Jump to content


Photo

Java JRE updates/advisories


  • Please log in to reply
45 replies to this topic

#1 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 12 October 2010 - 05:03 PM

FYI...

Java JRE v1.6.0_22 released
- http://www.oracle.co...oads/index.html
2010-October-12

Release Notes
- http://www.oracle.co...tes-176121.html

Oracle Java SE and Java for Business Risk Matrix (CVE#)
- http://www.oracle.co...ml#AppendixJAVA

- http://krebsonsecuri...security-flaws/
October 12, 2010 - "... critical update... fixing at least 29 security vulnerabilities..."

- http://secunia.com/advisories/41791/
Release Date: 2010-10-13
Last Update: 2010-10-21
Criticality level: Highly critical
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access
Where: From remote...
Solution Status: Vendor Patch
CVE Reference(s): CVE-2009-3555, CVE-2010-1321, CVE-2010-3541, CVE-2010-3548, CVE-2010-3549, CVE-2010-3550, CVE-2010-3551, CVE-2010-3552, CVE-2010-3553, CVE-2010-3554, CVE-2010-3555, CVE-2010-3556, CVE-2010-3557, CVE-2010-3558, CVE-2010-3559, CVE-2010-3560, CVE-2010-3561, CVE-2010-3562, CVE-2010-3563, CVE-2010-3565, CVE-2010-3566, CVE-2010-3567, CVE-2010-3568, CVE-2010-3569, CVE-2010-3570, CVE-2010-3571, CVE-2010-3572, CVE-2010-3573, CVE-2010-3574

- http://www.securityt....com/id?1024573
Oct 14 2010

:ph34r:

Edited by AplusWebMaster, 23 October 2010 - 07:11 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#2 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 18 October 2010 - 01:21 PM

FYI...

Have you checked Java?...
- http://blogs.technet...d-the-java.aspx
18 Oct 2010 - "... by the beginning of this year, the number of Java exploits... (... -not- attacks using JavaScript) had well surpassed the total number of Adobe-related exploits we monitored. See chart... a reminder that, in addition to running real-time protection, it is -imperative- to apply all security updates for software, no matter what your flavor might be."
Chart: http://blogs.technet...00_4ECD269A.gif

- http://krebsonsecuri...a-exploitation/
October 18, 2010 - "... the spike in the third quarter of 2010 is primarily driven by attacks on three Java vulnerabilities that have already been patched for some time now. Even so, attacks against these flaws have “gone from hundreds of thousands per quarter to millions” ..."
- http://web.nvd.nist....d=CVE-2008-5353
Last revised: 08/21/2010
CVSS v2 Base Score: 10.0 (HIGH)
- http://web.nvd.nist....d=CVE-2009-3867
Last revised: 08/21/2010
CVSS v2 Base Score: 9.3 (HIGH)
- http://web.nvd.nist....d=CVE-2010-0094
Last revised: 08/21/2010
CVSS v2 Base Score: 7.5 (HIGH)

- http://labs.m86secur...ted-by-zombies/
October 15, 2010 - "... effectively used in many other exploit tool kits. Potential victims are forced to visit Zombie’s exploit page when their browser loads an IFrame placed on a compromised website. All of the vulnerabilities exploited by this kit have been patched... 15 percent... of ‘visitors’ were successfully exploited by the Zombie Infection Kit and made to download a malicious executable. Because Java vulnerabilities accounted for 60 percent of infections, a surprising nine percent of all visitors were infected just by having an old version of java installed..."

- https://www.sans.org...issue=84#sID202
"... Eighty percent of PCs run at least one version of Java. Of those, 40 percent are running outdated versions. There is a Java update service, but user notification is slow and the service allows multiple versions of the software to run on PCs, so users' computers can be vulnerable to older attacks even if they're running a newer version of Java..."

:ph34r: :!:

Edited by AplusWebMaster, 25 October 2010 - 09:09 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#3 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 26 October 2010 - 07:28 AM

FYI...

Hello? Update. Please?
- http://www.zdnet.co....-hole-10020866/
25 October, 2010 - "... Only 7% have applied the critical patch. According to Trusteer*, 68% of Internet users are still at risk from the attacks that these Java vulnerabilities expose and goes as far as to claim that it has become the single most exploitable vulnerability on the web today... these things are not called 'critical' for the heck of it. "

* http://www.trusteer....unpatched-users
Oct. 25, 2010 – "... over a week after Oracle released a critical patch for Java, more than 68 percent of Internet users are still at risk from attacks that exploit these vulnerabilities. This may be the biggest security hole on the Internet today, since 73 percent of Internet computers are using Java..."

- http://blogs.cisco.c...dscape-today-2/
October 28, 2010 - "... Cisco ScanSafe data from the past 6 months:
- http://blogs.cisco.c...va-Security.jpg
Java vs. Flash vs. PDF, Apr - Sep 2010
... for all web-based malware, 65% of what ScanSafe blocked was prior to exploit delivery, at the iframe or malicious JavaScript reference level..."
___

60 second check for updates here.

:scratchhead:

Edited by AplusWebMaster, 05 November 2010 - 10:24 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#4 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 10 November 2010 - 10:23 PM

FYI...

Java exploits!...
- http://isc.sans.edu/...ml?storyid=9916
Last Updated: 2010-11-11 00:05:00 UTC - "... Bottom line: If you haven't done so yet, hunt down and patch every incarnation of Java on the PCs that you are responsible for."
* http://www.virustota...cd28-1289430438
File name: bad.exe
Submission date: 2010-11-10 23:07:18 (UTC)
Result: 14/43 (32.6%)

Currently Exploited Sun Java Vulnerabilities
- http://blog.sharpese...ulnerabilities/
___

60 second check for updates here.
___

- http://www.guardian....y-apache-crisis
16 November 2010

:ph34r: :ph34r:

Edited by AplusWebMaster, 08 December 2010 - 10:57 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#5 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 08 December 2010 - 04:46 PM

FYI...

Java JRE v1.6.0_23 released
- http://www.oracle.co...oads/index.html
Dec. 8, 2010
Offline Installation - jre-6u23-windows-i586.exe - 15.79 MB
[Noted: 2011.01.14 - "This release includes performance improvements and bug fixes."]

- http://www.oracle.co...tes-191058.html
"... Bug Fixes: Java SE 6u23 does not contain any additional fixes for security vulnerabilities to its previous release, Java SE 6u22. Users who have Java SE 6u22 have the latest security fixes and do not need to upgrade to this release to be current on security fixes. For other bug fixes, see the Java SE 6u23 Bug Fixes page*..."
* http://www.oracle.co...xes-191074.html
208 bug fixes ...
?? "6945145 - java_deployment - security - PKIX path validation failed: App won't start when offline when using JOGL/Win7 ..."

:ph34r:

Edited by AplusWebMaster, 14 January 2011 - 02:36 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#6 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 09 February 2011 - 10:08 AM

FYI...

Java vuln - patch available...
- http://secunia.com/advisories/43262/
Release Date: 2011-02-09
Criticality level: Moderately critical
Impact: DoS
Where: From remote
Solution: Apply patch via the FPUpdater tool.
... The vulnerability is reported in the following products: Sun JDK and JRE 6 Update 23 and prior, Sun JDK 5.0 Update 27 and prior, Sun SDK 1.4.2_29 and prior.
- http://www.oracle.co...476-305811.html
2011-February-08
___

- http://blogs.oracle....ve-2010-44.html
February 8, 2011 - "... the fix for this vulnerability will also be included in the upcoming Java Critical Patch Update (Java SE and Java for Business Critical Patch Update - February 2011*), which will be released on February 15th 2011..."
* http://www.oracle.co...rts-086861.html

- http://www.h-online....ty-1186135.html
9 February 2011 - "... Affected are Java SE and Java for Business in the current and all previous versions of the JDK/JRE 6, 5 and 1.4. To solve the problem, Oracle has released a hotfix* that users are advised to apply immediately, as information on how to exploit the DoS vulnerability is already freely available. The vendor also plans to release a regular Java update on 15 February."
* http://www.oracle.co....html#fpupdater

:ph34r: :!:

Edited by AplusWebMaster, 09 February 2011 - 01:53 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#7 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 15 February 2011 - 02:16 PM

FYI...

Java v1.6.0_24 released
- http://www.oracle.co...oads/index.html
Feb. 15, 2011

Release Notes
- http://www.oracle.co...tes-307697.html
The full internal version number for this update release is 1.6.0_24-b07 (where "b" means "build"). The external version number is 6u24...
Bug Fixes: This release contains fixes for security vulnerabilities. For more information, please see Oracle Java SE and Java for Business Critical Patch Update advisory.
- http://www.oracle.co...011-304611.html
Feb. 2011 - "... This Critical Patch Update contains 21 new security fixes..."

Java Downloads for All Operating Systems - Recommended Version 6 Update 24
- http://java.com/en/download/manual.jsp

Which version of Java should I download for my 64-bit Windows operating system?
- http://java.com/en/d...va_win64bit.xml

Bug list:
- http://www.oracle.co...ml#AppendixJAVA
___

3rd party Java test site
- http://javatester.org/version.html
___

Java - Multiple Flaws Let Remote Users Execute Arbitary Code, Access Data, Modifiy Data, and Deny Service
- http://www.securityt....com/id/1025082
Feb 15 2011

- http://secunia.com/advisories/43262/
Last Update: 2011-02-16
Criticality level: Highly critical
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access
Where: From remote...
Solution: Apply updates (see vendor's advisory).
Original Advisory: Oracle:
- http://www.oracle.co...011-304611.html
___

Most Vulnerable Browser Plug-in...
- http://www.esecurity...int.php/3925356
February 17, 2011- "... between July of 2010 and January of 2011... 42 percent of users were running vulnerable out-of-date Java plug-ins..."

