IBM JDK 8 SR5 FP30 (8.0.5.30) fixes a flaw described by upstream as:

Eclipse OpenJ9 could allow a remote attacker to execute arbitrary code on the system, caused by the failure to omit a null check on the receiver object of an Unsafe call when accelerating it. An attacker could exploit this vulnerability to execute arbitrary code on the system.

OpenJ9 upstream bug:

https://bugs.eclipse.org/bugs/showbug.cgi?id=544019

Related OpenJ9 upstream commit seems to be:

https://github.com/eclipse/openj9/commit/531d3f96fe9cdcf6baad9f6d6837be8fbc805d8d

References:

https://www-01.ibm.com/support/docview.wss?uid=ibm10873332 https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBMSecurityUpdateMarch2019

In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which accept pointer values that are dereferenced in the native code.