Java 7 and OpenJDK share a lot of common code, so, as a general rule, security issues in Java 7 also apply to OpenJDK. In that specific case, it seems that the vulnerability was reported in the Debian OpenJDK package, so yes, they are vulnerable. See this question on another stackexchange site. Since Oracle seems to have fixed their JDK, chances are that the same fix will appear in OpenJDK in a few hours or days.
On the bright side, if you use OpenJDK and IcedTea, then chances are that you use Linux. Malware authors rarely target Linux systems, because there are not that many people who browse the Web from a Linux machine, and there are a lot of different "Linux systems" which make it difficult to write a piece of binary code (such as malware) which will run on most of them (the Linux ecosystem relies on source code distribution and per-distribution packaging, rather than real binary compatibility). Therefore, malware authors usually deem Linux "not worth the effort". This goes a long way towards explaining the scarcity of malware on Linux.
My gut feeling is that the fix will be available on the normal update channels way before any Linux machine is actually attacked in the wild (but you do not have to trust my guts -- personally, I don't).