:ph34r:

Edited by AplusWebMaster, 20 February 2011 - 12:53 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#8 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 24 March 2011 - 09:15 AM

FYI...

Java - update ugly...
- https://www.computer..._McAfee_scanner
March 24, 2011 - "Windows users who install the latest Java security patches may end up with a little more security than they bargained for, at least that's the risk they take if they don't pay close attention to the installation process. Starting last month, Oracle began bundling a security scanning tool called the McAfee Security Scan Plus with its Java updates for the Windows operating system. The software is installed by default with the Java update, so unless users notice and uncheck the McAfee installation box as they're updating Java, they'll end up downloading McAfee's software too...
Oracle bundles different products with Java in different regions, so not all Windows users may get Security Scan Plus with their Java updates. Once downloaded, the McAfee software prompts the user on a daily basis to accept McAfee's licensing terms to complete the installation. The user can cancel out of this prompt, but there is no option to decline the terms. To remove the software, the user must use the Windows "Uninstall a Program" feature. A number of users have inadvertently installed the software since Oracle started the bundling deal with Intel's McAfee subsidiary last month... Some users are unhappy, including one who posted to an Intel message board after noticing a slowdown on a family member's PC a few weeks ago, apparently after a Java update... Security Scan Plus is a 1MB download. But it uses 4MB of memory when running, a company spokeswoman said via e-mail. There are other ways to end up with it on your system. Some users have complained of downloading it as part of an Adobe reader update, and it can be picked up when downloading via Adobe's Download Center, an Adobe spokeswoman said..."

[ ...aka: "Tag-along-software installs" - 'Not the only vendors who do this...]
- https://www.ixquick.com/
"... about 1,860 for ' Tag-along software installs '"
- https://encrypted.google.com/
Tag-along software installs
"... About 644,000 results..."

:ph34r: :hmmm:

Edited by AplusWebMaster, 24 March 2011 - 10:03 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#9 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 22 April 2011 - 12:28 PM

FYI...

Java v1.6.0_25 released
- http://www.oracle.co...oads/index.html
April 22, 2011

Release Notes
- http://www.oracle.co...tes-356444.html
"Highlights: This update release contains important enhancements for Java applications:
Improved performance and stability
Java HotSpot™ VM 20
Support for Internet Explorer 9, Firefox 4 and Chrome 10
Improved BigDecimal ...
Java SE 6u25 does not add any fixes for security vulnerabilities beyond those in Java SE 6u24. Users who have Java SE 6u24 have the latest security fixes and do not need to upgrade to this release to be current on security fixes..."

Bug fixes
- http://www.oracle.co...xes-356453.html
193...

:!:

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#10 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 03 June 2011 - 01:25 PM

FYI...

> http://www.oracle.co...011-313339.html
June 3, 2011 - "This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Java SE Critical Patch Update for June 2011, which will be released on Tuesday, June 7, 2011... This Critical Patch Update contains 17 new security vulnerability fixes..."
___

Java exploits predominate...
- http://www.informati...endly=this-page
June 01, 2011 - "... In 2011, the Java threat doesn't appear to have diminished. According to a study by Kaspersky Labs[1] that looked at malware trends from January through March 2011, Java vulnerabilities comprised a significant portion of the top 10 "most seen" vulnerabilities* on people's PCs..."
* http://blogs.technet...ts-du-jour.aspx
"... 7 of the top 10 threats are files containing exploits for Java vulnerabilities such as CVE-2008-5353, CVE-2010-0094, CVE-2010-0840 and CVE-2009-3867... many of these detections by MSS are the debris or aftermath after the exploit has already executed. By the time a user downloads and runs MSS to detect malware, the machine may have already been infected, if it was vulnerable to the exploit at the time... aside from additional malicious Java code detections... active threats were also reported on machines found to be infected by Exploit:Java/CVE-2008-5353**...
** http://web.nvd.nist....d=CVE-2008-5353
- http://web.nvd.nist....d=CVE-2009-3867
- http://web.nvd.nist....d=CVE-2010-0094
- http://web.nvd.nist....d=CVE-2010-0840
CVSS v2 Base Score: ... (HIGH)

[1] http://www.securelis...n_for_Q1_2011#9
"... In the first quarter of 2011, the number of blocked attacks stood at 254,932,299 – these attacks were carried out from web resources located in different countries all over the world..."

> http://www.microsoft...spx#section_3_1

:!: :ph34r:

Edited by AplusWebMaster, 03 June 2011 - 05:32 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#11 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 07 June 2011 - 01:46 PM

FYI...

Java JRE 6 Update 26 released
- http://java.com/en/download/manual.jsp

- http://www.oracle.co...oad-400751.html
June 7, 2011
Windows x86 15.85 MB jre-6u26-windows-i586.exe
Windows x64 16.14 MB jre-6u26-windows-x64.exe

Release Notes
- http://www.oracle.co...tes-401875.html
This release contains fixes for security vulnerabilities. For more information, please see Oracle Java SE Critical Patch Update advisory*.

* http://www.oracle.co...ml#AppendixJAVA
CVSS Base Score 10.0: CVE-2011-0802, CVE-2011-0814, CVE-2011-0815, CVE-2011-0817, CVE-2011-0862, CVE-2011-0863, CVE-2011-0864, CVE-2011-0871, CVE-2011-0873
Other: CVE-2011-0786, CVE-2011-0788, CVE-2011-0865, CVE-2011-0866, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0872

Download Java for your desktop computer
> http://java.com/en/download/index.jsp
___

- http://www.securityt....com/id/1025610
CVE Reference: CVE-2011-0786, CVE-2011-0788, CVE-2011-0802, CVE-2011-0814, CVE-2011-0815, CVE-2011-0817, CVE-2011-0862, CVE-2011-0863, CVE-2011-0864, CVE-2011-0865, CVE-2011-0866, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0871, CVE-2011-0872, CVE-2011-0873
Impact: Denial of service via network, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network...
A remote user can create a Java applet or Java Web Start application that, when loaded by the target user, will access or modify data or execute arbitrary code on the target user's system. A remote user can cause partial denial of service conditions on the target system.
Solution: The vendor has issued a fix...

- http://secunia.com/advisories/44784/
Last Update: 2011-06-10
Criticality level: Highly critical
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access
Where: From remote...
Solution Status: Vendor Patch...
... versions prior to 1.6.0_26...

Quick test here: http://javatester.org/version.html
___

IBM Java v6.0.0 SR9 FP2 released
- http://secunia.com/advisories/45206/
Release Date: 2011-07-13
Criticality level: Highly critical
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access
Where: From remote
CVE Reference(s): CVE-2011-0786, CVE-2011-0788, CVE-2011-0802, CVE-2011-0814, CVE-2011-0815, CVE-2011-0817, CVE-2011-0862, CVE-2011-0863, CVE-2011-0865, CVE-2011-0866, CVE-2011-0867, CVE-2011-0868, CVE-2011-0869, CVE-2011-0871, CVE-2011-0872, CVE-2011-0873
Solution: Update to version 6.0.0 SR9 FP2.
Original Advisory: http://www.ibm.com/d...ava/jdk/alerts/

:!:

Edited by AplusWebMaster, 19 July 2011 - 08:45 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#12 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 28 July 2011 - 05:43 PM

FYI...

Java JRE v7 released
- http://www.oracle.co...oad-432155.html
July 28 2011

JDK 7 and JRE 7 Supported System Configurations
- http://www.oracle.co...fig-417990.html

Security Enhancements
- http://download.orac...ancements7.html

Release Notes
- http://www.oracle.co...tes-429209.html

Changes in Java SE 7
- http://www.oracle.co...59.html#changes

Known Issues
- http://www.oracle.co...tml#knownissues
___

- http://h-online.com/-1288208
29 July 2011 - "9494 bug fixes, 1966 enhancements, 9018 updates, 147 builds and four specification requests have gone into developing the latest Java Platform 7 and Oracle has now released JDK 7 as a general availability release. It is the first major release of the Java development environment since Oracle's takeover of Sun Microsystems..."

:!: :ph34r:

Edited by AplusWebMaster, 30 July 2011 - 12:05 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#13 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 17 August 2011 - 01:31 PM

FYI...

- https://isc.sans.edu...l?storyid=11506
Last Updated: 2011-09-05 13:44:59 UTC ...(Version: 2)
___

Java JRE 6 Update 27 released
- http://www.oracle.co...oad-440425.html
August 17, 2011
Windows x86 ... jre-6u27-windows-i586.exe
Windows x64 ... jre-6u27-windows-x64.exe

Release Notes
- http://www.oracle.co...tes-444147.html

Bug Fixes
- http://www.oracle.co...xes-444150.html

NOTE:
https://www.java.com...d/faq/java7.xml
Java7: "... The new release of Java is first made available to the developers to ensure no major problems are found before we make it available on the java.com website for end users to download the latest version..."

:ph34r:

Edited by AplusWebMaster, 05 September 2011 - 11:29 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#14 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 14 October 2011 - 06:41 AM

FYI...

Java exploitation remains high ...
- https://blogs.techne...text&GroupKeys=
13 Oct 2011 - "... Most Frequent Exploits: ... Java exploitation remains high... The top four Java exploits are CVE-2010-0840, CVE-2008-5353, CVE-2010-0094, and CVE-2009-3867..."
- http://web.nvd.nist....d=CVE-2008-5353
- http://web.nvd.nist....d=CVE-2009-3867
- http://web.nvd.nist....d=CVE-2010-0094
- http://web.nvd.nist....d=CVE-2010-0840

Exploit Detections (charted)
> http://www.microsoft...-111012-002.png

:ph34r: :ph34r:

Edited by AplusWebMaster, 14 October 2011 - 06:42 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#15 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 18 October 2011 - 04:14 PM

FYI...

