It was discovered that the FTP client implementation in the Networking component of OpenJDK failed to correctly handle user inputs (e.g. usernames and passwords) containing newline characters. A remote attacker could possibly use this flaw to manipulate an FTP connection opened by a Java application if it could make it access a specially crafted FTP URL.

Blog posts were published that describe how to use this flaw to open ports on firewalls using active FTP connections:

http://blog.blindspotsecurity.com/2017/02/advisory-javapython-ftp-injections.html

and sending mails during XML parsing when use of XML external entities is allowed:

https://shiftordie.de/blog/2017/02/18/smtp-over-xxe/

It was discovered that the SMTP client implementation in the Networking component of OpenJDK failed to correctly handle sender and recipient addresses containing newline characters. A remote attacker could possibly use this flaw to manipulate an SMTP connection opened by a Java application if it could make it send an email to or from a specially crafted address.