It was discovered that the decoder (DocumentHandler in OpenJDK 7 and ObjectHandler OpenJDK 6) allowed processing of XML external entities. An application using JavaBeans could possibly disclose sensitive information, or be target of a DoS attack, triggered via XML external entities.
A flaw was found in the way the Networking component of OpenJDK checked permissions of code to listen on network ports. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions.
Oracle Java SE 6u71 and 7u51 fixes an unspecified vulnerability in the Deployment component (CVE-2014-0375). Upstream has CVSSv2 scored this issue as: 5.8/AV:N/AC:M/Au:N/C:P/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA
It was discovered that the JSSE component in OpenJDK could leak some timing information during the TLS/SSL handshake. This could possibly lead to disclosure of some information about negotiated encryption keys.
Oracle Java SE 6u71 and 7u51 fixes an unspecified vulnerability in the Deployment component (CVE-2014-0418). Upstream has CVSSv2 scored this issue as: 5.1/AV:N/AC:H/Au:N/C:P/I:P/A:P
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA
Oracle Java SE 6u71 and 7u51 fixes an unspecified vulnerability in the Deployment component (CVE-2014-0403). Upstream has CVSSv2 scored this issue as: 5.8/AV:N/AC:M/Au:N/C:P/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA
It was discovered that the JAXP (Java API for XML Processing) component in OpenJDK did not properly check code permissions when creating document builder factories. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions.
A flaw was found in the way JAAS (Java Authentication and Authorization Service) handled principals set for Subject. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions via deserialization of Subject.