Oracle blocks security hole with quick, hot 'n' premature Java update
Rushed out 2 weeks early
Oracle has brought forward the timetable of an upcoming Java security update by two weeks in order to block off an in-the-wild security hole.
The update, originally scheduled for 19 February, was released a fortnight early on Friday because of "active exploitation 'in the wild' of one of the vulnerabilities affecting the Java Runtime Environment (JRE) in desktop browsers".
The update covers 50 flaws, 49 of which are remotely exploitable. More than half (26) of the bunch carry the maximum Common Vulnerability Scoring System (CVSS) risk score of 10.
The latest official versions are Java 7 Update 13 and Java 6 Update 39. This month (February 2013) marks the end of life of Java 6.
Despite the update, security experts continue to advise against installing Java plug-in on browsers. If users do need to use Java applets to use certain sites, or for internal applications, then these should be accessed using a second browser, not used for day-to-day surfing.
The security implications of the Java security update can be found in a blog post by Paul Ducklin of Sophos here. ®