Java 7 Update 1 released
Release Notes / Bug Fixes
- http://www.oracle.co...tes-507962.html
October 18, 2011 - "... version number for this update release is 1.7.0_1-b08 (where "b" means "build"). The external version number is 7u1..."

Downloads
- http://www.oracle.co...oad-513652.html
Windows x86 jre-7u1-windows-i586.exe
Windows x64 jre-7u1-windows-x64.exe
___

Java 6 Update 29 released
Release Notes / Bug Fixes
- http://www.oracle.co...tes-507960.html
October 18, 2011 - "... version number for this update release is 1.6.0_29-b11 (where "b" means "build"). The external version number is 6u29..."

Downloads
- http://www.oracle.co...oad-513650.html
Windows x86 jre-6u29-windows-i586.exe
Windows x64 jre-6u29-windows-x64.exe
___

Oracle Java SE Critical Patch Update Advisory - October 2011
- http://www.oracle.co...ml#AppendixJAVA
"... contains 20 new security fixes for Oracle Java SE. 19 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password...
... Supported Versions Affected: JDK and JRE 7, 6 Update 27 and before..."
___

JRE Multiple Flaws Let Remote Users Execute Arbitrary Code and Deny Service
- http://www.securityt....com/id/1026215
CVE Reference: CVE-2011-3516, CVE-2011-3521, CVE-2011-3544, CVE-2011-3545, CVE-2011-3546, CVE-2011-3547, CVE-2011-3548, CVE-2011-3549, CVE-2011-3550, CVE-2011-3551, CVE-2011-3552, CVE-2011-3553, CVE-2011-3554, CVE-2011-3555, CVE-2011-3556, CVE-2011-3557, CVE-2011-3558, CVE-2011-3560, CVE-2011-3561
Date: Oct 19 2011
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via network.
Version(s): JDK and JRE 7; JDK and JRE 6 Update 27 and prior; JDK and JRE 5.0 Update 31 and prior; SDK and JRE 1.4.2_33 and prior.
... vendor has issued a fix... advisory is available at:
http://www.oracle.co...011-443431.html

- https://secunia.com/advisories/46512/
Release Date: 2011-10-19
Criticality level: Highly critical
Impact: Hijacking, Spoofing, Manipulation of data, Exposure of sensitive information, DoS, System access
Where: From remote
Solution Status: Vendor Patch
Software: Oracle Java JDK/JRE SE 1.7.x / 7.x, JDK/JRE 1.6.x / 6.x, JDK/JRE 1.5.x, JDK/JRE 1.4.x
Description: Multiple vulnerabilities have been reported in Oracle Java SE, which can be exploited by malicious users to disclose certain information and by malicious people to disclose potentially sensitive information, hijack a user's session, conduct DNS cache poisoning attacks, manipulate certain data, cause a DoS (Denial of Service), and compromise a vulnerable system.
... see the vendor's advisory for details...
http://www.oracle.co...011-443431.html

:ph34r: :ph34r:

Edited by AplusWebMaster, 19 October 2011 - 07:03 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#16 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 23 November 2011 - 10:24 PM

FYI...

IBM Java - multiple vulns - update available
- https://secunia.com/advisories/46977/
Release Date: 2011-11-23
Criticality level: Highly critical
Impact: Exposure of sensitive information, DoS, System access
Where: From remote
Software: IBM Java 5.x ...
CVE Reference(s): CVE-2011-3545, CVE-2011-3547, CVE-2011-3548, CVE-2011-3549, CVE-2011-3552, CVE-2011-3554, CVE-2011-3556
Solution: Update to version SR13.
Original Advisory: http://www.ibm.com/d...ava/jdk/alerts/

> https://www.ibm.com/...works/java/jdk/
___

- http://web.nvd.nist....d=CVE-2011-3547
CVSS v2 Base Score: 5.0 (MEDIUM)
- http://web.nvd.nist....d=CVE-2011-3552
CVSS v2 Base Score: 2.6 (LOW)
- http://web.nvd.nist....d=CVE-2011-3545
- http://web.nvd.nist....d=CVE-2011-3548
- http://web.nvd.nist....d=CVE-2011-3549
- http://web.nvd.nist....d=CVE-2011-3554
Last revised: 10/30/2011
CVSS v2 Base Score: 10.0 (HIGH)
- http://web.nvd.nist....d=CVE-2011-3556
CVSS v2 Base Score: 7.5 (HIGH)

:!: :ph34r:

Edited by AplusWebMaster, 23 November 2011 - 10:42 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#17 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 12 December 2011 - 03:49 PM

FYI...

Java 6u30 / 7u2 released
- http://www.oracle.co...es-1394870.html
Dec. 12, 2011 - "... a notable bug fix for Java SE 6u30:
Area: JSSE: Runtime Synopsis: REGRESSION - 6u29 -breaks- ssl connectivity using TLS_DH_anon_WITH_AES_128_CBC_SHA . It is strongly encouraged that applications using JSSE (SSL/TLS) be upgraded to this release to have access to the latest changes that address this recent vulnerability: Under certain circumstances, Java SE 6u29* will incorrectly throw an IndexOutOfBoundsException or send an extra SSL/TLS packet..."
* http://bugs.sun.com/...?bug_id=7103725
Related: http://web.nvd.nist....d=CVE-2011-3389
Last revised: 12/13/2011

- http://www.oracle.co...es-1394228.html
Dec. 12, 2011 - "... 7u2 does -not- add any fixes for security vulnerabilities beyond those in Java SE 7u1. Users who have Java SE 7u1 have the latest security fixes and do not need to upgrade to this release to be current on security fixes..."

Bug Fixes... in Java SE 6u30:
- http://www.oracle.co...es-1394936.html
Bug Fixes... in Java SE 7u2:
- http://www.oracle.co...es-1394661.html

Downloads: http://www.oracle.co...oads/index.html

JRE 6u30: http://www.oracle.co...ad-1377142.html

JRE 7u2: http://www.oracle.co...ad-1377135.html
___

- https://krebsonsecur...t-windows-java/
December 13, 2011 - "... specific details of the flaws* fixed in this update..."

* Exploitable bugs fixed in update 30
- https://krebsonsecur...date30notes.txt
http://bugs.sun.com/...?bug_id=6761678
http://bugs.sun.com/...?bug_id=6670868
http://bugs.sun.com/...?bug_id=7041800
http://bugs.sun.com/...?bug_id=6682380
http://bugs.sun.com/...?bug_id=7103725
___

IBM Java updated...
- https://secunia.com/advisories/47464/
Release Date: 2012-01-09
Criticality level: Highly critical
Impact: Hijacking, Spoofing, Manipulation of data, Exposure of sensitive information, DoS, System access
Where: From remote
Software: IBM Java 1.4.x, IBM Java 6.x ...
Solution: Update to version 1.4.2 SR13-FP11 or 6.0.0 SR10.
Original Advisory: http://www.ibm.com/d...ava/jdk/alerts/
Oracle October 18 2011 CPU
... more information:
- https://secunia.com/advisories/46512/
Last Update: 2011-10-27
Criticality level: Highly critical
Oracle: http://www.oracle.co...011-443431.html
Java SE Critical Patch Update Advisory - October 2011
JDK and JRE 7 Java SE
JDK and JRE 6 Update 27 and earlier
JDK and JRE 5.0 Update 31 and earlier
SDK and JRE 1.4.2_33 and earlier
IBM: http://blog.watchfir..._exhaustion.pdf

IBM Security Bulletins - Quarterly Summaries
- http://www-03.ibm.co.../bulletins.html
"... Starting in 2012, IBM will post a summary of its Security Bulletins from the previous Quarter on the 2nd Tuesday of January, April, July and October. The next four dates are:
January 10, 2012
April 10, 2012
July 10, 2012
October 9, 2012".

IBM Product Security Incident Response Blog
- https://www.ibm.com/blogs/PSIRT

:!:

Edited by AplusWebMaster, 24 January 2012 - 07:04 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#18 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 15 February 2012 - 06:01 AM

FYI...

Java update advisory - Feb 2012
- http://www.oracle.co...012-366318.html
2012-February-17 Rev 2. Replaced CVE-2011-3571 with CVE-2012-0507
2012-February-14 Rev 1. Initial Release
2012-February-14 - "... Affected product releases and versions:
JDK and JRE 7 Update 2 and earlier, JDK and JRE 6 Update 30 and earlier, JDK and JRE 5.0 Update 33 and earlier, SDK and JRE 1.4.2_35 and earlier, JavaFX 2.0.2 and earlier, JavaFX...
>> http://www.oracle.co...oads/index.html
"... Java SE 7u3 - This release includes security fixes... Java SE 6 Update 31 - This release includes security fixes..."

Java JRE 7u3:
- http://www.oracle.co...ad-1501631.html
Release Notes:
- http://www.oracle.co...es-1481928.html
"... version number for this update release is 1.7.0_03-b04 (b05 in Windows, where "b" means "build"). The external version number is 7u3..."

