Patch Java now, says Oracle. Leave the Easter chocolate until later
Malicious web page could achieve remote PC takeover without authentication
Oracle is urging Java users to upgrade, ASAP, to crimp a very nasty bug in the desktop and browser plug-in versions of the software.
Labelled CVE-2016-0636, the flaw scored a 9.3 on the Common Vulnerability Scoring System bug severity rating.
That high score comes about because the flaw means attackers “can impact the availability, integrity, and confidentiality of the user's system.” Worse still, an attacker can do that remotely, without authentication.
In other words, visit the wrong web site with un-patched Java and there's a decent chance crims can rummage through your entire computer then hop onto your network. What happens next doesn't bear thinking about.
Big Red's posted an update version of Java, Java SE 8u77, here. Or you can trust to auto-updates on Windows.
Long story short: however you get the fix, get off Oracle Java SE 7 Update 97, and 8 Update 73 and 74, on Windows, Solaris, Linux, and Mac OS X.
And then go stuff yourself with Easter Eggs. ®