A flaw was found in the factory finder implementation in JAXP used to find XML stream factories. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions.
External References: http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
Fixed in Oracle Java SE 7u45. OpenJDK upstream commit: http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/rev/399c58bf22ad
This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 6 Supplementary for Red Hat Enterprise Linux 5 Via RHSA-2013:1440 https://rhn.redhat.com/errata/RHSA-2013-1440.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2013:1447 https://rhn.redhat.com/errata/RHSA-2013-1447.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2013:1451 https://rhn.redhat.com/errata/RHSA-2013-1451.html
This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2013:1508 https://rhn.redhat.com/errata/RHSA-2013-1508.html
This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2013:1507 https://rhn.redhat.com/errata/RHSA-2013-1507.html
This issue has been addressed in following products: Red Hat Network Satellite Server v 5.4 Red Hat Network Satellite Server v 5.5 Red Hat Satellite Server v 5.6 Via RHSA-2013:1793 https://rhn.redhat.com/errata/RHSA-2013-1793.html
Fixed in IcedTea7 2.4.3: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-October/025087.html