Oracle releases Java patch update
The February patch was offered today -- ahead of schedule -- and contains fixes for 50 vulnerabilities
Infoworld - Oracle on Friday released a critical patch update for Java SE, offering the patch ahead of schedule to stave off an active exploitation affecting the Java Runtime Environment in desktop browsers. Server-side fixes are being offered as well.
Initially scheduled for release on February 19, the February 2013 critical patch update contains fixes for 50 vulnerabilities. Java has been under fire lately for security issues, particularly affecting browsers, and Oracle recently vowed to be more communicative about what it is doing to fix these problems. "The popularity of the Java Runtime Environment in desktop browsers and the fact that Java in browsers is OS-independent makes Java an attractive target for malicious hackers," Oracle said in its bulletin on Friday.
Forty-four of the 50 vulnerabilities impact Java in Internet browsers. "In other words, these vulnerabilities can only be exploited on desktops through Java Web Start applications or Java applets," Oracle said. "In addition, one vulnerability affects the installation process of client deployment of Java (i.e. installation of the Java Runtime Environment on desktops). Note also that this Critical Patch Update includes the fixes that were previously released through Security Alert CVE-2013-0422."
Additionally, three of the vulnerabilities apply to client and server deployments of Java, in which these can be exploited on desktops through Java Web Start or browser applets or in servers by supplying malicious input to APIs in vulnerable components. "In some instances, the exploitation scenario of this kind of bugs on servers is very improbable; for example, one of these vulnerabilities can only be exploited against a server in the unlikely scenario that the server was allowed to process image files from an untrusted source." Two vulnerabilities fixed in the update only apply to server-side deployment of the Java Secure Socket Extension, but most of the vulnerabilities addressed in the patch update affect Java and JavaFX client deployments, Oracle noted. "This reflects the fact that the Java server environment is more secure than the Java Runtime Environment in browsers because servers operate in a more secure and controlled environment."
This article, "Oracle releases Java patch update," was originally published at InfoWorld.com. Follow the latest developments in business technology news and get a digest of the key stories each day in the InfoWorld Daily newsletter. For the latest developments in business technology news, follow InfoWorld.com on Twitter.
Read more about security in InfoWorld's Security Channel.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts