It was discovered that the JAR (Java ARchive) verifier in the Security component of OpenJDK did not correctly handle files inside archives with missing digest. An attacker could possibly use this flaw to manipulate content of a singed JAR, bypassing intended verification.

It was discovered that the Hotspot component of OpenJDK did not properly check for integer overflows when generating range check loop predicates. An untrusted Java application or applet could use this flaw to corrupt JVM memory and cause it to crash or, possibly, execute arbitrary code, bypassing Java sandbox restrictions.

A covert timing channel flaw was found in the DSA implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application generate DSA signatures on demand could possibly use this flaw to extract certain information about the used key via a timing side channel.

Note that the fix for this issue reverts the fix for CVE-2016-5548 (see bug 1413920) and uses different approach to implement blinding of the DSA operations.

It was discovered that the LDAPCertStore class in the Security component of OpenJDK followed LDAP referrals to arbitrary URLs. A specially-crafted LDAP referral URL could cause LDAPCertStore to communicate with non-LDAP servers.