcare.els2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-accessibility","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-accessibility-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-demo-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-devel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-headless-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-javadoc-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-javadoc-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-javadoc-zip-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"java-1.8.0-openjdk-src-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.502.b07-1.el7_9.tuxcare.els2"}]}]}],"references":[{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1788346723.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46968","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47010","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47021","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47027","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47057","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47058","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47059","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47063","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60147","tags":["advisory"]}],"sources":{"osv":[{"id":"CLSA-2026-1788346723","title":"java-1.8.0-openjdk: Fix of 10 CVEs","description":"- Build with devtoolset-7 on aarch64 as well as 32-bit ARM. Upstream refuses\n  to build HotSpot on aarch64 with GCC \u003c 5 (JDK-8360869), and el7 ships GCC\n  4.8.5, so the aarch64 build failed in configure. The devtoolset-7 machinery\n  was already present but gated on %{arm}, which does not cover aarch64.","status":"published","published":"2026-10-16T20:46:53Z","modified":"2026-10-26T09:31:48.76082557Z","updated_at":"2026-11-02T15:43:47.591214Z"}]}}