Oracle Releases Java Critical Patch Updates
Written by Kay Ewbank   
Thursday, 18 April 2013

Two new major security updates have been issued by Oracle for Java for Mac OS and the Windows browser plug-in, each fixing a large number of severe vulnerabilities.

Both Critical Patch updates were released on Tuesday April 16th, i.e. in accordance with the regular schedule, but they fix a surprisingly large number of vulnerabilities - 42 in the case of the Windows browser update, and 21 for the Mac.

In the Oracle Security Assurance blog, Eric Maurice said that 39 of the vulnerabilities fixed in April's Critical Patch Update are remotely exploitable without authentication. He also said that the maximum CVSS Base Score (Common Vulnerability Scoring System) of  10.0 affected 19 of these vulnerabilities. 10 is the maximum score on the (CVSS).

Maurice said that only two of the 42 vulnerabilities can affect server deployments of Java. Server exploitation can only occur as a result of these bugs when malicious data is supplied into specific APIs on the server (e.g., through a web service), and one of these bugs actually require local access to be exploited.

The fact that the vulnerabilities are remotely exploitation without authentication means that if a user visits a compromised or malicious website, the attacker can run code on your machine. A recent report by F-Secure, the Finnish security company, highlighted a market increase in the use of botnets, exploits and banking Trojans for money-making attacks during the second half of 2012. The H2 Threat Report said that a particular threat was posed by exploits against the Java development platform:

"Three things visibly stand out in this past half year: botnets (with special reference to ZeroAccess), exploits (particularly against the Java development platform) and banking Trojans (Zeus)."

The security patch for Windows is available from the Oracle Java SE Downloads page. Apple maintains Java for Mac OS and its patch, Java for OX X 2013-003, is available from the Apple Download center.


Banner


Kinect SDK 2 And An Xbox Adaptor
24/10/2014

The Kinect is a well developed depth camera, but the SKD for version 2 is only just rolling out. You can now also use the Xbox One Kinect with the PC and create Windows Store apps. Is this the start o [ ... ]



GNU Emacs 24.4 Released
27/10/2014

The new version of the cross platform text editor widely used on Linux represents quite a big update and includes new functionality.


More News

 

Last Updated ( Thursday, 18 April 2013 )
 
 

   
RSS feed of news items only
I Programmer News
Copyright © 2014 i-programmer.info. All Rights Reserved.
Joomla! is Free Software released under the GNU/GPL License.