Java JRE 6u31:
- http://www.oracle.co...ad-1501637.html
Release Notes:
- http://www.oracle.co...es-1482342.html
"... version number for this update release is 1.6.0_31-b04 (b05 in Windows, where "b" means "build")..."
___

- http://www.securityt....com/id/1026687
CVE Reference:
- http://web.nvd.nist....d=CVE-2011-3563 - 6.4
- http://web.nvd.nist....d=CVE-2012-0497 - 10.0 (HIGH)
- http://web.nvd.nist....d=CVE-2012-0498 - 10.0 (HIGH)
- http://web.nvd.nist....d=CVE-2012-0499 - 10.0 (HIGH)
- http://web.nvd.nist....d=CVE-2012-0500 - 10.0 (HIGH)
- http://web.nvd.nist....d=CVE-2012-0501 - 5.0
- http://web.nvd.nist....d=CVE-2012-0502 - 6.4
- http://web.nvd.nist....d=CVE-2012-0503 - 7.5 (HIGH)
- http://web.nvd.nist....d=CVE-2012-0504 - 9.3 (HIGH)
- http://web.nvd.nist....d=CVE-2012-0505 - 7.5 (HIGH)
- http://web.nvd.nist....d=CVE-2012-0506 - 4.3
- http://web.nvd.nist....d=CVE-2012-0508 - 10.0 (HIGH)
Date: Feb 14 2012
Impact: Denial of service via network, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Version(s): 1.4.2_35 and prior, 5.0 Update 33 and prior; 6 Update 30 and prior; 7 Update 2 and prior...
The vendor's advisory is available at:
- http://www.oracle.co...012-366318.html

- https://secunia.com/advisories/48009/
Release Date: 2012-02-15
Criticality level: Highly critical
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access
Where: From remote...
Original Advisory:
- http://www.oracle.co...012-366318.html

:!: :!:

Edited by AplusWebMaster, 03 April 2012 - 02:27 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#19 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 26 February 2012 - 01:15 PM

FYI...

Java exploit code available for recently patched vuln ...
ZDI-12-039: Oracle Java Web Start java-vm-args Command Argument Injection Remote Code Execution
- http://atlas.arbor.n...dex#-2068343742
Severity: High Severity
Feb 24, 2012 - "Exploit code is available for a recently patched Java vulnerability.
Analysis: Oracle patched a series of Java security issues in February and at least one of these issues now has publicly available exploit code, as published in the Metasploit framework. While Metasploit is intended for authorized penetration testing purposes, attackers have no such scruples and will happily leverage freshly published exploit code to develop their own and incorporate the exploit into their malware kits. Such exploits also pay off for the attackers who launch targeted attacks, as many targets do not patch in a timely manner."
Source: http://www.zerodayin...ies/ZDI-12-039/
___

- https://isc.sans.edu...l?storyid=12838
Last Updated: 2012-03-25 17:04:16 UTC - "... In slight modification of Oracle's own words: 'We highly recommend users remove all older versions of Java from your system. Keeping old and unsupported versions of Java on your system presents a serious security risk...' ..."

:!: :ph34r:

Edited by AplusWebMaster, 01 April 2012 - 11:23 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#20 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 01 April 2012 - 12:20 PM

FYI...

Critical Java hole being exploited on a large scale ...
- http://atlas.arbor.n...dex#-1937641784
Severity: High Severity
Published: Wednesday, March 28, 2012 19:20
Java security vulnerability patched in February is now being used widely by criminals to install malware.
Analysis: Patch! Watch for outdated Java on the network as the presence of old Java User-Agents is often a sign that a system has been exploited and Java is now doing the attackers bidding, typically downloading something evil.
Source: http://h-online.com/-1485681
Update 29-03-12: "... Until an update is released that addresses the vulnerability, Mac OS X users can turn off Java. Users can disable Java via Java Preferences (Applications > Utilities > Java Preferences) by unchecking the installed version. Alternatively, users can disable Java in each of their browsers; in Apple's Safari browser, this can be done by unchecking the "Enable Java" and "Enable JavaScript" under the Security tab in Safari's Preferences..."
* http://www.h-online....iew=zoom;zoom=2
___

- http://atlas.arbor.n...index#-51701177
Elevated Severity
March 30, 2012
Source: http://blog.eset.com...507-and-carberp

Mac Flashback Exploiting Unpatched Java Vulnerability
- https://www.f-secure...s/00002341.html
April 2, 2012

:grrr: :ph34r:

Edited by AplusWebMaster, 03 April 2012 - 06:15 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#21 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 20 April 2012 - 04:42 PM

FYI...

- http://www.oracle.co...rts-086861.html
"... For Oracle Java SE Critical Patch Updates, the next three dates are:
12 June 2012
16 October 2012
19 February 2013 ..."
___

IBM Java 5 update released
- https://secunia.com/advisories/48915/
Release Date: 2012-04-20
Criticality level: Highly critical
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access
Where: From remote
CVE Reference(s): CVE-2011-3389, CVE-2011-3557, CVE-2011-3560, CVE-2011-3563, CVE-2012-0498, CVE-2012-0499 CVE-2012-0501, CVE-2012-0502, CVE-2012-0503, CVE-2012-0505, CVE-2012-0506, CVE-2012-0507
Solution: Update to version 5.0 SR13-FP1.
Original Advisory: http://www.ibm.com/d...ava/jdk/alerts/

IBM Java 6 update released
- https://secunia.com/advisories/48913/
Criticality level: Highly critical
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access
Where: From remote
CVE Reference(s): CVE-2011-3563, CVE-2011-5035, CVE-2012-0497, CVE-2012-0498, CVE-2012-0499, CVE-2012-0500, CVE-2012-0501, CVE-2012-0502, CVE-2012-0503, CVE-2012-0505, CVE-2012-0506, CVE-2012-0507
Solution: Update to version 6 SR10-FP1.
Original Advisory: http://www.ibm.com/d...ava/jdk/alerts/

:!: :!:

Edited by AplusWebMaster, 23 April 2012 - 09:16 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#22 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 26 April 2012 - 01:55 PM

FYI...

Java v.6u32/v.7u4 released
> http://www.oracle.co...oads/index.html
___

Java SE Runtime Environment 7u4 - Download
- http://www.oracle.co...ad-1591157.html
April 26, 2012

Release notes
- http://www.oracle.co...es-1575007.html
"... Bug Fixes: Java SE 7u4 does -not- add any fixes for security vulnerabilities beyond those in Java SE 7u3..."

Bug Fixes - Java SE 7u4
- http://www.oracle.co...es-1579555.html

- http://h-online.com/-1562140
27 April 2012 - "The new Java Standard Edition 7 Update 4 is the first Oracle-sponsored Java release that has been made available for Mac OS X (Lion)... Java SE 7 Update 4 can be downloaded for Macs, as well as Windows and Linux..."
- http://www.oracle.co...ds-1591156.html
___

Java SE Runtime Environment 6 Update 32 - Download
- http://www.oracle.co...ds-1594646.html
April 26, 2012

Release notes
- http://www.oracle.co...es-1578471.html

Bug Fixes - Java SE 6u32
- http://www.oracle.co...es-1579554.html

Java 6 End of Life (EOL) Notice
- http://www.oracle.co...eol-135779.html
After November 2012, Oracle will no longer post updates of Java SE 6 to its public download sites...
___

Oracle to bring Java security fixes directly to Mac user ...
- http://atlas.arbor.n...dex#-1272909644
Severity: Elevated Severity
Published: Monday, April 30, 2012 16:24
Oracle is now providing a direct version of Java to OSX users.
Analysis: This is a positive development that will hopefully reduce OSX malware. The lag in patch time between Oracle and Apple has been a thorn in the side of security for some time and the pain of the recent Flashback trojan, the SabPub trojan, and now another OSX malware using the same Java security hole has been significant enough that users should migrate towards Oracle Java as soon as possible. Cyber criminals are aware that OSX is a viable platform for malware, and will have their eyes open for other gaps in coverage.
Source: http://arstechnica.c...jdk-support.ars

.

Edited by AplusWebMaster, 01 May 2012 - 01:03 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#23 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 12 June 2012 - 01:29 PM

FYI...

Java v7u5 / v6 Update 33 released
- http://www.oracle.co...oads/index.html
June 12, 2012

- http://www.oracle.co...12-1515912.html
"... contains 14 new security fixes for Oracle Java SE. 12 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password..."

Risk Matrix
- http://www.oracle.co...ml#AppendixJAVA
7 Update 4 and before, 6 Update 32 and before, 5 Update 35 and before, 1.4.2_37 and before. JavaFX 2.1 and before...

Verify:
>> https://www.java.com...etect=jre&try=1

Java SE 7u5 JRE
- http://www.oracle.co...ds-1637588.html
Changes in 1.7.0_5
- http://www.oracle.co...es-1653274.html

Java SE 6 Update 33 JRE
- http://www.oracle.co...ds-1637595.html
Changes in 1.6.0_33
- http://www.oracle.co...es-1653258.html
___

URGENT BULLETIN: All E-Business Suite End-Users...
- https://blogs.oracle...jre_auto_update
Update: June 14, 2012 - "To ensure that Java Users remain on a secure version, Windows systems that rely on auto-update will be auto-updated from JRE 6 to JRE 7. Until EBS is certified with JRE 7, EBS users should -not- rely on the windows auto-update mechanism for their client machines and should -manually- keep the JRE up to date with the latest versions of 6 on an ongoing basis..."

- http://h-online.com/-1618753
15 June 2012
___

- http://www.securityt....com/id/1027153
CVE Reference: CVE-2012-1711, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1720, CVE-2012-1721, CVE-2012-1722, CVE-2012-1723, CVE-2012-1724, CVE-2012-1725, CVE-2012-1726
Jun 12 2012
Impact: Denial of service via network, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via local system, User access via network
Version(s): 1.4.2_37 and prior, 5.0 Update 35 and prior, 6 Update 32 and prior, 7 Update 4 and prior...

- https://secunia.com/advisories/49472/
Release Date: 2012-06-13
Criticality level: Highly critical
Impact: Cross Site Scripting, Manipulation of data, Exposure of sensitive information, DoS, System access
Where: From remote
Original Advisory: Oracle:
http://www.oracle.co...se-1515971.html

:ph34r: :ph34r:

Edited by AplusWebMaster, 15 June 2012 - 09:55 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#24 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 14 August 2012 - 09:31 PM

FYI...

