A flaw was found in the way javadoc (Java API Documentation Generator) created a JavaScript code used to set browser window title when navigating between pages of the generated API documentation. An input from user was not properly escaped before being used as part of the JavaScript string. A specially crafted input could "break out" of the JS string and execute arbitrary JavaScript in the context of the domain that hosts generated API documentation, allowing a Cross-Site Scripting attacks.
Upstream reports that this issue is relevant to uses where javadoc is used to generated documentation for an untrusted source code and have it hosted on a domain not controlled by the author of the source code (the attacker). However, the exact use case upstream tried to address is not clear. Javadoc documentation found in the java sources is handled as HTML and is embedded into generated HTML pages without escaping of HTML special characters (such as < and >). Hence JavaScript code used to set browser window title is not the only way untrusted source code can trigger XSS. Additionally, upstream fix only escapes quotes and fails to escape </script>.
External References: http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
Fixed in Oracle Java SE 7u45 and 6u65. OpenJDK upstream commit: http://hg.openjdk.java.net/jdk7u/jdk7u/langtools/rev/de93f4bc2c76
This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 6 Supplementary for Red Hat Enterprise Linux 5 Via RHSA-2013:1440 https://rhn.redhat.com/errata/RHSA-2013-1440.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2013:1447 https://rhn.redhat.com/errata/RHSA-2013-1447.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2013:1451 https://rhn.redhat.com/errata/RHSA-2013-1451.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Via RHSA-2013:1505 https://rhn.redhat.com/errata/RHSA-2013-1505.html
This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 6 Supplementary for Red Hat Enterprise Linux 5 Via RHSA-2013:1509 https://rhn.redhat.com/errata/RHSA-2013-1509.html
This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2013:1508 https://rhn.redhat.com/errata/RHSA-2013-1508.html
This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2013:1507 https://rhn.redhat.com/errata/RHSA-2013-1507.html
This issue has been addressed in following products: Red Hat Network Satellite Server v 5.4 Red Hat Network Satellite Server v 5.5 Red Hat Satellite Server v 5.6 Via RHSA-2013:1793 https://rhn.redhat.com/errata/RHSA-2013-1793.html
Fixed in IcedTea7 2.4.3 and IcedTea6 1.11.14 and 1.12.7: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-October/025087.html http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-November/025278.html http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-November/025328.html
This issue has been addressed in following products: Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 5 Via RHSA-2014:0414 https://rhn.redhat.com/errata/RHSA-2014-0414.html