Skip the navigation

Oracle releases new Java fixes, speeds up patching cycle

Oracle patches five more Java vulnerabilities that weren't fixed in a security update earlier in February

By Lucian Constantin
February 20, 2013 06:17 AM ET

IDG News Service - Oracle released new Java security updates on Tuesday and announced plans to accelerate the release of future Java patches following recent attacks that have infected computers with malware by exploiting zero-day vulnerabilities in Java browser plug-ins.

The new updates, Java 7 Update 15 and Java 6 Update 41, address five additional vulnerabilities that couldn't be included in the emergency Java update that Oracle released on Feb. 1 due to time constraints. At the time, Oracle broke out of its scheduled 4-month Java patching cycle in order to patch a vulnerability that was being actively exploited by hackers.

Four of the five vulnerabilities addressed in the Tuesday updates can be exploited through Java Web Start applications on desktops and Java applets in Internet browsers, Eric Maurice, Oracle's director of software assurance, said Tuesday in a blog post.

Three of those four vulnerabilities received the highest rating on the Common Vulnerability Scoring System scale -- 10 -- which means they are critical and can be exploited to completely compromise the confidentiality, integrity, and availability of systems where Java runs with administrator privileges, such as Windows XP. On systems where Java does not run with administrative privileges, such as Linux or Solaris, the impact is lower, Maurice said.

The fifth vulnerability affects server deployments of the Java Secure Socket Extension (JSSE) and stems from the Lucky Thirteen attack against SSL/TLS implementations that security researchers disclosed earlier this month.

Even though the new Java 6 Update 41 is available for download from Oracle's website, it is not available from Java.com and must be obtained manually. The updating feature in Java 6 installations will prompt users to download and install Java 7 Update 15.

This was a planned move from Oracle, which previously announced on its website that it will "start auto-updating all Windows 32-bit users from JRE 6 to JRE 7 with the update release of Java, Java SE 7 Update 15 (Java SE 7u15), due in February 2013."

Oracle will speed up its patching cycle for Java. "Oracle's intent is to continue to accelerate the release of Java fixes, particularly to help address the security worthiness of the Java Runtime Environment (JRE) in desktop browsers," Maurice said.

The next scheduled Critical Patch Update for Java SE will be released on April 16, two months from now instead of four, and will come at the same time as the Critical Patch Update for Oracle's non-Java products. The next Java patch update after that is scheduled for June 18.

Reprinted with permission from IDG.net. Story copyright 2014 International Data Group. All rights reserved.
Our Commenting Policies
Internet of Things: Get the latest!
Internet of Things

Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!