Bug 1385402 (CVE-2016-5582)

Summary:	CVE-2016-5582 OpenJDK: incomplete type checks of System.arraycopy arguments (Hotspot, 8160591)
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	dbhole, jvanek, kbost, sardella, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-01-13 08:12:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1381992

Description Tomas Hoger 2016-10-16 20:54:10 UTC

It was discovered that the Hotspot component of OpenJDK did not check types of System.arraycopy() function arguments src and dest in certain cases.  An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and bypass Java sandbox restrictions.

Comment 1 Tomas Hoger 2016-10-18 20:09:36 UTC

Public now via Oracle CPU October 2016, fixed in Oracle JDK 8u111, 7u121, and 6u131.

External References:

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixJAVA

Comment 2 Tomas Hoger 2016-10-19 08:11:00 UTC

OpenJDK 8 upstream commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/rev/a3ede966ecfe

Comment 3 errata-xmlrpc 2016-10-19 15:19:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2016:2079 https://rhn.redhat.com/errata/RHSA-2016-2079.html

Comment 4 errata-xmlrpc 2016-10-20 12:38:28 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2016:2088 https://rhn.redhat.com/errata/RHSA-2016-2088.html

Comment 5 errata-xmlrpc 2016-10-20 12:49:13 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 5
  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2016:2090 https://rhn.redhat.com/errata/RHSA-2016-2090.html

Comment 6 errata-xmlrpc 2016-10-20 12:50:13 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 5
  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2016:2089 https://rhn.redhat.com/errata/RHSA-2016-2089.html

Comment 7 errata-xmlrpc 2016-11-07 13:27:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2016:2658 https://rhn.redhat.com/errata/RHSA-2016-2658.html

Comment 8 errata-xmlrpc 2017-01-13 00:01:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2017:0061 https://rhn.redhat.com/errata/RHSA-2017-0061.html