Oracle Java SE 7 Update 25 fixes an unspecified vulnerability in the Deployment component (CVE-2013-2437). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:P/I:N/A:N

External Reference:

http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html

It was discovered that JConsole did not properly inform the user in case establishing an SSL connection failed. An attacker could exploit this flaw to gain access to potentially sensitive information.

It was discovered that the ObjectOutputStream class did not properly perform certain access checks when handling subclasses. An untrusted Java application or applet could possibly use this flaw to disclose potentially sensitive information.

It was discovered that the ObjectStreamClass class did not properly protect against circular references. An untrusted Java application or applet could possibly use this flaw to cause a denial of service.

It was discovered that the Networking component did not properly prevent the local address from being revealed. An untrusted Java application or applet could possibly use this flaw to disclose the local address.

It was discovered that access checks for getEnclosingClass, getEnclosingMethod and getEnclosingConstructor were not performed properly. An untrusted Java application or applet could possibly use this flaw to disclose potentially sensitive information.

It was discovered that the java.rmi.dgc.VMID class did not create entirely unique and unpredictable IDs. An untrusted Java application or applet could possibly use this flaw to disclose potentially sensitive information.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability than CVE-2013-2452 and CVE-2013-2455. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to an incorrect "checking order" within the AccessControlContext class.

It was discovered that the MBeanServer Introspector of the JMX component did not properly verify the package access. An untrusted Java application or applet could possibly use this flaw to bypass intended package restrictions.

It was discovered that the JMX component did not properly implement certain class checks. An untrusted Java application or applet could possibly use this flaw to bypass intended class restrictions.

It was discovered that CORBA output streams did not properly implement access restrictions. An untrusted Java application or applet could possibly use this flaw to disclose potentially sensitive information.

It was discovered that the AWT component did not properly manage and restrict certain resources related to the processing of fonts. An untrusted Java application or applet could possibly use this flaw to exhaust available resources and cause a denial of service.

The SerialJavaObject class of the JDBC component did not properly restrict access to certain class packages. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

It was discovered that the Libraries component contained certain errors related to XML security and the class loader. A remote attacker could possibly exploit this flaw to disclose potentially sensitive information and cause a denial of service.

It was found that documentation generated by javadoc was vulnerable to a frame injection attack. If such documentation was accessible over a network, and a remote attacker could trick a user into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's session if permitted by the browser. It could also be used to perform a phishing attack, by providing frame content that spoofed a login form on the site hosting the vulnerable documentation.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2433.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-1540.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Install.

It was discovered that the Network component did not properly perform InetAddress serialization. An untrusted Java application or applet could possibly use this flaw to disclose sensitive information.

It was discovered that the 2D component did not properly process certain fonts. An untrusted Java application or applet could possibly use this flaw to crash the Java VM.

MBeanInstantiator class implementation in OpenJDK JMX component did not properly check class access before creating new instances. Untrusted Java application or applet could use this flaw to create instances of non-public classes.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect integrity via unknown vectors related to Deployment.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Hotspot.