Oracle releases new Java fixes, speeds up patching cycle

Oracle patches five more Java vulnerabilities that weren't fixed in a security update earlier in February

Oracle released new Java security updates on Tuesday and announced plans to accelerate the release of future Java patches following recent attacks that have infected computers with malware by exploiting zero-day vulnerabilities in Java browser plug-ins.

The new updates, Java 7 Update 15 and Java 6 Update 41, address five additional vulnerabilities that couldn't be included in the emergency Java update that Oracle released on Feb. 1 due to time constraints. At the time, Oracle broke out of its scheduled 4-month Java patching cycle in order to patch a vulnerability that was being actively exploited by hackers.

Four of the five vulnerabilities addressed in the Tuesday updates can be exploited through Java Web Start applications on desktops and Java applets in Internet browsers, Eric Maurice, Oracle's director of software assurance, said Tuesday in a blog post.

Three of those four vulnerabilities received the highest rating on the Common Vulnerability Scoring System scale -- 10 -- which means they are critical and can be exploited to completely compromise the confidentiality, integrity, and availability of systems where Java runs with administrator privileges, such as Windows XP. On systems where Java does not run with administrative privileges, such as Linux or Solaris, the impact is lower, Maurice said.

The fifth vulnerability affects server deployments of the Java Secure Socket Extension (JSSE) and stems from the Lucky Thirteen attack against SSL/TLS implementations that security researchers disclosed earlier this month.

Even though the new Java 6 Update 41 is available for download from Oracle's website, it is not available from Java.com and must be obtained manually. The updating feature in Java 6 installations will prompt users to download and install Java 7 Update 15.

This was a planned move from Oracle, which previously announced on its website that it will "start auto-updating all Windows 32-bit users from JRE 6 to JRE 7 with the update release of Java, Java SE 7 Update 15 (Java SE 7u15), due in February 2013."

Oracle will speed up its patching cycle for Java. "Oracle's intent is to continue to accelerate the release of Java fixes, particularly to help address the security worthiness of the Java Runtime Environment (JRE) in desktop browsers," Maurice said.

The next scheduled Critical Patch Update for Java SE will be released on April 16, two months from now instead of four, and will come at the same time as the Critical Patch Update for Oracle's non-Java products. The next Java patch update after that is scheduled for June 18.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Oracleonline safetypatchesExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Lucian Constantin

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?