It was discovered that the Libraries component in OpenJDK failed to properly handle ZIP archives that contain entries with NUL byte ('\0') used in the file name. When extracting data from such archives, OpenJDK could use different file than expected. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Public now via Oracle Critical Patch Update - October 2014. Fixed in Oracle Java SE 8u25.
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2014:1636 https://rhn.redhat.com/errata/RHSA-2014-1636.html
Upstream OpenJDK commit: