Oracle Java SE 6u71 and 7u51 fixes an unspecified vulnerability in the Deployment component (CVE-2014-0415). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA
Oracle Java SE 6u71 and 7u51 fixes an unspecified vulnerability in the Deployment component (CVE-2014-0410). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA
It was discovered that the CORBA component of OpenJDK failed to properly perform security checks IIOP input streams. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the Naming / JNDI component of OpenJDK failed to implement required package access checks. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Oracle Java SE 5.0u71, 6u71 and 7u51 fixes an unspecified vulnerability in the 2D component (CVE-2014-0417). Upstream has CVSSv2 scored this issue as: 9.3/AV:N/AC:M/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA
Oracle Java SE 6u71 and 7u51 fixes an unspecified vulnerability in the Deployment component (CVE-2014-0387). Upstream has CVSSv2 scored this issue as: 7.6/AV:N/AC:H/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA
A flaw was found in the way SNMP implementation in the Serviceability component in OpenJDK raised SnmpStatusException exception. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions.
Oracle Java SE 6u71 and 7u51 fixes an unspecified vulnerability in the Deployment component (CVE-2014-0424). Upstream has CVSSv2 scored this issue as: 7.5/AV:N/AC:L/Au:N/C:P/I:P/A:P
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA
Oracle Java SE 6u71 and 7u51 fixes an unspecified vulnerability in the Deployment component (CVE-2014-0375). Upstream has CVSSv2 scored this issue as: 5.8/AV:N/AC:M/Au:N/C:P/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA
Oracle Java SE 6u71 and 7u51 fixes an unspecified vulnerability in the Deployment component (CVE-2014-0403). Upstream has CVSSv2 scored this issue as: 5.8/AV:N/AC:M/Au:N/C:P/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA
It was discovered that the decoder (DocumentHandler in OpenJDK 7 and ObjectHandler OpenJDK 6) allowed processing of XML external entities. An application using JavaBeans could possibly disclose sensitive information, or be target of a DoS attack, triggered via XML external entities.
Oracle Java SE 6u71 and 7u51 fixes an unspecified vulnerability in the Deployment component (CVE-2014-0418). Upstream has CVSSv2 scored this issue as: 5.1/AV:N/AC:H/Au:N/C:P/I:P/A:P
External Reference:
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#AppendixJAVA
A flaw was found in the way the Networking component of OpenJDK checked permissions of code to listen on network ports. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions.
A flaw was found in the way JAAS (Java Authentication and Authorization Service) handled principals set for Subject. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions via deserialization of Subject.
It was discovered that the JAXP (Java API for XML Processing) component in OpenJDK did not properly check code permissions when creating document builder factories. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions.
It was discovered that the JSSE component in OpenJDK could leak some timing information during the TLS/SSL handshake. This could possibly lead to disclosure of some information about negotiated encryption keys.