Java v7u6 / v6u34 released
- http://www.oracle.co...e/press/1735645
August 14, 2012

- http://www.oracle.co...oads/index.html

Java SE 7u6 JRE
- http://www.oracle.co...ds-1637588.html
Changes in 1.7.0_6
- http://www.oracle.co...es-1729681.html
Bug fixes
- http://www.oracle.co...es-1733378.html

Java SE 6 Update 34 JRE
- http://www.oracle.co...ds-1637595.html
Changes in 1.6.0_34
- http://www.oracle.co...es-1729733.html
Bug fixes
- http://www.oracle.co...es-1733379.html

Java 6 EOL extended to February 2013
- https://blogs.oracle.../java_6_eol_h_h

Verify: https://www.java.com...etect=jre&try=1
___

- http://h-online.com/-1667714
15 August 2012
___

- http://nakedsecurity...or-apple-users/
Aug 15, 2012 - "... the latest Java version from Oracle is 7u6, also known as 1.7.0_6. If you don't intend to develop Java programs yourself, stick to the JRE. It's much smaller than the JDK, which reduces what's known in trendy-speak as your attack surface area. That's always a good thing. This new Java version includes a longish list of bugfixes*. These include: a few ominous-sounding ones with more than a whiff of vulnerability about them, such as 7166498 - JVM crash in ClassVerifier; the risky-sounding 7155051 - DNS provider may return incorrect results; and the intriguingly sticky-sounding 7178177 - Debug spewage when applets start up. With that in mind, I suggest you update as soon as practicable."
* http://www.oracle.co...es-1733378.html

:!:

Edited by AplusWebMaster, 19 August 2012 - 10:08 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#25 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 30 August 2012 - 01:13 PM

FYI...

New critical Java flaw claimed
- http://www.theregist..._new_java_flaw/
26 Sep 2012- "Oracle's Java is making a play to wrest back the title of world's leakiest code from Internet Explorer, after Polish researcher Adam Gowdiak claimed another critical flaw exists in the product. The -new- claim is stated on the Full Disclosure mailing list where Gowdiak writes that the newly-found flaw impacts “all latest versions of Oracle Java SE software” and that it allows “a complete Java security sandbox bypass in the environment of Java SE 5, 6 and 7.” That's apparently worse than previous exploits, as they only hit Java 7..."
- http://arstechnica.c...curity-sandbox/
Sep 25, 2012

Consider disabling Java* in your browser until the next update**.

* https://krebsonsecur...om-the-browser/

** https://isc.sans.edu...l?storyid=14017

- http://www.oracle.co...rts-086861.html
"For Oracle Java SE Critical Patch Updates, the next three dates are:
16 October 2012
19 February 2013
18 June 2013 ..."
___

Java v7u7 / v6u35 released
* http://www.oracle.co...se-1835710.html
August 30, 2012

Risk Matrix
- http://www.oracle.co...ml#AppendixJAVA
CVE-2012-4681, CVE-2012-1682, CVE-2012-3136, CVE-2012-0547

- http://www.oracle.co...oads/index.html

Java SE 7u7 JRE
- http://www.oracle.co...ds-1836441.html
Changes in 1.7.0_7
- http://www.oracle.co...es-1835816.html
"... Bug fixes: This release contains a security-in-depth fix. For more information, see Oracle Security Alert for CVE-2012-4681*..."
___

Java SE 6 Update 35 JRE
- http://www.oracle.co...ds-1836473.html
Changes in 1.6.0_35
- http://www.oracle.co...es-1835788.html
"... Bug fixes: This release contains a security-in-depth fix. For more information, see Oracle Security Alert for CVE-2012-4681*..."
___

- http://web.nvd.nist....d=CVE-2012-4681 - 10.0 (HIGH)
Last revised: 09/01/2012 - "... as exploited in the wild in August 2012..."

:!: :!:

Edited by AplusWebMaster, 26 September 2012 - 08:41 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#26 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 16 October 2012 - 02:23 PM

FYI...

Java SE Critical Patch Update Advisory - October 2012
- http://www.oracle.co...12-1515924.html
Oct 16, 2012

Java JRE 7u9 released
- http://www.oracle.co...ds-1859586.html
Oct 16, 2012

Release Notes
- http://www.oracle.co...es-1863279.html

Java JRE 6 Update 37
- http://www.oracle.co...ds-1859589.html
Oct 16, 2012

Release Notes
- http://www.oracle.co...es-1863283.html

Java - October 2012 Risk Matrices
- http://www.oracle.co...ml#AppendixJAVA
"This Critical Patch Update contains 30 new security fixes for Oracle Java SE. 29 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password..."
___

- http://atlas.arbor.n...ndex#1321617866
Severity: High Severity
October 17, 2012
Oracle releases Java security patches that should be applied as soon as possible.
Analysis: Given the damage that has been caused by malware infections and system intrusions caused by vulnerable versions of Java being exploited it is likely that the security holes patched herein will also be used by cyber-criminals, nation-state attackers and others in their quest to compromise systems and pursue a malicious agenda. Limiting the scope of browser-based Java to one specific browser that's only used on trusted applications and also wrapping Java on any Microsoft platform with a technology such as EMET to reduce the risk of future exploitation can help provide additional protection for this widely attacked software.

- http://www.securityt....com/id/1027672
CVE Reference: CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-3143, CVE-2012-3159, CVE-2012-3216, CVE-2012-4416, CVE-2012-5067, CVE-2012-5068, CVE-2012-5069, CVE-2012-5070, CVE-2012-5071, CVE-2012-5072, CVE-2012-5073, CVE-2012-5074, CVE-2012-5075, CVE-2012-5076, CVE-2012-5077, CVE-2012-5078, CVE-2012-5079, CVE-2012-5080, CVE-2012-5081, CVE-2012-5082, CVE-2012-5083, CVE-2012-5084, CVE-2012-5085, CVE-2012-5086, CVE-2012-5087, CVE-2012-5088, CVE-2012-5089
Oct 17 2012
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information, User access via network
Version(s): 1.4.2_38 and prior, 5.0 Update 36 and prior, 6 Update 35, 7 Update 7 and prior
Impact: A remote user can take full control of the target system.
A remote user can access and modify data on the target system.
A remote user can cause partial denial of service conditions on the target system.
Solution: The vendor has issued a fix, described in the October 2012 Critical Patch Update advisory.
The vendor's advisory is available at:
http://www.oracle.co...12-1515924.html

- https://secunia.com/advisories/50949/
Release Date: 2012-10-17
Criticality level: Highly critical
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access
Where: From remote
... vulnerabilities are reported in the following products:
* JDK and JRE 7 Update 7 and earlier.
* JDK and JRE 6 Update 35 and earlier.
* JDK and JRE 5.0 Update 36 and earlier.
* SDK and JRE 1.4.2_38 and earlier.
* JavaFX 2.2 and earlier.
Solution: Apply updates.
Original Advisory: Oracle:
http://www.oracle.co...12-1515924.html
___

- http://javatester.org/
Oct 17, 2012 - "... not all known bugs were fixed..."

- http://blogs.compute...st-java-updates
Oct 18, 2012 -"... the ugly stuff. The biggest issue is that Oracle didn't patch all the known problems with Java. As a result, even these latest and greatest editions of Java remain vulnerable to a known critical flaw. Adam Gowdiak is the security researcher who found many of the recent flaws in Java. His last flaw became public knowledge on September 25th. Since the problem was exploitable on Java versions 5, 6 and 7, Gowdiak estimated that it put 1 billion users at risk. A couple security organizations, Heise and Kaspersky, have been in contact with Gowdiak about how well the latest versions of Java patch the flaws he discovered. Gowdiak told Heise Security "that a critical security hole that allows attackers to break out of the Java sandbox continues to exist in Java". He claims that Oracle told him that the just-released package of 30 bug fixes was "already in its final testing phase" when he reported the September 25th flaw. In other words, he was too late to the party. He told Kaspersky the same thing. The flaw that puts a billion users at risk won't be patched until February 19, 2013. This is not to suggest, in any way, ignoring the latest updates to Java. Just recognize that they make you safer (30 bugs were fixed) rather than safe..."

:!: :!:

Edited by AplusWebMaster, 16 November 2012 - 08:25 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#27 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 11 December 2012 - 10:34 PM

FYI...

Java 7u10/6u38 released
- http://www.oracle.co...oads/index.html
Dec 11, 2012

7u10 Downloads:
- http://www.oracle.co...ds-1880261.html

Bug Fixes - JDK 7u10
> http://www.oracle.co...es-1881008.html

- http://www.oracle.co...es-1880995.html
___

- http://h-online.com/-1770629
17 Dec 2012

> http://docs.oracle.c...t-security.html

> http://docs.oracle.c...s/jweb/jcp.html

- https://krebsonsecur...-shockwave-bug/
Dec 19, 2012 - "... There are bug fixes with these releases, but no official security updates. However, the Java 7 update does include some new functionality designed to make it easier to disable Java in the browser..."
___

6 Update 38 Downloads:
- http://www.oracle.co...ds-1877409.html

Bug Fixes - JDK 6u38
- http://www.oracle.co...es-1880999.html

- http://www.oracle.co...es-1880997.html

- http://www.oracle.co...eol-135779.html
"... After February 2013, Oracle will no longer post updates of Java SE 6 to its public download sites. Existing Java SE 6 downloads already posted as of February 2013 will remain accessible in the Java Archive on Oracle Technology Network. Developers and end-users are encouraged to update to more recent Java SE versions..."

:!:

Edited by AplusWebMaster, 19 December 2012 - 10:40 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#28 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 13 January 2013 - 07:29 PM

FYI...

Java v7u11 released - Download
- http://www.oracle.co...ds-1880260.html
Jan 13, 2013

Release Notes
- http://www.oracle.co...es-1896856.html
"... This release contains fixes for security vulnerabilities. For more information, see Oracle Security Alert for CVE-2013-0422..."
* http://www.oracle.co...22-1896849.html

> http://www.oracle.co...ml#AppendixJAVA
2013-January 13

- https://blogs.oracle...rt_for_cve_2013
Jan 13, 2013 - "... The vulnerabilities addressed with this Security Alert are CVE-2013-0422 and CVE-2012-3174. These vulnerabilities, which only affect Oracle Java 7 versions, are both remotely exploitable without authentication and have received a CVSS Base Score of 10.0. Oracle recommends that this Security Alert be applied as soon as possible because these issues may be exploited “in the wild” and some exploits are available in various hacking tools..."

