Integer overflow flaws were found in the way the Hotspot component of OpenJDK read bytecode from class files. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
Public now via Oracle CPU July 2016, fixed in Oracle JDK 8u101, 7u111, and 6u121. External References: http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixJAVA
OpenJDK 8 upstream commit: http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/rev/9edc175ff3e6
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2016:1458 https://access.redhat.com/errata/RHSA-2016:1458
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 5 Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 6 Via RHSA-2016:1477 https://access.redhat.com/errata/RHSA-2016:1477
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 5 Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 6 Via RHSA-2016:1476 https://access.redhat.com/errata/RHSA-2016:1476
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 7 Via RHSA-2016:1475 https://access.redhat.com/errata/RHSA-2016:1475
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2016:1504 https://rhn.redhat.com/errata/RHSA-2016-1504.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2016:1776 https://rhn.redhat.com/errata/RHSA-2016-1776.html