Oracle releases Java patch update

The February patch was offered today -- ahead of schedule -- and contains fixes for 50 vulnerabilities
  • Paul Krill (InfoWorld)
  • — 01 February, 2013 23:44

Oracle on Friday released a critical patch update for Java SE, offering the patch ahead of schedule to stave off an active exploitation affecting the Java Runtime Environment in desktop browsers. Server-side fixes are being offered as well.

Initially scheduled for release on February 19, the February 2013 critical patch update contains fixes for 50 vulnerabilities. Java has been under fire lately for security issues, particularly affecting browsers, and Oracle recently vowed to be more communicative about what it is doing to fix these problems. "The popularity of the Java Runtime Environment in desktop browsers and the fact that Java in browsers is OS-independent makes Java an attractive target for malicious hackers," Oracle said in its bulletin on Friday.

[ InfoWorld columnist Andrew Oliver vouches for Java's runtime security. | Sign up for InfoWorld's Enterprise Java newsletter for more news on Java. ]

Forty-four of the 50 vulnerabilities impact Java in Internet browsers. "In other words, these vulnerabilities can only be exploited on desktops through Java Web Start applications or Java applets," Oracle said. "In addition, one vulnerability affects the installation process of client deployment of Java (i.e. installation of the Java Runtime Environment on desktops). Note also that this Critical Patch Update includes the fixes that were previously released through Security Alert CVE-2013-0422."

Additionally, three of the vulnerabilities apply to client and server deployments of Java, in which these can be exploited on desktops through Java Web Start or browser applets or in servers by supplying malicious input to APIs in vulnerable components. "In some instances, the exploitation scenario of this kind of bugs on servers is very improbable; for example, one of these vulnerabilities can only be exploited against a server in the unlikely scenario that the server was allowed to process image files from an untrusted source." Two vulnerabilities fixed in the update only apply to server-side deployment of the Java Secure Socket Extension, but most of the vulnerabilities addressed in the patch update affect Java and JavaFX client deployments, Oracle noted. "This reflects the fact that the Java server environment is more secure than the Java Runtime Environment in browsers because servers operate in a more secure and controlled environment."

This article, "Oracle releases Java patch update," was originally published at InfoWorld.com. Follow the latest developments in business technology news and get a digest of the key stories each day in the InfoWorld Daily newsletter. For the latest developments in business technology news, follow InfoWorld.com on Twitter.

Read more about security in InfoWorld's Security Channel.

Tags: application development, Java Programming, security, software, patch management, Oracle

Vulnerabilities in some Netgear router and NAS products open door to remote attacks

READ THIS ARTICLE
DO NOT SHOW THIS BOX AGAIN [ x ]
Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Fraud Management Solutions

Reduce fraud losses regardless of channel by preventing cybercrime, identity theft, and other threats targeting your customers.

Latest Jobs
Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.