It was discovered that the Pipe (java.nio.channels.Pipe) implementation in the Networking component of OpenJDK that is used on the Microsoft Windows platformed used an insecure method to authenticate process which can use the Pipe. A local attacker could possibly use the flaw to connect to the Pipes created by other Java programs running on the system. This issue did not affect OpenJDK versions running on Linux, where Pipe is implemented using the pipe() system call. On Windows, Pipe support is implemented via a network socket listening on a loopback address (127.0.0.1) and using authentication with a secret value to prevent unauthorized access to the Pipe. A weak method to generate the secret could possibly allow bypass of the authentication mechanism.
Public now via Oracle CPU July 2016, fixed in Oracle JDK 8u101, 7u111, and 6u121. External References: http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixJAVA
OpenJDK 8 upstream commit: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/a3a382d63d5b