- http://web.nvd.nist....d=CVE-2013-0422 - 10.0 (HIGH)
"... vulnerability in Oracle Java 7 before Update 11..."
- http://web.nvd.nist....d=CVE-2012-3174 - 10.0 (HIGH)
"... vulnerability in Oracle Java 7 before Update 11..."

:ph34r: :ph34r:


Edited by AplusWebMaster, 19 January 2013 - 07:35 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#29 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 01 February 2013 - 03:22 PM

FYI...

Java v7u13 released
- http://www.oracle.co...ds-1880260.html
Feb 1, 2013

JRE 7u13
- http://www.oracle.co...ds-1880261.html

- https://www.java.com...load/manual.jsp

Release Notes
- http://www.oracle.co...es-1902884.html
This release contains fixes for security vulnerabilities. For more information, see Oracle Java SE Critical Patch Update Advisory*.

* http://www.oracle.co...se-1841196.html

- http://www.oracle.co...ml#AppendixJAVA

- https://blogs.oracle...al_patch_update
Feb 01, 2013 - "... contains fixes for -50- security vulnerabilities. 44 of these vulnerabilities only affect client deployment of Java..."

Oracle Java SE Critical Patch Update Advisory - February 2013
- http://www.oracle.co...13-1841061.html
Note: The original Critical Patch Update for Java SE – February 2013 was scheduled to be released on February 19th, but Oracle decided to accelerate the release of this Critical Patch Update because active exploitation “in the wild” of one of the vulnerabilities affecting the Java Runtime Environment (JRE) in desktop browsers, was addressed with this Critical Patch Update...

- https://web.nvd.nist...d=CVE-2013-1489 - 10.0 (HIGH)
___

JRE 6u39
- http://www.oracle.co...ds-1902815.html

- http://www.oracle.co...es-1902886.html
___

- http://www.securityt....com/id/1028071
CVE Reference: CVE-2012-1541, CVE-2012-1543, CVE-2012-3213, CVE-2012-3342, CVE-2012-4301, CVE-2012-4305, CVE-2013-0351, CVE-2013-0409, CVE-2013-0419, CVE-2013-0423, CVE-2013-0424, CVE-2013-0425, CVE-2013-0426, CVE-2013-0427, CVE-2013-0428, CVE-2013-0429, CVE-2013-0430, CVE-2013-0431, CVE-2013-0432, CVE-2013-0433, CVE-2013-0434, CVE-2013-0435, CVE-2013-0436, CVE-2013-0437, CVE-2013-0438, CVE-2013-0439, CVE-2013-0440, CVE-2013-0441, CVE-2013-0442, CVE-2013-0443, CVE-2013-0444, CVE-2013-0445, CVE-2013-0446, CVE-2013-0447, CVE-2013-0448, CVE-2013-0449, CVE-2013-0450, CVE-2013-1472, CVE-2013-1473, CVE-2013-1474, CVE-2013-1475, CVE-2013-1476, CVE-2013-1477, CVE-2013-1478, CVE-2013-1479, CVE-2013-1480, CVE-2013-1481, CVE-2013-1482, CVE-2013-1483, CVE-2013-1489
Feb 1 2013
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.0 Update 38 and prior; 6 Update 38 and prior; 7 Update 11 and prior...
Solution: The vendor has issued a fix as part of the Oracle Java SE Critical Patch Update Advisory for February 2013. The vendor's advisory is available at:
- http://www.oracle.co...13-1841061.html

- http://www.kb.cert.org/vuls/id/858729
Last Updated: 05 Feb 2013
___

- https://blogs.oracle..._2013_critical#
Update Feb 08, 2013: "... As a result of the accelerated release of the Critical Patch Update, Oracle did not include a small number of fixes initially intended for inclusion in the February 2013 Critical Patch Update for Java SE. Oracle is therefore planning to release an updated version of the February 2013 Critical Patch Update on the initially scheduled date. This updated February 2013 Critical Patch Update will be published on February 19th..."

:ph34r: :ph34r:


Edited by AplusWebMaster, 18 February 2013 - 05:23 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#30 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 19 February 2013 - 03:20 PM

FYI...

- https://secure.dslre...orum/r28039102-
2013-02-23 - "With the last 2 Java updates on my XP box (7_13 & 7_15), I received the offer of a McAfee Security Scan which I declined. The same updates on my Vista box offered the installation of the Ask.com toolbar which I also declined..."

 

- https://encrypted.google.com/
Tag-along software installs
"... About 35,500,000 results..." < 3.15.2013
___

IBM Java Multiple Vulnerabilities
- https://secunia.com/advisories/52308/
Release Date: 2013-03-01
Criticality level: Highly critical
Impact: Privilege escalation, DoS, System access, Manipulation of data, Exposure of sensitive information
Where: From remote...
Original Advisory: http://www.ibm.com/d...ava/jdk/alerts/
___

Java 7u15 released - JRE
- http://www.oracle.co...ds-1880261.html
Feb 19, 2013

Release Notes
- http://www.oracle.co...es-1907738.html

JDK
- http://www.oracle.co...ds-1880260.html

Java v7 Update 15
- https://www.java.com...load/manual.jsp

Risk Matrix
- http://www.oracle.co...ml#AppendixJAVA

- https://blogs.oracle..._critical_patch
Feb 19, 2013
___

Java JRE v6 Update 41
- http://www.oracle.co...ds-1902815.html
___

- http://www.securityt....com/id/1028155
CVE Reference: CVE-2013-1484, CVE-2013-1485, CVE-2013-1486, CVE-2013-1487
Feb 19 2013
Impact: Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.4.2_41 and prior, 5.0 Update 39 and prior, 6 Update 39, 7 Update 13 and prior

:ph34r:


Edited by AplusWebMaster, 15 March 2013 - 02:36 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#31 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 04 March 2013 - 05:25 PM

FYI...

There are a dozen known flaws in Java ...
- http://blogs.compute...nown-flaws-java
March 10, 2013 - "The last time Oracle released a new version of Java was less than a week ago (March 4th). Yet, there are already a dozen known, un-patched bugs in this latest release (Java 7 update 17)..."
___

Java JRE 7u17 released
- http://www.oracle.co...ds-1880261.html
Mar 4, 2013

- http://www.oracle.co...es-1915289.html

- https://blogs.oracle...t_cve_2013_1493
Mar 4, 2013 - "Today Oracle released Security Alert CVE-2013-1493 to address two vulnerabilities affecting Java running in web browsers (CVE-2013-1493 and CVE-2013-0809). One of these vulnerabilities (CVE-2013-1493) has recently been reported as being actively exploited by attackers..."

Risk Matrix
- http://www.oracle.co...ml#AppendixJAVA

JDK 7u17
- http://www.oracle.co...ds-1880260.html
___

Java 6 Update 43
- http://www.oracle.co...ds-1902815.html

- https://secunia.com/advisories/52451/
Last Update: 2013-03-05
Criticality level: Extremely critical
Impact: System access
Where: From remote...
CVE Reference(s): CVE-2013-0809, CVE-2013-1493
Solution: Update to a fixed version...
___

- http://seclists.org/...ure/2013/Mar/38
Mar 4, 2013 - "... 5 -new- security issues were discovered in Java SE 7..."

:ph34r: :ph34r:


Edited by AplusWebMaster, 15 March 2013 - 02:27 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#32 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 15 April 2013 - 09:36 PM

FYI...

Oracle Java SE Critical Patch Update Pre-Release Announcement - April 2013
- http://www.oracle.co...13-1928497.html
Apr 15, 2013 - "This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Java SE Critical Patch Update for April 2013, which will be released on Tuesday, April 16, 2013... this Critical Patch Update contains -42- new security vulnerability fixes..."
 

:ph34r: :ph34r:


This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#33 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 16 April 2013 - 03:24 PM

FYI...

- http://www.symantec....3-2423-coverage
Updated: 26 Apr 2013 - "... this vulnerability is now seen as a high priority... Please be aware of -malware- that masquerades as software updates and patches - only download the patch from the official website."

Current version always shown here:
- https://www.java.com...load/manual.jsp
___

Java JRE 7u21
- http://www.oracle.co...ds-1880261.html
April 16, 2013

Release Notes
- http://www.oracle.co...es-1932873.html

- https://blogs.oracle...l_patch_update1
Apr 16, 2013

Oracle Java SE Critical Patch Update Advisory - April 2013
- http://www.oracle.co...ml#AppendixJAVA
April 16, 2013 - "This Critical Patch Update contains 42 new security fixes for Oracle Java SE.  39 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password..."

Recommended Version 7 Update 21
- https://www.java.com...load/manual.jsp

 

- https://krebsonsecur...security-holes/
April 16, 2013 - "... contains 42 new security fixes for Oracle Java SE. A majority of these flaws are browse-to–a-hacked-site-and-get-infected vulnerabilities..."

