It's actually pretty hard to find details, maybe because I don't know any good security-related blogs, but I did find this about a recent exploit: http://www.security-faqs.com/another-day-another-java-0-day....

Java downloaded an executable with a misleading '.jpg' extension and then executed it (it was a trojan that downloads other malware: http://go.eset.com/us/threat-center/encyclopedia/threats/win... ).