Oracle Releases Java Critical Patch Updates
Oracle Releases Java Critical Patch Updates
Written by Kay Ewbank   
Thursday, 18 April 2013

Two new major security updates have been issued by Oracle for Java for Mac OS and the Windows browser plug-in, each fixing a large number of severe vulnerabilities.

Both Critical Patch updates were released on Tuesday April 16th, i.e. in accordance with the regular schedule, but they fix a surprisingly large number of vulnerabilities - 42 in the case of the Windows browser update, and 21 for the Mac.

In the Oracle Security Assurance blog, Eric Maurice said that 39 of the vulnerabilities fixed in April's Critical Patch Update are remotely exploitable without authentication. He also said that the maximum CVSS Base Score (Common Vulnerability Scoring System) of  10.0 affected 19 of these vulnerabilities. 10 is the maximum score on the (CVSS).

Maurice said that only two of the 42 vulnerabilities can affect server deployments of Java. Server exploitation can only occur as a result of these bugs when malicious data is supplied into specific APIs on the server (e.g., through a web service), and one of these bugs actually require local access to be exploited.

The fact that the vulnerabilities are remotely exploitation without authentication means that if a user visits a compromised or malicious website, the attacker can run code on your machine. A recent report by F-Secure, the Finnish security company, highlighted a market increase in the use of botnets, exploits and banking Trojans for money-making attacks during the second half of 2012. The H2 Threat Report said that a particular threat was posed by exploits against the Java development platform:

"Three things visibly stand out in this past half year: botnets (with special reference to ZeroAccess), exploits (particularly against the Java development platform) and banking Trojans (Zeus)."

The security patch for Windows is available from the Oracle Java SE Downloads page. Apple maintains Java for Mac OS and its patch, Java for OX X 2013-003, is available from the Apple Download center.


Banner


GCHQ Launches Spy Summer School
31/01/2016

The UK's national security organization, GCHQ, has launched a Cyber Insiders course to help recruit train future analysts and will pay those who attend.



E-Commerce Giant Hires Udacity Graduates Based On Nanodegree Portfolio
28/01/2016

Flipkart, India's largest online marketplace has hired three graduates of Udacity India's Android Developer Nanodgree program without any interviews and based solely on their Udacity profiles and  [ ... ]


More News

 

Last Updated ( Thursday, 18 April 2013 )
 
 

   
RSS feed of news items only
I Programmer News
Copyright © 2016 i-programmer.info. All Rights Reserved.
Joomla! is Free Software released under the GNU/GPL License.