It was discovered that the decoder (DocumentHandler in OpenJDK 7 and ObjectHandler OpenJDK 6) allowed processing of XML external entities. An application using JavaBeans could possibly disclose sensitive information, or be target of a DoS attack, triggered via XML external entities.

It was discovered that the JSSE component in OpenJDK could leak some timing information during the TLS/SSL handshake. This could possibly lead to disclosure of some information about negotiated encryption keys.

An insufficient input validation check flaw was found in the ICU Layout Engine's LookupProcessor, which is part of OpenJDK 2D component. A specially crafted font file could cause Java application to crash or execute arbitrary code. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.

This fix improves checks added in the fix for CVE-2012-1713 (bug 829361).