Oracle Java SE 5.0u85, 6u95, 7u79 and 8u45 fixes an unspecified vulnerability in the 2D component (CVE-2015-0491). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html#AppendixJAVA
Oracle Java SE 7u79 and 8u45 fixes an unspecified vulnerability in the JavaFX component (CVE-2015-0492). Upstream has CVSSv2 scored this issue as: 9.3/AV:N/AC:M/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html#AppendixJAVA
Oracle Java SE 5.0u85, 6u95, 7u79 and 8u45 fixes an unspecified vulnerability in the 2D component (CVE-2015-0459). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html#AppendixJAVA
A flaw was found in the way the JSSE (Java Secure Socket Extension) component in OpenJDK parsed X.509 certificate options. A specially-crafted certificate could cause JSSE to raise an unexpected exception, possibly causing an application using JSSE to exit unexpectedly.
A directory traversal flaw was found in jar, The Java Archive Tool. Relative paths containing '..' or absolute paths used for files stored in a specially-crafted jar archive could cause the jar tool to overwrite arbitrary files when the archive was extracted.
With this update, jar strips leading '/' or path prefix that contains '..'. New command line option -P can be used to revert back to the old insecure behavior which preserves absolute paths and paths with '..'.
This issue was reported multiple times in the past and already got CVE-2005-1080 (bug 606442) assigned. This CVE is a duplicate of the old 2005 id.
It was discovered that the Beans component in OpenJDK incorrectly given permissions to code when loading resources. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions and request resources which should not be accessible.
A flaw was found in the way the Hotspot JVM handled phantom references. An untrusted Java application or applet could use this flaw to corrupt JVM memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions.
This fix corrects the patch for CVE-2015-0395 (bug 1183031) fixed in Jan 2015 CPU.
It was found that the RSA implementation in Java Cryptography Extension (JCE) component in OpenJDK did not follow recommended practices for implementing RSA signatures.
Acknowledgement:
This issue was discovered by Florian Weimer of Red Hat Product Security.
It was discovered that ObjectInputStream and ObjectOutputStream serialization handling did not properly perform certain checks. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the Java2d Disposer did not properly dispose of resources if an exception occured during the process. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the checkPackageAccess function of the class loader did not properly check the package access for non-public proxy classes. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the virtual machine.
Oracle Java SE Update 45 fixes an unspecified vulnerability in the 2D component (CVE-2013-5843). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html