Arch Linux

Description:
CVE-2020-14779
It was discovered that the implementation of the Proxy class in the Serialization component of OpenJDK could trigger an out-of-memory condition when deserializing Proxy class objects with many interfaces. A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized.
The patch for this issue adds a new system property jdk.serialProxyInterfaceLimit that can be used to reduce the limit for Proxy interfaces from the default of 65535 and hence better protect against excessive memory usage.
Fixed in 15.0.1, 11.0.9, 8u271, and 7u281. [1]

CVE-2020-14781
It was discovered that the LDAP client implementation in the JNDI component of OpenJDK did not properly track whether a connection to a server uses TLS encryption, and consequently did not properly restrict the set of authentication mechanisms that were allowed to be used over an unencrypted connection. This could possibly lead to sending of plain text authentication credentials over an unencrypted connection.
Fixed in 15.0.1, 11.0.9, 8u271, and 7u281. [1]

CVE-2020-14782
A flaw was found in the way the Libraries component of OpenJDK handled blacklists of untrusted certificates. Alternate certificate encodings were not considered, causing certain certificate fingerprints to not be blacklisted, possibly leading to untrusted certificates being accepted.
Fixed in 15.0.1, 11.0.9, 8u271, and 7u281. [1]

CVE-2020-14792
It was discovered that the Hotspot component of OpenJDK did not properly check for integer overflows when when optimizing code, leading to out-of-bounds access. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
Fixed in 15.0.1, 11.0.9, 8u271, and 7u281. [1]

CVE-2020-14796
It was discovered that the Libraries component of OpenJDK failed to perform permission check when converting file system paths to URI in UnixUriUtils and WindowsUriSupport classes. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
Fixed in 15.0.1, 11.0.9, 8u271, and 7u281. [1]

CVE-2020-14797
It was discovered that the UnixUriUtils class in the Libraries component of OpenJDK did not properly check for invalid characters when performing URI to Path conversion. This could lead to creating Path objects with invalid paths.
Fixed in 15.0.1, 11.0.9, 8u271, and 7u281. [1]

2020-14798
No information except it is in the libraries component.
Fixed in 15.0.1, 11.0.9, 8u271, and 7u281. [1]

CVE-2020-14803
It was discovered that the NIO Buffer implementation in the Libraries component of OpenJDK contained a race condition affecting boundary checks. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
Fixed in 15.0.1and 11.0.9 [1]

Additional info:
* jdk-openjdk 14.0.2.u12-1
[1] https://www.oracle.com/security-alerts/cpuoct2020.html#AppendixJAVA