[lmm]

Those are vulnerabilities in the JVM itself - and I'd bet a fair bit the majority will be in the C/C++ parts, not the Java parts.