Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.240 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAXP. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the public declaration of the loadPropertyFile method in the JAXP FuncSystemProperty class, which allows remote attackers to obtain sensitive information.

It was discovered that JSSE component in OpenJDK did not properly validate Diffie-Hellman public keys. A malicious SSL/TLS client could use this flaw to perform a small subgroup attack on the Diffie-Hellman protocol, resulting in weak session key to be negotiated for the connection, or possibly disclose portions of the server's Diffie-Hellman private key.

External Reference:

http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.240 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient clipboard access premission checks."

An XSS flaw was discovered in the sun.rmi.transport.proxy CGIHandler class. When error was detected in the request query parameters, an untrusted user input was used in an error string without further sanitization.

External Reference:

http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.238 and earlier allows remote attackers to affect availability, related to JSSE.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.238 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries, a different vulnerability than CVE-2012-5079.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.238 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries, a different vulnerability than CVE-2012-5073.

A flaw was discovered in the SSL/TLS in JSSE component of OpenJDK, that allows malicious clients to make an SSL/TLS server use an excessive amount of CPU time by repeatedly sending ClientHello packets. Client can send pre-generated packet, causing the server to repeatedly perform expensive computations when generating ServerHello response.

This flaw is similar to OpenSSL CVE-2011-4619 (bug #771780), but the problem does not seem to be caused by an attempt to support server gated cryptography (SGC) and rather seems to be caused by an incorrect enforcing of the packet order during the SSL/TLS protocol handshake.

Note that the attacker needs to keep connection open and keep re-sending ClientHello packets to keep server busy.