Bug 2376783 (CVE-2025-30749)

Summary:	CVE-2025-30749 openjdk: Better Glyph drawing (Oracle CPU 2025-07)
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ahughes, fferrari, fitzsim, jsamir, khosford, mtorre, neugens, pjindal, rhel-process-autobot, security-response-team, sraghupu, sthirugn, tfitzsim, vkrizan, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2025-07-15

Description OSIDB Bzimport 2025-07-07 10:43:05 UTC

Several scenarios of heap corruption were observed for
Graphics2D.drawString(String,float,float) with varying settings for
RenderingHints and affine font transformations.

Comment 1 Michal Findra 2025-07-25 11:11:48 UTC

OpenJDK-8 upstream commit:
https://github.com/openjdk/jdk8u/commit/33624e872e7d40d3059f4c0d2967f140305378b8

OpenJDK-11 upstream commit:
https://github.com/openjdk/jdk11u/commit/25101ecf5abb77532f39de43758f6dd5614d7795

OpenJDK-17 upstream commit:
https://github.com/openjdk/jdk17u/commit/5b443e9e817fa206dfaa87d9e2b9dbc87daa027f

OpenJDK-21 upstream commit:
https://github.com/openjdk/jdk21u/commit/10a28c0f67b458e2ec273d2e792c75493f8e6d67

Comment 2 Michal Findra 2025-07-25 12:39:16 UTC

This CVE was fixed in Oracle Java SE 8u461, 11.0.28, 17.0.16, 21.0.8. 

https://www.oracle.com/java/technologies/javase/8u461-relnotes.html#R180_461
https://www.oracle.com/java/technologies/javase/11-0-28-relnotes.html#R11_0_28
https://www.oracle.com/java/technologies/javase/17-0-16-relnotes.html#R17_0_16
https://www.oracle.com/java/technologies/javase/21-0-8-relnotes.html

Comment 4 errata-xmlrpc 2026-01-21 20:21:49 UTC

This issue has been addressed in the following products:

  RHOSS-1.36-RHEL-8

Via RHSA-2026:0934 https://access.redhat.com/errata/RHSA-2026:0934