A flaw was found in the reference implementation of the Java API for XML Web Services (JAX-WS). A remote client could possibly use this flaw to obtain sensitive information from the server via stack trace.
An integer overflow, leading to heap-based buffer overflow, was found in the Java2D code use for performing transformations of graphical shapes and images. An untrusted Java application or applet, or a specially crafted input for the trusted Java application, could cause application crash or lead to code execution.
It was discovered that RMI Registry implementation in OpenJDK did not properly restrict privileges of remotely executed code. A remote RMI client could use this flaw to execute code on the server with elevated privileges.
It was found that RMI Registry implementation in OpenJDK did not properly restrict access to some of its methods. A remote client able to connect to the RMI Registry could use this flaw to execute arbitrary code on the server running the registry.
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.233 and earlier, and JRockit R28.1.4 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound.
A flaw was found in the way javadoc (Java API Documentation Generator) created a JavaScript code used to set browser window title when navigating between pages of the generated API documentation. An input from user was not properly escaped before being used as part of the JavaScript string. A specially crafted input could "break out" of the JS string and execute arbitrary JavaScript in the context of the domain that hosts generated API documentation, allowing a Cross-Site Scripting attacks.
It was discovered that javac did not properly ignore certain ignorable characters. An attacker could influence the integrity and confidentiality of a system by providing specially crafted input, which is then used by javadoc to generate API documentation.
Upstream reports that this issue is relevant to uses where javadoc is used to generate documentation for an untrusted source code and have it hosted on a domain not controlled by the author of the source code (the attacker).
A denial of service flaw was found in the way the JRE processes XML. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service.
It was discovered that XMLConstants.FEATURESECUREPROCESSING setting was not properly honored by javax.xml.transform.TransformerFactory transformers. A remote attacker could use this flaw to supply crafted XML that would be processed without the intended security restrictions.
A denial of service flaw was discovered in the com.sun.org.apache.xml.internal.security.utils.UnsyncByteArrayOutputStream class. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service.
It was discovered that the awtgetPixelByte, awtgetPixelShort, awtsetPixelByte, and awtsetPixelShort functions did not properly verify certain raster attributes. A remote attacker could use this flaw to trigger a Java Virtual Machine memory corruption and, possibly, execute arbitrary code with the privileges of the user running the virtual machine.
It was discovered that various OpenJDK classes that represent cryptographic keys could leak private key information by including sensitive data in strings returned by toString() methods. If a Java application called the toString() method on any of the affected classes, it could possibly lead to an unexpected exposure of sensitive key data.
It was discovered that KRB5 / Kerberos implementation in OpenJDK did not properly parse KDC (Kerberos Key Distribution Center) responses. A malformed or truncated packet could cause a Java application using JGSS to exit because of an unexpected exception.
Unspecified vulnerability in the Oracle JRockit component in Oracle Fusion Middleware R27.7.4 and earlier and R28.2.6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: this might be a duplicate of CVE-2013-1537 and CVE-2013-2415. If so, then CVE-2013-2380 might be REJECTed in the future.