Java JRE 6 Update 45
- http://www.oracle.co...ds-1902815.html
___

Java 7 Update 21 is available - Watch for Behaviour Changes
- https://isc.sans.edu...l?storyid=15620
2013-04-16 - "... Oracle has significantly changed how Java runs with this version.  Java now requires code signing, and will pop up brightly coloured dialogue boxes if your code is not signed.  They now alert on unsigned, signed-but-expired and self-signed certificates. We'll even need to click "OK" when we try to download and execute signed and trusted Java... graphics you can expect to see once you update are:
> https://isc.sans.edu...xpired_cert.jpg
> https://isc.sans.edu...signed_cert.jpg
 Full details on the new run policy can be found here ==>
- https://www.java.com...ritydialogs.xml
And more information can be found here ==>
- http://www.oracle.co...ng-1915323.html "

Dangerous defaults let certificates stay unchecked.
- http://www.h-online....iew=zoom;zoom=2
17 April 2013

___

- http://www.securityt....com/id/1028434
CVE Reference: CVE-2013-0401, CVE-2013-0402, CVE-2013-1488, CVE-2013-1491, CVE-2013-1518, CVE-2013-1537, CVE-2013-1540, CVE-2013-1557, CVE-2013-1558, CVE-2013-1561, CVE-2013-1563, CVE-2013-1564, CVE-2013-1569, CVE-2013-2383, CVE-2013-2384, CVE-2013-2394, CVE-2013-2414, CVE-2013-2415, CVE-2013-2416, CVE-2013-2417, CVE-2013-2418, CVE-2013-2419, CVE-2013-2420, CVE-2013-2421, CVE-2013-2422, CVE-2013-2423, CVE-2013-2424, CVE-2013-2425, CVE-2013-2426, CVE-2013-2427, CVE-2013-2428, CVE-2013-2429, CVE-2013-2430, CVE-2013-2431, CVE-2013-2432, CVE-2013-2433, CVE-2013-2434, CVE-2013-2435, CVE-2013-2436, CVE-2013-2438, CVE-2013-2439, CVE-2013-2440

Apr 16 2013
Impact: Denial of service via local system, Denial of service via network, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.0 Update 41, 6 Update 43, 7 Update 17; and prior versions...
Solution: The vendor has issued a fix (6 Update 45, 7 Update 21)...
___

- http://www.f-secure....s/00002544.html
April 23, 2013 - "A few days after Oracle released a critical patch, CVE-2013-2423* is found to (have) already been exploited. Upon checking the history, the exploitation seems to have begun on April 21st and is still actively happening... the Metasploit module was published on the 20th... the exploit was seen in the wild the day after..."
* https://web.nvd.nist...d=CVE-2013-2423
 

:ph34r:


Edited by AplusWebMaster, 15 May 2013 - 06:44 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#34 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 04 June 2013 - 09:03 AM

FYI...

Java users at risk ...
- http://community.web...a-exploits.aspx
4 Jun 2013 - "... collecting telemetry... to provide insight into usage of the most recent version of Java... almost 93% of users are still not patched to the most recent version of Java. This leaves the majority of users still vulnerable to the dangers of exploit code already in use in the wild... So 1 month after release, the remaining 92.8% of users remain vulnerable to at least one exploit in the wild... the April 2013 Java Critical Patch Update contained 42 new security fixes, of which 39 may be remotely exploitable without authentication. We saw that on April 20, 2013, to illustrate the danger of just one of these 39 remote execution vulnerabilities, Metasploit published a module to exploit a vulnerability in CVE-2013-2423*. We have observed this particular exploit code incorporated into exploit kits and used in the wild..."
* https://web.nvd.nist...d=CVE-2013-2423

Java JRE 7u21
- http://www.oracle.co...ds-1880261.html
April 16, 2013

Recommended Version 7 Update 21
- https://www.java.com...load/manual.jsp

- https://krebsonsecur...security-holes/
April 16, 2013 - "... contains 42 new security fixes for Oracle Java SE. A majority of these flaws are browse-to–a-hacked-site-and-get-infected vulnerabilities..."
 

:ph34r: :ph34r:


This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#35 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 18 June 2013 - 02:28 PM

FYI...

Java JRE 7u25
- http://www.oracle.co...ds-1880261.html
June 18, 2013

- http://www.oracle.co...oads/index.html

Release Notes
- http://www.oracle.co...es-1955741.html

- http://www.oracle.co...13-1899847.html
"... This Critical Patch Update contains 40 new security fixes across Java SE products of which 4 are applicable to server deployments of Java..."

Java SE Risk Matrix
- http://www.oracle.co...ml#AppendixJAVA

- http://www.oracle.co...se-1899853.html

- https://blogs.oracle...al_patch_update
Jun 18, 2013

Recommended Version 7 Update 25
- https://www.java.com...load/manual.jsp
___

- http://www.securityt....com/id/1028679
CVE Reference:  CVE-2013-1500, CVE-2013-1571, CVE-2013-2400, CVE-2013-2407, CVE-2013-2412, CVE-2013-2437, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2445, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2449, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2458, CVE-2013-2459, CVE-2013-2460, CVE-2013-2461, CVE-2013-2462, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2467, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743, CVE-2013-3744
Jun 18 2013
Impact: Denial of service via local system, Denial of service via network, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information, Root access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.0 Update 45, 6 Update 45, 7 Update 21; and prior versions ...
Solution: The vendor has issued a fix (7 Update 25).

- https://secunia.com/advisories/53846/
Release Date: 2013-06-19
Criticality level: Highly critical
Impact: Spoofing, Manipulation of data, Exposure of sensitive information, Privilege escalation, DoS, System access
Where: From remote  
... vulnerabilities are reported in the following products:
* JDK and JRE 7 Update 21 and prior
* JDK and JRE 6 Update 45 and prior
* JDK and JRE 5 Update 45 and prior
Solution: Apply updates...
___

Less Than 1 Percent Of Enterprises Run Newest Version Of Java
Most businesses have multiple, outdated versions of the app on their endpoints, new report finds
- http://www.darkreadi...endly=this-page
July 18, 2013 - "... More than 90 percent of organizations are running a version of Java that's at least five years old, and 82 percent of endpoints run Java version 6, according to a new report by Bit9 that investigated Java installations in the enterprise. There are an average of 1.6 versions of Java on every endpoint, and nearly half of all endpoints have more than two versions of the application. Fewer than 1 percent run the newest version of Java: version 7 Update 25, Bit9 found... why don't enterprises merely purge older versions of Java? It's the old legacy application problem. Applications that are tied to a specific version of Java could lose functionality if only the new version of Java were running..."
 

:ph34r:


Edited by AplusWebMaster, 19 July 2013 - 03:19 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#36 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 27 August 2013 - 10:45 AM

FYI...

Java 6 0-Day exploit-in-the-wild
- https://community.qu...oit-in-the-wild
Aug 26, 2013 - "CVE-2013-2463 is a vulnerability in the Java 2D subcomponent, that was addressed by Oracle in the June 2013 Critical Patch Update for Java 7. Java 6 (including the latest u45) has the same vulnerability, as Oracle acknowledges in the CPU, but since Java 6 has become unsupported as of its End-of-Life in April 2013, there is no patch for the vulnerability... this time, things have become a bit more serious. As Matthew Schwartz reports in Informationweek*, F-Secure has seen exploits for this vulnerability in Java 6 in the wild. Further they have seen it included in the Neutrino exploit kit, which guarantees that it will find widespread adoption. In addition, we still see very high rates of Java 6 installed (a bit over 50%), which means many organizations are vulnerable..."
* https://www.informat...-expl/240160443

- https://web.nvd.nist...d=CVE-2013-2463 - 10.0 (HIGH)
___

- https://community.qu...oit-in-the-wild
Comments: "... OpenJDK 6 remains supported and actively patched for security flaws. An OpenJDK 6 patch for CVE-2013-2463 is available":
- http://mail.openjdk....uly/023941.html
___

- http://blog.trendmic...loits-going-up/
Aug 28, 2013 - "... We urge users to carefully evaluate their usage of Java is necessary and ensure that copies of Java that are used are updated, to reduce exposure to present and future Java flaws."
___

- http://krebsonsecuri...security-fails/
4 Sep 2013
* http://krebsonsecuri.../javaprompt.png

- https://www.cert.org...hat_applet.html

- http://krebsonsecuri...om-the-browser/
 

:ph34r: :ph34r:


Edited by AplusWebMaster, 04 September 2013 - 07:01 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#37 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 11 September 2013 - 05:52 AM

FYI...

Java JRE 7u40 released
- http://www.oracle.co...ds-1880261.html
Sep 10, 2013

Release Notes
- http://www.oracle.co...es-2004172.html

Bug Fixes
- http://www.oracle.co...es-2007733.html

Recommended Version 7 Update 40
- https://www.java.com...load/manual.jsp

- https://blogs.oracle..._se_7_update_40
 

:ph34r: :ph34r:


This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#38 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 15 October 2013 - 03:14 PM

FYI...

Java JRE 7u45 released
- http://www.oracle.co...ds-1880261.html

- http://www.oracle.co...oads/index.html
"This release includes important security fixes. Oracle strongly recommends that all Java SE 7 users upgrade to this release..."

- https://blogs.oracle..._se_7_update_45
Oct 15, 2013

Release Notes
- http://www.oracle.co...es-2016950.html

Recommended Version 7 Update 45
- https://www.java.com...load/manual.jsp

- http://www.oracle.co...ml#AppendixJAVA
"This Critical Patch Update contains -51- new security fixes for Oracle Java SE. 50 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password..."

