It was discovered that the Inet6Address class contained errors when processing IPv6 addresses. This could lead to inaccurate results when processing IPv6 addresses, for example during serialization.
A denial of service flaw was found in the way the JRE processes XML. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service.
It was discovered that AWT JTable did not properly perform certain access checks. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that java.util.TimeZone does not properly restrict changing the time zone to the default time zone. An untrusted Java application or applet could exploit this to change the default time zone of their application contexts.
It was discovered that javac did not properly ignore certain ignorable characters. An attacker could influence the integrity and confidentiality of a system by providing specially crafted input, which is then used by javadoc to generate API documentation.
Upstream reports that this issue is relevant to uses where javadoc is used to generate documentation for an untrusted source code and have it hosted on a domain not controlled by the author of the source code (the attacker).
Oracle Java SE Update 45 fixes an unspecified vulnerability in the 2D component (CVE-2013-5801). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
It was discovered that AWT component's native ImagingLib failed to properly check image boundaries when preforming image conversion. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions by reading portions of the JVM memory.
It was discovered that getDeclaringClass() method implementation did not perform class loader package access checks. In certain configurations, an untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions.
It was discovered that various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. If a Java application called the toString() method on any of the affected classes, it could possibly lead to an unexpected exposure of sensitive key data.
It was discovered that DataFlavor class in the AWT component of OpenJDK failed to perform security checks properly. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions because of insufficient checks of package access restrictions, or class loader access permission.
http://docs.oracle.com/javase/7/docs/api/java/awt/datatransfer/DataFlavor.html
It was discovered that the Beans component of OpenJDK failed to perform security checks properly. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions because of insufficient checks of access level modifiers or package access restrictions.