It was discovered that the 2D component did not properly verify certain image channels. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

java.lang.invoke.MethodHandles did not perform access checks correctly. An untrusted Java application or applet could use this to set value of a final field.

An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.