Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Install.
It was discovered that the Libraries component contained certain errors related to XML security and the class loader. A remote attacker could possibly exploit this flaw to disclose potentially sensitive information and cause a denial of service.
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5812). Upstream has CVSSv2 scored this issue as: 6.4/AV:N/AC:L/Au:N/C:P/I:N/A:P
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
It was discovered that java.util.TimeZone does not properly restrict changing the time zone to the default time zone. An untrusted Java application or applet could exploit this to change the default time zone of their application contexts.
It was discovered that javac did not properly ignore certain ignorable characters. An attacker could influence the integrity and confidentiality of a system by providing specially crafted input, which is then used by javadoc to generate API documentation.
Upstream reports that this issue is relevant to uses where javadoc is used to generate documentation for an untrusted source code and have it hosted on a domain not controlled by the author of the source code (the attacker).
It was discovered that AWT JTable did not properly perform certain access checks. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Hotspot.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality and integrity, related to JMX.
The SerialJavaObject class of the JDBC component did not properly restrict access to certain class packages. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE 7 update 4 and earlier and 6 update 32 and earlier, and the GlassFish Enterprise Server component in Oracle Sun Products Suite GlassFish Enterprise Server 3.1.1, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Web Container or Deployment.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Concurrency.
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, and JavaFX 2.0 allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality and integrity via unknown vectors related to Deployment.
Oracle Java SE 7 Update 25 fixes an unspecified vulnerability in the Deployment component (CVE-2013-2437). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
It was discovered that the ObjectOutputStream class did not properly perform certain access checks when handling subclasses. An untrusted Java application or applet could possibly use this flaw to disclose potentially sensitive information.
It was discovered that the ObjectStreamClass class did not properly protect against circular references. An untrusted Java application or applet could possibly use this flaw to cause a denial of service.
It was discovered that the Networking component did not properly prevent the local address from being revealed. An untrusted Java application or applet could possibly use this flaw to disclose the local address.
It was discovered that access checks for getEnclosingClass, getEnclosingMethod and getEnclosingConstructor were not performed properly. An untrusted Java application or applet could possibly use this flaw to disclose potentially sensitive information.
It was discovered that the AWT component did not properly manage and restrict certain resources related to the processing of fonts. An untrusted Java application or applet could possibly use this flaw to exhaust available resources and cause a denial of service.
It was discovered that the MBeanServer Introspector of the JMX component did not properly verify the package access. An untrusted Java application or applet could possibly use this flaw to bypass intended package restrictions.
It was discovered that CORBA output streams did not properly implement access restrictions. An untrusted Java application or applet could possibly use this flaw to disclose potentially sensitive information.
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5831). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5819). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5818). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
It was discovered that the Inet6Address class contained errors when processing IPv6 addresses. This could lead to inaccurate results when processing IPv6 addresses, for example during serialization.
Oracle Java SE Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-5776). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
A denial of service flaw was found in the way the JRE processes XML. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service.
Oracle Java SE Update 45 fixes an unspecified vulnerability in the 2D component (CVE-2013-5801). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
A denial of service flaw was discovered in the com.sun.org.apache.xml.internal.security.utils.UnsyncByteArrayOutputStream class. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service.
It was discovered that the java.rmi.dgc.VMID class did not create entirely unique and unpredictable IDs. An untrusted Java application or applet could possibly use this flaw to disclose potentially sensitive information.
It was discovered that getDeclaringClass() method implementation did not perform class loader package access checks. In certain configurations, an untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions.