An insecure class construction flaw, related to the incorrect handling of exception stack frames, was found in the Hotspot component of OpenJDK. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

It was discovered that the atomic field updaters in the in the java.util.concurrent.atomic package in the Libraries component of OpenJDK did not properly restrict access to protected field members. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

It was discovered that the RMI registry and DCG (Distributed Garbage Collector) implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application.

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 7u121 and 8u112. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS v3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).

It was discovered that the ECDSASignature class in the Libraries component of OpenJDK accepted signatures using non-canonical DER encoding. This could cause a Java application to accept signature in an incorrect format not accepted by other cryptographic tools.

It was discovered that the PNGImageReader in the javax.imageio package of the 2D component of OpenJDK performed parsing of iTXt and zTXt PNG image chunks even when ignoreMetadata was set to true. An attacker able to make a Java application parse a specially crafted PNG image could cause the application to consume an excessive amount of memory.

A covert timing channel flaw was found in the ECDSA implementation in the Libraries component of OpenJDK. A remote attacker able to make a Java application generate ECDSA signatures on demand could possibly use this flaw to extract certain information about the key use via a timing side channel.

A covert timing channel flaw was found in the DSA implementation in the Libraries component of OpenJDK. A remote attacker able to make a Java application generate DSA signatures on demand could possibly use this flaw to extract certain information about the used key via a timing side channel.

It was discovered that the LdapLoginModule class in the Java Authentication and Authorization Service (JAAS) component of OpenJDK did not use a correct way to extract user DN from a result of the LDAP query used to locate user in an LDAP database. A specially crafted user LDAP entry could cause the application to use incorrect DN.

It was discovered that the ObjectIdentifier class in the Libraries component of OpenJDK did not check the length of the object identifier read from the input before allocating memory to store the OID. An attacker able to make a Java application to decode a specially crafted DER input could cause the application to use an excessive amount of memory. The DER encoding is used in e.g. X.509 certificates or LDAP protocol.

It was discovered that the URLStreamHandler class in the Networking component of OpenJDK failed to properly parse user info from the URL. A remote attacker could cause Java application to incorrectly parse attacker provided URL and interpret it differently from other applications processing the same URL.

Oracle Java SE 8u121 fixes an unspecified vulnerability in the Java Mission Control component (CVE-2017-3262). Upstream has CVSS scored this issue as: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

External Reference:

http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixJAVA

It was discovered that the URLClassLoader class in the Networking component of OpenJDK did not properly check access control context when downloading class files. An untrusted Java application or applet could use this flaw to make HTTP requests to locations that should not be accessible, bypassing certain Java sandbox restrictions.

An integer overflow flaw, leading to a buffer over-read, was found in the array boundary checks in SocketOutputStream and SocketInputStream in the Networking component of OpenJDK. An untrusted Java application or applet could use this flaw to disclose portions of the Java virtual machine memory and therefore bypass certain Java sandbox restrictions.

Oracle Java SE 6u141, 7u131, and 8u121 fixes an unspecified vulnerability in the Deployment component (CVE-2017-3259). Upstream has CVSS scored this issue as: 3.7/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

External Reference:

http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixJAVA

Oracle Java SE 8u121 fixes an unspecified vulnerability in the Java Mission Control component (CVE-2016-8328). Upstream has CVSS scored this issue as: 3.7/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

External Reference:

http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixJAVA