REDHAT-BUG-1356971: Openjdk vulnerability

Published Jul 15, 2016

Updated

A flaw was found in the way the dropArguments() method of the MethodHandles class in the Libraries component of OpenJDK handled its valueTypes argument. As it did not create a copy of the list, caller could modify it after it was checked by the dropArguments() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Affected Software

1 affected component

OpenJDK OpenJDK

Event History

Jul 15, 2016

Data Sourced

via Red Hat·12:00 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1356971?

The severity of REDHAT-BUG-1356971 is categorized as Medium.

How do I fix REDHAT-BUG-1356971?

To fix REDHAT-BUG-1356971, update your OpenJDK to the latest patched version.

Which versions of OpenJDK are affected by REDHAT-BUG-1356971?

REDHAT-BUG-1356971 affects multiple versions of OpenJDK prior to the security fix.

What type of vulnerability is REDHAT-BUG-1356971?

REDHAT-BUG-1356971 is a vulnerability related to improper handling of valueTypes in the MethodHandles class.

Can an untrusted Java application exploit REDHAT-BUG-1356971?

Yes, an untrusted Java application can exploit REDHAT-BUG-1356971 due to the flaw in the dropArguments() method.