IBM JDK 7 R1 SR5 FP20 (7.1.5.20) and 8 SR8 FP15 (8.0.8.15) fix a flaw described by upstream as:

Eclipse OpenJ9 is vulnerable to a denial of service, caused by a flaw when a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has finished initializing. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause an infinite busy hang on a spinlock or a segmentation fault.

OpenJ9 upstream references: https://github.com/eclipse-openj9/openj9/pull/18085 https://gitlab.eclipse.org/security/cve-assignement/-/issues/13

IBM JDK references: https://www.ibm.com/support/pages/node/7078433 https://www.ibm.com/support/pages/apar/IJ49075 https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities#IBMSecurityUpdateNovember2023

A flaw was discovered in the CORBA component of OpenJDK in the way it performed deserialization of IOR (Interoperable Object Reference) string objects. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

A flaw was found in the PKIX certification path validation algorithm in the JSSE component of OpenJDK. A malicious remote client could use this flaw to craft a X.509 certificate and cause denial of service in a Java application processing such certificate.