Indeed Lucene suffers from bugs in Oracle's Java 1.7u40 and 1.7u45.
However, 1.7u25 should be safe. You can find information about these bugs
in Lucene's JIRA and mailing-list. For example, here is one that affects
Java 1.7u40: https://issues.apache.org/jira/browse/LUCENE-5212
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.