- https://secunia.com/advisories/55315/
Release Date: 2013-10-16
Criticality: Highly Critical
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access
Solution Status: Vendor Patch
CVE Reference(s): CVE-2013-3829, CVE-2013-4002, CVE-2013-5772, CVE-2013-5774, CVE-2013-5775,
CVE-2013-5776, CVE-2013-5777, CVE-2013-5778, CVE-2013-5780, CVE-2013-5782, CVE-2013-5783,
CVE-2013-5784, CVE-2013-5787, CVE-2013-5788, CVE-2013-5789, CVE-2013-5790, CVE-2013-5797, CVE-2013-5800, CVE-2013-5801, CVE-2013-5802, CVE-2013-5802, CVE-2013-5803, CVE-2013-5804, CVE-2013-5805, CVE-2013-5806, CVE-2013-5809, CVE-2013-5810, CVE-2013-5812, CVE-2013-5814,
CVE-2013-5817, CVE-2013-5818, CVE-2013-5819, CVE-2013-5820, CVE-2013-5823, CVE-2013-5824, CVE-2013-5825, CVE-2013-5829, CVE-2013-5830, CVE-2013-5831, CVE-2013-5832, CVE-2013-5838,
CVE-2013-5840, CVE-2013-5842, CVE-2013-5843, CVE-2013-5844, CVE-2013-5846, CVE-2013-5848,
CVE-2013-5849, CVE-2013-5850, CVE-2013-5851, CVE-2013-5852, CVE-2013-5854
Original Advisory: Oracle:
http://www.oracle.co...ml#AppendixJAVA
http://www.oracle.co...99842.html#JAVA
___

- http://krebsonsecuri...security-holes/
Oct. 16, 2013 - "... seriously consider removing Java altogether.  I’ve long urged end users to junk Java unless they have a specific use for it (this advice does not scale for businesses, which often have legacy and custom applications that rely on Java). This widely installed and powerful program is riddled with security holes, and is a top target of malware writers and miscreants..."
___

- https://isc.sans.edu...l?storyid=16811
Last Updated: 2013-10-15 20:17:01 UTC - "... Oracle is now on a quarterly update schedule, starting with this version. Going forward, expect regular updates to be released on the Tuesday closest to the 17th day of January, April, July and October. The next four dates are:
    14 January 2014
    15 April 2014
    15 July 2014
    14 October 2014 ..."
 

:ph34r: :ph34r:


Edited by AplusWebMaster, 16 October 2013 - 11:03 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#39 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 14 January 2014 - 04:57 PM

FYI...

Java JRE 7u51 released
- http://www.oracle.co...ds-1880261.html
Jan 14, 2014

Java SE Risk Matrix
- http://www.oracle.co...ml#AppendixJAVA

- http://www.oracle.co...oads/index.html
"This release includes important security fixes. Oracle strongly recommends that all Java SE 7 users upgrade to this release..."

- https://blogs.oracle..._se_7_update_51
"... important security fixes. Oracle strongly recommends that all Java SE 7 users upgrade to this release..."

Release Notes
- http://www.oracle.co...es-2085002.html

Recommended Version 7 Update 51
- https://www.java.com...load/manual.jsp
___

- http://www.securityt....com/id/1029608
CVE Reference: CVE-2013-5870, CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5893, CVE-2013-5895, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5902, CVE-2013-5904, CVE-2013-5905, CVE-2013-5906, CVE-2013-5907, CVE-2013-5910, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0382, CVE-2014-0385, CVE-2014-0387, CVE-2014-0403, CVE-2014-0408, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0418, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428
Jan 14 2014
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 7 Update 51...

- https://secunia.com/advisories/56485/
Release Date: 2014-01-15
Criticality: Highly Critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access...
___

Java Primary Cause of 91% of Attacks
- http://www.eweek.com...acks-cisco.html
2014-01-16 - "... no one technology was more abused or more culpable that Java, according to Cisco's latest annual security report*... What that means is that the final payload in observed attacks was a Java exploit..."
* http://www.cisco.com...port/index.html
"... 91% of web exploits target Java..."
 

:ph34r: :ph34r:


Edited by AplusWebMaster, 20 January 2014 - 09:42 PM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#40 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 30 January 2014 - 03:02 PM

FYI...

IBM Java multiple vulns
- https://secunia.com/advisories/56594/
Release Date: 2014-01-30
Criticality: Highly Critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access...
For more information: https://secunia.com/SA56485/
... vulnerabilities are reported in versions prior to 5.0 SR16-FP5, 6 SR15-FP1, 6.0.1 SR7-FP1, 7 SR6-FP1, and 7R1 SR1.
Solution: Update to version 5.0 SR16 FP5, 6 SR15-FP1, 6.0.1 SR7-FP1, 7 SR6-FP1, or 7R1 SR1.
Original Advisory:
- http://www.ibm.com/d...ava/jdk/alerts/
- http://www.ibm.com/s...uid=swg21662968
 

:ph34r: :ph34r:


This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#41 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 19 March 2014 - 06:23 AM

FYI...

Java SE 8
- http://www.oracle.co...oads/index.html
Mar 18, 2014

Java SE 8 Now Available
- https://blogs.oracle...a_se_embedded_8

JRE 8
- http://www.oracle.co...ds-2133155.html

JDK 8 Release Notes
- http://www.oracle.co...st-2153846.html
"The Java Platform, Standard Edition 8 Development Kit (JDK 8 ) is a feature release of the Java SE platform. It contains new features and enhancements in many functional areas... links to release information about enhancements, changes, bugs, installation, runtime deployment, and documentation. Release Notes files are located on our website only and are not in the documentation download bundle, unless otherwise noted..."

Known Issues for JDK 8
- http://www.oracle.co...es-2157115.html
___

Recommended Version 7 Update 51
- https://www.java.com...load/manual.jsp
 

:ph34r:


This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#42 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 15 April 2014 - 09:42 PM

FYI...

Java SE 8u5
- http://www.oracle.co...oads/index.html
Apr 15, 2014

Release Notes
- http://www.oracle.co...st-2153846.html

Oracle Java SE Risk Matrix
- http://www.oracle.co...ml#AppendixJAVA
___

Recommended Version 7 Update 55
- https://www.java.com...load/manual.jsp

Release Notes - 7u55
- http://www.oracle.co...es-2177812.html
"...  This JRE (version 7u55) will expire with the release of the next critical patch update scheduled for July 15, 2014..."
___

- https://secunia.com/advisories/57932/
Release Date: 2014-04-16
Criticality: Highly Critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access
CVE Reference(s): CVE-2013-6629, CVE-2013-6954, CVE-2014-0429, CVE-2014-0432, CVE-2014-0446, CVE-2014-0448, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0454, CVE-2014-0455, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458, CVE-2014-0459, CVE-2014-0460, CVE-2014-0461, CVE-2014-0463, CVE-2014-0464, CVE-2014-1876, CVE-2014-2397, CVE-2014-2398, CVE-2014-2401, CVE-2014-2402, CVE-2014-2403, CVE-2014-2409, CVE-2014-2410, CVE-2014-2412, CVE-2014-2413, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2422, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428
... vulnerabilities are reported in the following products:
* JDK and JRE 7 Update 51 and prior
* JDK and JRE 6 Update 71 and prior
* JDK and JRE 5 Update 61 and prior
* JDK and JRE 8
Solution: Apply updates...
Original Advisory:
- http://www.oracle.co...ml#AppendixJAVA
 

:ph34r:


Edited by AplusWebMaster, 16 April 2014 - 07:50 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#43 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 28 May 2014 - 07:00 PM

FYI...

Java JRE 7u60 released
- http://www.oracle.co...ds-1880261.html
May 28, 2014

Release Notes
- http://www.oracle.co...es-2200106.html
... notable bug fixes in this release:
Area: security-libs/java.security
Synopsis: Realm.getRealmsList returns realms list in wrong order...

Bug fixes included in JDK 7u60 release
- http://www.oracle.co...es-2202029.html
___

Recommended Version 7 Update 60
- https://www.java.com...load/manual.jsp
 

:ph34r:


Edited by AplusWebMaster, 31 May 2014 - 09:52 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#44 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 15 July 2014 - 03:21 PM

FYI...

Java 7u65 released
- http://www.oracle.co...ds-1880261.html
July 15, 2014

Java 8u11
- http://www.oracle.co...oads/index.html

Java SE Risk Matrix
- http://www.oracle.co...ml#AppendixJAVA
"... contains 20 new security fixes for Oracle Java SE.  All of these vulnerabilities may be remotely exploitable without authentication..."
___

Recommended Version 7 Update 65
- https://www.java.com...load/manual.jsp

Java Uninstall Tool
- https://www.java.com...er_toolinfo.xml
"...  simplifying the process of finding and uninstalling older versions of Java. The Uninstall tool shows you a list of the Java versions on your computer and then removes those that are out of date..."
- https://www.java.com...stallapplet.jsp
___

- http://www.securityt....com/id/1030577
CVE Reference: CVE-2014-2483, CVE-2014-2490, CVE-2014-4208, CVE-2014-4209, CVE-2014-4216, CVE-2014-4218, CVE-2014-4219, CVE-2014-4220, CVE-2014-4221, CVE-2014-4223, CVE-2014-4227, CVE-2014-4244, CVE-2014-4247, CVE-2014-4252, CVE-2014-4262, CVE-2014-4263, CVE-2014-4264, CVE-2014-4265, CVE-2014-4266, CVE-2014-4268
Jul 15 2014
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.0u65, Java SE 6u75, Java SE 7u60, Java SE 8u5; and prior versions...
___

- https://atlas.arbor....dex#-1227693199
High Severity
17 Jul 2014
 

:ph34r:


Edited by AplusWebMaster, 18 July 2014 - 07:09 AM.

This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#45 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 06 August 2014 - 06:33 AM

FYI...

Java 7u67 patch released
- https://blogs.oracle...update_67_patch
Aug 04, 2014 - "The recent Java 7 update 65 contained an issue that prevents some Applet and Web Start applications from launching. As a result, we have released Java 7 update 67 to restore the functionality for affected users..."

Recommended Version 7 Update 67
- https://www.java.com...load/manual.jsp
 

:ph34r: :ph34r:


This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#46 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 9,049 posts

Posted 19 August 2014 - 03:50 PM

FYI...

Java 8u20 released
- http://www.oracle.co...oads/index.html
Aug 19, 2014

Release Notes
- http://www.oracle.co...es-2257729.html

Java JRE 8u20 download
- http://www.oracle.co...ds-2133155.html

(-still-) Recommended Version 7 Update 67
- https://www.java.com...load/manual.jsp
 

:ph34r:


This machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button