[El-errata] ELSA-2026-42877 Important: Oracle Linux 9 java-1.8.0-openjdk security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-42877

http://linux.oracle.com/errata/ELSA-2026-42877.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
java-1.8.0-openjdk-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-demo-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-demo-fastdebug-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-demo-slowdebug-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-devel-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-devel-fastdebug-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-devel-slowdebug-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-fastdebug-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-headless-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-headless-fastdebug-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-headless-slowdebug-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-javadoc-1.8.0.502.b07-1.2.0.1.el9.noarch.rpm
java-1.8.0-openjdk-javadoc-zip-1.8.0.502.b07-1.2.0.1.el9.noarch.rpm
java-1.8.0-openjdk-slowdebug-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-src-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-src-fastdebug-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-src-slowdebug-1.8.0.502.b07-1.2.0.1.el9.x86_64.rpm

aarch64:
java-1.8.0-openjdk-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-demo-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-demo-fastdebug-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-demo-slowdebug-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-devel-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-devel-fastdebug-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-devel-slowdebug-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-fastdebug-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-headless-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-headless-fastdebug-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-headless-slowdebug-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-javadoc-1.8.0.502.b07-1.2.0.1.el9.noarch.rpm
java-1.8.0-openjdk-javadoc-zip-1.8.0.502.b07-1.2.0.1.el9.noarch.rpm
java-1.8.0-openjdk-slowdebug-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-src-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-src-fastdebug-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-src-slowdebug-1.8.0.502.b07-1.2.0.1.el9.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/java-1.8.0-openjdk-1.8.0.502.b07-1.2.0.1.el9.src.rpm

Related CVEs:

CVE-2026-41254
CVE-2026-46968
CVE-2026-47010
CVE-2026-47021
CVE-2026-47027
CVE-2026-47057
CVE-2026-47058
CVE-2026-47059
CVE-2026-47063
CVE-2026-60147




Description of changes:

[1:1.8.0.502.b07-1.2.0.1]
- Add Oracle vendor bug URL [Orabug: 34340155]

[1:1.8.0.502.b07-1.2]
- Bump release for PQC build
- Related: RHEL-212095
- Related: RHEL-188852
- Related: RHEL-149784
- Related: RHEL-212316
- Related: RHEL-212318
- Related: RHEL-212329
- Related: RHEL-212330
- Related: RHEL-212327
- Related: RHEL-212328

[1:1.8.0.502.b07-1.1]
- Update to 8u502-b07 (GA).
- Update release notes for 8u502-b07.
- Bump lcms2 version to 2.19.1 following JDK-8321489, JDK-8348110, JDK-8375065 & JDK-8383354
- Bump zlib version to 1.3.2 following JDK-8378631
- Require tzdata 2026b due to upstream inclusion of JDK-8383175
- Add attempted patch for JDK-8385876 to fix -Wnonnull build failure with s390x Zero on CentOS 9
- Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file
- Explictly define supported architectures
- Specify portablerelease and rpmrelease (always 0 for portables) in the Release field
- Make zone string debug output optional in TestTranslations
- Change javadoc-zip to just own the top-level directory, not include the entire subtree
- Update tagged versions to include 9.8.0-z & 9.9.0.
- Cleanup tagging and gating scripts to appease shellcheck:
- * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.
- * scripts/builds/check_signatures.sh: Quote variable usage.
- * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage.
- * scripts/builds/waive_leapp_issue.sh: Likewise.
- * scripts/builds/waive_rpminspect.sh: Likewise.
- * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable.
- * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage.
- Obsolete old RHEL releases (8.2.0-z, 9.0.0-z, 9.7.0-z)
- Sync the copy of the portable specfile with the latest update
- Sync portable naming with later JDKs, due to adoption of <compatiblename> by portable
- Drop <pversion> which is a redundant alias for version now
- ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
- Resolves: RHEL-212095
- Resolves: RHEL-188852
- Resolves: RHEL-149784
- Resolves: RHEL-212316
- Resolves: RHEL-212318
- Related: RHEL-212327
- Resolves: RHEL-212329
- Resolves: RHEL-212330

[1:1.8.0.502.b07-1.1]
- Make headless own /usr/share/doc/java-1.8.0-openjdk
- Make javadoc-zip own /usr/share/javadoc/java-1.8.0-openjdk
- Do not overwrite slowdebug __provides_exclude_from and __requires_exclude_from regexps
- Resolves: RHEL-212327
- Resolves: RHEL-212328