Debian has issued an advisory on October 20: https://www.debian.org/security/2017/dsa-4005
Hi, After checking, it appears those two CVEs have been corrected in Openjfx 8u141 so the problem is already solved. Best regards, Nico.
Resolution: (none) => FIXEDStatus: NEW => RESOLVED