It was discovered that the URLStreamHandler class in the Networking component of OpenJDK failed to properly parse user info from the URL. A remote attacker could cause Java application to incorrectly parse attacker provided URL and interpret it differently from other applications processing the same URL.

It was discovered that the LdapLoginModule class in the Java Authentication and Authorization Service (JAAS) component of OpenJDK did not use a correct way to extract user DN from a result of the LDAP query used to locate user in an LDAP database. A specially crafted user LDAP entry could cause the application to use incorrect DN.

It was discovered that the PNGImageReader in the javax.imageio package of the 2D component of OpenJDK performed parsing of iTXt and zTXt PNG image chunks even when ignoreMetadata was set to true. An attacker able to make a Java application parse a specially crafted PNG image could cause the application to consume an excessive amount of memory.

It was discovered that the RMI registry and DCG (Distributed Garbage Collector) implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application.

It was discovered that the ObjectIdentifier class in the Libraries component of OpenJDK did not check the length of the object identifier read from the input before allocating memory to store the OID. An attacker able to make a Java application to decode a specially crafted DER input could cause the application to use an excessive amount of memory. The DER encoding is used in e.g. X.509 certificates or LDAP protocol.

It was discovered that the ECDSASignature class in the Libraries component of OpenJDK accepted signatures using non-canonical DER encoding. This could cause a Java application to accept signature in an incorrect format not accepted by other cryptographic tools.