Bug 1385402 – CVE-2016-5582 OpenJDK: incomplete type checks of System.arraycopy arguments (Hotspot, 8160591)

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1385402 - (CVE-2016-5582) CVE-2016-5582 OpenJDK: incomplete type checks of System.arraycopy arguments (Hotspot, 8160591)

Summary:	CVE-2016-5582 OpenJDK: incomplete type checks of System.arraycopy arguments (...

Status:	CLOSED ERRATA

Aliases:	CVE-2016-5582

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	urgent Severity urgent
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=critical,public=20161018,repor...
Keywords:	Security

Depends On:
Blocks:	1381992
	Show dependency tree / graph

Reported:	2016-10-16 16:54 EDT by Tomas Hoger
Modified:	2017-01-13 03:12 EST (History)
CC List:	5 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-01-13 03:12:20 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2016:2079	normal	SHIPPED_LIVE	Critical: java-1.8.0-openjdk security update	2016-10-19 14:58:57 EDT
Red Hat Product Errata	RHSA-2016:2088	normal	SHIPPED_LIVE	Critical: java-1.8.0-oracle security update	2017-12-14 17:30:51 EST
Red Hat Product Errata	RHSA-2016:2089	normal	SHIPPED_LIVE	Critical: java-1.7.0-oracle security update	2017-12-14 17:42:23 EST
Red Hat Product Errata	RHSA-2016:2090	normal	SHIPPED_LIVE	Important: java-1.6.0-sun security update	2017-12-14 15:03:08 EST
Red Hat Product Errata	RHSA-2016:2658	normal	SHIPPED_LIVE	Important: java-1.7.0-openjdk security update	2016-11-07 13:27:12 EST
Red Hat Product Errata	RHSA-2017:0061	normal	SHIPPED_LIVE	Important: java-1.6.0-openjdk security update	2017-01-13 00:00:28 EST

Groups: None (edit)

Description Tomas Hoger 2016-10-16 16:54:10 EDT

It was discovered that the Hotspot component of OpenJDK did not check types of System.arraycopy() function arguments src and dest in certain cases.  An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and bypass Java sandbox restrictions.

Comment 1 Tomas Hoger 2016-10-18 16:09:36 EDT

Public now via Oracle CPU October 2016, fixed in Oracle JDK 8u111, 7u121, and 6u131.

External References:

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixJAVA

Comment 2 Tomas Hoger 2016-10-19 04:11:00 EDT

OpenJDK 8 upstream commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/rev/a3ede966ecfe

Comment 3 errata-xmlrpc 2016-10-19 11:19:30 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2016:2079 https://rhn.redhat.com/errata/RHSA-2016-2079.html

Comment 4 errata-xmlrpc 2016-10-20 08:38:28 EDT

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2016:2088 https://rhn.redhat.com/errata/RHSA-2016-2088.html

Comment 5 errata-xmlrpc 2016-10-20 08:49:13 EDT

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 5
  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2016:2090 https://rhn.redhat.com/errata/RHSA-2016-2090.html

Comment 6 errata-xmlrpc 2016-10-20 08:50:13 EDT

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 5
  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2016:2089 https://rhn.redhat.com/errata/RHSA-2016-2089.html

Comment 7 errata-xmlrpc 2016-11-07 08:27:59 EST

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2016:2658 https://rhn.redhat.com/errata/RHSA-2016-2658.html

Comment 8 errata-xmlrpc 2017-01-12 19:01:17 EST

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2017:0061 https://rhn.redhat.com/errata/RHSA-2017-0061.html

Note You need to log in before you can comment on or make changes to this bug.