A flaw was found in the way the dropArguments() method of the MethodHandles class in the Libraries component of OpenJDK handled its valueTypes argument. As it did not create a copy of the list, caller could modify it after it was checked by the dropArguments() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Public now via Oracle CPU July 2016, fixed in Oracle JDK 8u101. External References: http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixJAVA
OpenJDK 8 upstream commit: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/5e7489ac05f0
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2016:1458 https://access.redhat.com/errata/RHSA-2016:1458
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 7 Via RHSA-2016:1475 https://access.redhat.com/errata/RHSA-2016:1475
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2016:1504 https://rhn.redhat.com/errata/RHSA-2016-1504.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Supplementary Via RHSA-2016:1589 https://rhn.redhat.com/errata/RHSA-2016-1589.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Supplementary Red Hat Enterprise Linux 7 Supplementary Via RHSA-2016:1588 https://rhn.redhat.com/errata/RHSA-2016-1588.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Supplementary Red Hat Enterprise Linux 7 Supplementary Via RHSA-2016:1587 https://rhn.redhat.com/errata/RHSA-2016-1587.html
This issue has been addressed in the following products: Red Hat Satellite 5.6 Red Hat Satellite 5.7 Via RHSA-2017:1216 https://access.redhat.com/errata/RHSA-2017:1216