java.lang.invoke.MethodHandles did not perform access checks correctly. An untrusted Java application or applet could use this to set value of a final field.

A flaw was found in the way javadoc (Java API Documentation Generator) created a JavaScript code used to set browser window title when navigating between pages of the generated API documentation. An input from user was not properly escaped before being used as part of the JavaScript string. A specially crafted input could "break out" of the JS string and execute arbitrary JavaScript in the context of the domain that hosts generated API documentation, allowing a Cross-Site Scripting attacks.

Unspecified vulnerability in Oracle Java SE 7u40 and earlier and JavaFX 2.2.40 and earlier allows remote attackers to affect confidentiality via unknown vectors.

It was discovered that jhat (Java Heap Analysis Tool) failed to properly escape all data embedded into HTML pages it generates. A specially crafted content in the memory of a Java program analyzed using jhat could possibly be used to conduct a Cross-Site Scripting attacks against users view jhat generated pages.

It was discovered that KRB5 / Kerberos implementation in OpenJDK did not properly parse KDC (Kerberos Key Distribution Center) responses. A malformed or truncated packet could cause a Java application using JGSS to exit because of an unexpected exception.

It was discovered that the Networking component did not properly enforce exclusive port binding. A local attacker could exploit this flaw to bind to ports intended to be exclusively bound.

It was discovered that JAX-WS could possibly create temporary files with insecure permissions. A local attacker could use this flaw to access temporary files created by an application using JAX-WS.

It was discovered that the 2D component created shared memory segments with insecure permissions. A local attacker could use this flaw to read or write to the shared memory segment.