It was discovered that the ObjectInputStream class in the Serialization component of OpenJDK failed to properly ensure thread consistency when deserializing serialized input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Public now via Oracle Critical Patch Update - April 2016. Fixed in Oracle Java SE 6u115, 7u101, and 8u91. External References: http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html#AppendixJAVA
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2016:0651 https://rhn.redhat.com/errata/RHSA-2016-0651.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:0650 https://rhn.redhat.com/errata/RHSA-2016-0650.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 7 Via RHSA-2016:0676 https://rhn.redhat.com/errata/RHSA-2016-0676.html
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 7 Via RHSA-2016:0677 https://rhn.redhat.com/errata/RHSA-2016-0677.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2016:0675 https://rhn.redhat.com/errata/RHSA-2016-0675.html
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 5 Oracle Java for Red Hat Enterprise Linux 6 Via RHSA-2016:0679 https://rhn.redhat.com/errata/RHSA-2016-0679.html
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 5 Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 7 Via RHSA-2016:0678 https://rhn.redhat.com/errata/RHSA-2016-0678.html
OpenJDK8 upstream commit: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/4138b3f27ffe
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Supplementary Red Hat Enterprise Linux 6 Supplementary Via RHSA-2016:0701 https://rhn.redhat.com/errata/RHSA-2016-0701.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Supplementary Via RHSA-2016:0702 https://rhn.redhat.com/errata/RHSA-2016-0702.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Supplementary Red Hat Enterprise Linux 5 Supplementary Via RHSA-2016:0708 https://rhn.redhat.com/errata/RHSA-2016-0708.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Supplementary Via RHSA-2016:0716 https://rhn.redhat.com/errata/RHSA-2016-0716.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Via RHSA-2016:0723 https://rhn.redhat.com/errata/RHSA-2016-0723.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Supplementary Via RHSA-2016:1039 https://rhn.redhat.com/errata/RHSA-2016-1039.html
This issue has been addressed in the following products: Red Hat Satellite 5.6 Red Hat Satellite 5.7 Via RHSA-2016:1430 https://access.redhat.com/errata/RHSA-2016:1430
This issue has been addressed in the following products: Red Hat Satellite 5.6 Red Hat Satellite 5.7 Via RHSA-2017:1216 https://access.redhat.com/errata/RHSA-2017:1216