Bug 1386112 (CVE-2016-5568) - CVE-2016-5568 OpenJDK: incorrect menu handling on Windows (AWT, 8158993)
Summary: CVE-2016-5568 OpenJDK: incorrect menu handling on Windows (AWT, 8158993)
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2016-5568
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1381992
TreeView+ depends on / blocked
 
Reported: 2016-10-18 08:04 UTC by Tomas Hoger
Modified: 2021-02-17 03:10 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-10-18 08:06:33 UTC
Embargoed:


Attachments (Terms of Use)

Description Tomas Hoger 2016-10-18 08:04:12 UTC
A flaw was found in the way the AWT component of OpenJDK running on Microsoft Windows platform handled menus.  An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Comment 1 Tomas Hoger 2016-10-18 08:06:33 UTC
This flaw only affects OpenJDK versions running on Microsoft Windows.  OpenJDK versions for Linux do not use the affected code and were therefore not affected by this issue.

Comment 2 Tomas Hoger 2016-10-18 20:09:20 UTC
Public now via Oracle CPU October 2016, fixed in Oracle JDK 8u111, 7u121, and 6u131.

External References:

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixJAVA

Comment 3 Tomas Hoger 2016-10-19 08:02:40 UTC
OpenJDK 8 upstream commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/f75edc10277f


Note You need to log in before you can comment on or make changes to this bug.