Oracle Releases Java Critical Patch Updates
Oracle Releases Java Critical Patch Updates
Written by Kay Ewbank   
Thursday, 18 April 2013

Two new major security updates have been issued by Oracle for Java for Mac OS and the Windows browser plug-in, each fixing a large number of severe vulnerabilities.

Both Critical Patch updates were released on Tuesday April 16th, i.e. in accordance with the regular schedule, but they fix a surprisingly large number of vulnerabilities - 42 in the case of the Windows browser update, and 21 for the Mac.

In the Oracle Security Assurance blog, Eric Maurice said that 39 of the vulnerabilities fixed in April's Critical Patch Update are remotely exploitable without authentication. He also said that the maximum CVSS Base Score (Common Vulnerability Scoring System) of  10.0 affected 19 of these vulnerabilities. 10 is the maximum score on the (CVSS).

Maurice said that only two of the 42 vulnerabilities can affect server deployments of Java. Server exploitation can only occur as a result of these bugs when malicious data is supplied into specific APIs on the server (e.g., through a web service), and one of these bugs actually require local access to be exploited.

The fact that the vulnerabilities are remotely exploitation without authentication means that if a user visits a compromised or malicious website, the attacker can run code on your machine. A recent report by F-Secure, the Finnish security company, highlighted a market increase in the use of botnets, exploits and banking Trojans for money-making attacks during the second half of 2012. The H2 Threat Report said that a particular threat was posed by exploits against the Java development platform:

"Three things visibly stand out in this past half year: botnets (with special reference to ZeroAccess), exploits (particularly against the Java development platform) and banking Trojans (Zeus)."

The security patch for Windows is available from the Oracle Java SE Downloads page. Apple maintains Java for Mac OS and its patch, Java for OX X 2013-003, is available from the Apple Download center.


Banner


DirectX Tool Kit For DirectX 12 - 3D For The Rest Of Us?
20/07/2016

Microsoft has announced the extension of the DirectX Tool Kit to DirectX 12. This not only makes DirectX 12 more accessible but highlights the fact that Windows graphics in general has become less acc [ ... ]



DARPA Cyber Grand Challenge AI Will Prevail
20/07/2016

Next month Las Vegas will host the Final Event of the DARPA Cyber grand Challenge as an all-computer cyber-defence Capture the Flag tournament. From an initial field of over 100 applicant seven teams  [ ... ]


More News

 

Last Updated ( Thursday, 18 April 2013 )
 
 

   
Banner
RSS feed of news items only
I Programmer News
Copyright © 2016 i-programmer.info. All Rights Reserved.
Joomla! is Free Software released under the GNU/GPL License.