Critical Patch UpdatesNo reason to think this wouldn't be a Security Alert.
Critical Patch Updates are collections of security fixes for Oracle products. They are available to customers with valid support contracts. They are released on the Tuesday closest to the 17th day of January, April, July and October.
Security Alerts
Oracle will issue Security Alerts for vulnerability fixes deemed too critical to wait for distribution in the next Critical Patch Update
From inside one?Wasn't there a recent FPP about some virus writers who included a chat client in their virus. Then they used it to make fun of the virus researchers and shut down the VM they were using to investigate the virus?
Security Explorations reported 19 Java 7 security issues to Oracle on Apr. 2. Those issues included the two zero-day -- unpatched -- vulnerabilities that attackers are exploiting to infect computers with malware, Gowdiak said Wednesday via email.
The company continued to report Java 7 vulnerabilities to Oracle in the following months until the total number reached 29. "We demonstrated 16 full Java SE 7 sandbox compromises with the use of our bugs," Gowdiak said.
(long snip)
According to a status report received on Aug. 23 from Oracle, the company was planning to fix the two vulnerabilities in its October Critical Patch Update (CPU), together with 17 other Java 7 flaws reported by Security Explorations, Gowdiak said.
Oracle releases security patches every four months. The last Java CPU was released in June and only addressed 3 of the security issues reported by Polish security firm.
"Although we stay in touch with Oracle and the communication process has been quite flawless so far, we don't know why Oracle left so many serious bugs for the Oct. CPU," Gowdiak said.
Security Explorations is not aware of any changes in Oracle's patching plans at this time, Gowdiak said. "But, we hope they will stand up to the task and release a Java CPU fixing the security issues as soon as possible."
if vulnerable, you'll want to at least disable Java in your Web browser, if not remove it altogether. On Firefox, NoScript will provide a little protection, by not running Java code unless you click it, but the vulnerability remains.Uh... you do understand the difference between Java and Javascript, right? NoScript kills javascript, not Java. Firefox disables Java when there's a security problem, and Chrome always asks if you want to run it by default. In either of those two browsers, you should be safe without needing to do anything.
I forget, why the hell did Oracle buy Sun anyway? Other than getting a halfway decent patent library for a relatively cheap price it doesn't really seem like Oracle wants anything to do with about 99% of Sun's product lines.Java is huge on the server side, and this doesn't really affect that at all (since servers generally don't download and run untrusted code). In fact, along with C++ it's one of the most popular languages for writing custom code. It's also used frequently for desktop software (like minecraft). Also, most of Android is written in the Java language (although with a totally different runtime)
Type safety is the whole point of having Generics. The problem with Java's generics is that they wanted the code to be backwards compatible. So a List<String> needs to have the same function signature as a List object created in pre JDK 1.5 code.
Java really is a strange language now. It's still dominated by some of the its goals, like type safety, which has led to things like the grotesque implementation of generics that they had to do.
It looks like VMs aren't necessarily secure. (Not necessarily a bad idea, mind you, but not unbreakable)Anything scriptable is exploitable. In fact, if you can find a buffer overflow or something you don't even need scripting. Pretty much everything has been exploited at one point or another.
No, it does not. Other then the name, Javascript has NOTHING to do with Java. It was developed independently at Netscape, and it was originally going to be called "LiveScript" but when Sun wanted to put out Java, they decided to do some "co-branding" they don't share any code or work together in any way. You don't need anything relating to Java on your system at all to run Javascript.
I'm still not sure, though, if allowing a site to run Javascript also allows it to run Java.
Right on cue, Java has responded to my hatred in kind. Shortly after I awoke to discover my previous article denouncing the language had been published, a client called to inform me his computer had contracted some malware. Java has, if you'll forgive the anthropomorphization of a bytecode virtualization engine, decided to exact its revenge.Oh shit, it's alive.
« Older Perez Hamilton... | The alternative to admitting t... Newer »
This thread has been archived and is closed to new comments
On my own machine, I've removed Java completely, as I can live without Minecraft until a patch comes out. But just disabling it in the browser is probably adequate, as long as you are very careful about what you download.
posted by Malor at 1:33 PM on August 29, 2012