Oracle blocks security hole with quick, hot 'n' premature Java update
Rushed out 2 weeks early
Agentless Backup is Not a Myth
Oracle has brought forward the timetable of an upcoming Java security update by two weeks in order to block off an in-the-wild security hole.
The update, originally scheduled for 19 February, was released a fortnight early on Friday because of "active exploitation 'in the wild' of one of the vulnerabilities affecting the Java Runtime Environment (JRE) in desktop browsers".
The update covers 50 flaws, 49 of which are remotely exploitable. More than half (26) of the bunch carry the maximum Common Vulnerability Scoring System (CVSS) risk score of 10.
The latest official versions are Java 7 Update 13 and Java 6 Update 39. This month (February 2013) marks the end of life of Java 6.
Despite the update, security experts continue to advise against installing Java plug-in on browsers. If users do need to use Java applets to use certain sites, or for internal applications, then these should be accessed using a second browser, not used for day-to-day surfing.
The security implications of the Java security update can be found in a blog post by Paul Ducklin of Sophos here. ®
COMMENTS
Re: If Java were a boat
> Yes, but your Java boat could sink in any ocean, sea, lake, river, stream, brook or pond anywhere in the world.
Float once, sink anywhere?
Re: If Java were a boat
Yes, but your Java boat could sink in any ocean, sea, lake, river, stream, brook or pond anywhere in the world.
Re: Anyone else get a 'invalid certificate' fail on trying to install this update?
Recommending to uninstall the old versions.
Then log in as admin.
THEN install. Oracle/Sun still haven't fixed the bug from ... 2011 or so whereby installation won't proceed by User Account Control only.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
