I need to determine whether a user's version of OpenJDK is susceptible to a particular security vulnerability. As an example, CVE-2016-0695 was discovered in OpenJDK 8u77, as revealed in the April 2016 Critical Patch Update. Ideally, detecting whether a user's OpenJDK version is vulnerable would be as simple as checking whether it's <= 8u77 or > 8u77 and accordingly marking it as vulnerable or not (assuming that all previous versions are also vulnerable and that the fix gets applied by the next version). The picture gets muddied by manual patches, though.
If I understand correctly, the April 2016 patch would be automatically bundled into the next version of OpenJDK8 (8u91, in this case), but would also be available for manual application. The latter would probably be an attractive option to risk-averse users who want to keep their Java version as-is while patching security holes. If a user manually applies the patch to their 8u77 install, is there any way for me to detect that? For instance, does the version number reported by java -version change? Or is there no indicator that a patch had been applied?