SRL Archive - News and General

Java has updated to: Java 7 Update 11.

A quote regarding the newest update,

Due to the severity of these vulnerabilities, the public disclosure of technical details and the reported exploitation of CVE-2013-0422 "in the wild," Oracle strongly recommends that customers apply the updates provided by this Security Alert as soon as possible.

http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html

http://www.oracle.com/technetwork/java/javase/7u11-relnotes-1896856.html

Browsers should have additional security from previous version(s) "exploit's."

Hope this helps,
Lj

Thanks for the info. I'll try to install it later when I get home. Hopefully it lets me load the rs client as J7U10 didnt allow it to load.

From: Silentcore
Thanks for the info. I'll try to install it later when I get home. Hopefully it lets me load the rs client as J7U10 didnt allow it to load.

No problem, also, for those who want the link to the latest download (aka save the extra google search + link click :p ) here's a link to the latest download:
http://www.oracle.com/technetwork/java/javase/downloads/index.html

Very nice bro. Updating now.
~Rez

Is the J7U11 Firefox plugin not available yet? My browser says only the Update 10 plugin is available for download.

From: Echo_
Is the J7U11 Firefox plugin not available yet? My browser says only the Update 10 plugin is available for download.

I don't think it is available yet, but afaik the exploit was initially "patched" regardless of the FF plugin version (which is currently at 7.0.100.18).
Given Mozilla is independent to Java/Oracle, I'm sure the plugin to be optmized with the newer Java update won't take too long to update (and afaik FF auto-checks for updates/plugin updates upon opening a new browser).

ref = https://www.mozilla.org/en-US/plugincheck/

Is this just a temporary patch while they do more fixing or does this fix the exploits completely?

From: chongc
Is this just a temporary patch while they do more fixing or does this fix the exploits completely?

I am unsure about the status of whether or not a new update will follow in 2 days ( the scheduled critical patch updates / security updates / 3rd party updates date found here http://www.oracle.com/technetwork/topics/security/alerts-086861.html), however the patched version (v7u11) is safer in terms of the latest 'exploit' buzz in comparison to prior vulnerable versions. I would recommend 7 update 11.

Java 6 is not affected and all versions of Java 7 up to and including Update 10 are affected. Java 7u11 fails to correct the underlying vulnerability but does fix the immediate problem. I'll be willing to discuss more specific things in private if anyone is interested in security.

Does anyone know if the early release builds of Java 8 have these vulnerabilities?

From: pyroryan
Java 6 is not affected and all versions of Java 7 up to and including Update 10 are affected. Java 7u11 fails to correct the underlying vulnerability but does fix the immediate problem. I'll be willing to discuss more specific things in private if anyone is interested in security.

I'm curious, since being in the security field, I like to keep up to date with these type of things.

From: pyroryan
Java 6 is not affected and all versions of Java 7 up to and including Update 10 are affected. Java 7u11 fails to correct the underlying vulnerability but does fix the immediate problem. I'll be willing to discuss more specific things in private if anyone is interested in security.

Java 6 had it's own problems though, specifically Rhino.

From: Kyle Undefined
I'm curious, since being in the security field, I like to keep up to date with these type of things.

Also interested. No doubt it will be exploited in the near future by pentesters/exploit kits.

From: pyroryan
Java 6 is not affected and all versions of Java 7 up to and including Update 10 are affected. Java 7u11 fails to correct the underlying vulnerability but does fix the immediate problem. I'll be willing to discuss more specific things in private if anyone is interested in security.

I can't seem to find an answer elsewhere: Do you know if the early release builds of Java 8 are vulnerable?

From: Bixby Sayz
I can't seem to find an answer elsewhere: Do you know if the early release builds of Java 8 are vulnerable?

Everything past 6 was

Thx for the heads-up, gave my java updates the every-morning finger after starting up my PC until now :D