Sun Microsystems has issued patches for several vulnerabilities in its Java Runtime Environment that leave users on Windows, Linux and Solaris wide open.

By our count, there are 11 separate vulnerabilities plaguing versions 6, 5, 1.4 and 1.3 of the JRE, Sun said on its security blog.

Miscreants could use the "highly critical" bugs to read or alter sensitive information stored on a vulnerable machine, bypass security restrictions and compromise systems, according to an alert from Secunia.

Java's write-once-run-anywhere sales pitch, it would seem, applies equally to vulnerabilities, since it makes users of some of the most hardened systems susceptible to crippling attacks.

Sun acknowledged a host of researchers for discovering the flaw. They included Billy (BK) Rios, Peter Csepely, Giorgio Maone Dan Boneh, Collin Jackson, Adam Barth, Andrew Bortz, Weidong Shao and David Byrne. ®

Related stories

• Fat or thin: an insider's view on Java's destiny (9 November 2007)

  https://www.theregister.com/2007/11/09/haase_opnion_java_future/

• Sun clarifies client-side Java strategy (sort of) (18 October 2007)

  https://www.theregister.com/2007/10/18/sun_sketches_client_side_java_roadmap/

• The Misfit Geek and AJAX acceptability (8 October 2007)

  https://www.theregister.com/2007/10/08/ajax_stagner_microsoft/

• Java and Flash fixes tax system security (16 July 2007)

  https://www.theregister.com/2007/07/16/flash_java_patches/

• Sun's handling of Java security update prompts concerns (10 July 2007)

  https://www.theregister.com/2007/07/10/sun_java_security_update/

• Solaris offers fix for zero-day vuln (1 March 2007)

  https://www.theregister.com/2007/03/01/solaris_security_worm/

• Sun buys Linux and Solaris patch whiz (22 February 2006)

  https://www.theregister.com/2006/02/22/aduva_goes_sun/