Holes still exist in Oracle's Java software that could potentially leave machines open to remote execution of malicious code, according to a researcher.