A denial of service flaw was discovered in the com.sun.org.apache.xml.internal.security.utils.UnsyncByteArrayOutputStream class. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service.

A denial of service flaw was found in the way the JRE processes XML. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service.

It was discovered that javac did not properly ignore certain ignorable characters. An attacker could influence the integrity and confidentiality of a system by providing specially crafted input, which is then used by javadoc to generate API documentation.

Upstream reports that this issue is relevant to uses where javadoc is used to generate documentation for an untrusted source code and have it hosted on a domain not controlled by the author of the source code (the attacker).

It was discovered that various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. If a Java application called the toString() method on any of the affected classes, it could possibly lead to an unexpected exposure of sensitive key data.