Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 93125 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

Java JRE updates/advisories


  • Please log in to reply
83 replies to this topic

#61 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 15 October 2013 - 02:16 PM

FYI...

Java JRE 7u45 released
- http://www.oracle.co...ds-1880261.html

- http://www.oracle.co...oads/index.html
"This release includes important security fixes. Oracle strongly recommends that all Java SE 7 users upgrade to this release..."

- https://blogs.oracle..._se_7_update_45
Oct 15, 2013

Release Notes
- http://www.oracle.co...es-2016950.html

Recommended Version 7 Update 45
- https://www.java.com...load/manual.jsp

- http://www.oracle.co...ml#AppendixJAVA
"This Critical Patch Update contains -51- new security fixes for Oracle Java SE. 50 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password..."

- https://secunia.com/advisories/55315/
Release Date: 2013-10-16
Criticality: Highly Critical
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access
Solution Status: Vendor Patch
CVE Reference(s): CVE-2013-3829, CVE-2013-4002, CVE-2013-5772, CVE-2013-5774, CVE-2013-5775, CVE-2013-5776, CVE-2013-5777, CVE-2013-5778, CVE-2013-5780, CVE-2013-5782, CVE-2013-5783, CVE-2013-5784, CVE-2013-5787, CVE-2013-5788, CVE-2013-5789, CVE-2013-5790, CVE-2013-5797, CVE-2013-5800, CVE-2013-5801, CVE-2013-5802, CVE-2013-5802, CVE-2013-5803, CVE-2013-5804, CVE-2013-5805, CVE-2013-5806, CVE-2013-5809, CVE-2013-5810, CVE-2013-5812, CVE-2013-5814, CVE-2013-5817, CVE-2013-5818, CVE-2013-5819, CVE-2013-5820, CVE-2013-5823, CVE-2013-5824, CVE-2013-5825, CVE-2013-5829, CVE-2013-5830, CVE-2013-5831, CVE-2013-5832, CVE-2013-5838, CVE-2013-5840, CVE-2013-5842, CVE-2013-5843, CVE-2013-5844, CVE-2013-5846, CVE-2013-5848, CVE-2013-5849, CVE-2013-5850, CVE-2013-5851, CVE-2013-5852, CVE-2013-5854
Original Advisory: Oracle:
http://www.oracle.co...ml#AppendixJAVA
http://www.oracle.co...99842.html#JAVA
___

- http://krebsonsecuri...security-holes/
Oct. 16, 2013 - "... seriously consider removing Java altogether. I’ve long urged end users to junk Java unless they have a specific use for it (this advice does not scale for businesses, which often have legacy and custom applications that rely on Java). This widely installed and powerful program is riddled with security holes, and is a top target of malware writers and miscreants..."
___

- https://isc.sans.edu...l?storyid=16811
Last Updated: 2013-10-15 20:17:01 UTC - "... Oracle is now on a quarterly update schedule, starting with this version. Going forward, expect regular updates to be released on the Tuesday closest to the 17th day of January, April, July and October. The next four dates are:
14 January 2014
15 April 2014
15 July 2014
14 October 2014 ..."

:ph34r: :ph34r:

Edited by AplusWebMaster, 16 October 2013 - 10:15 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.

    Advertisements

Register to Remove


#62 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 14 January 2014 - 03:58 PM

FYI...

Java JRE 7u51 released
- http://www.oracle.co...ds-1880261.html
Jan 14, 2014

Java SE Risk Matrix
- http://www.oracle.co...ml#AppendixJAVA

- http://www.oracle.co...oads/index.html
"This release includes important security fixes. Oracle strongly recommends that all Java SE 7 users upgrade to this release..."

- https://blogs.oracle..._se_7_update_51
"... important security fixes. Oracle strongly recommends that all Java SE 7 users upgrade to this release..."

Release Notes
- http://www.oracle.co...es-2085002.html

Recommended Version 7 Update 51
- https://www.java.com...load/manual.jsp
___

- http://www.securityt....com/id/1029608
CVE Reference: CVE-2013-5870, CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5893, CVE-2013-5895, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5902, CVE-2013-5904, CVE-2013-5905, CVE-2013-5906, CVE-2013-5907, CVE-2013-5910, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0382, CVE-2014-0385, CVE-2014-0387, CVE-2014-0403, CVE-2014-0408, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0418, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428
Jan 14 2014
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 7 Update 51...

- https://secunia.com/advisories/56485/
Release Date: 2014-01-15
Criticality: Highly Critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access...
___

Java Primary Cause of 91% of Attacks
- http://www.eweek.com...acks-cisco.html
2014-01-16 - "... no one technology was more abused or more culpable that Java, according to Cisco's latest annual security report*... What that means is that the final payload in observed attacks was a Java exploit..."
* http://www.cisco.com...port/index.html
"... 91% of web exploits target Java..."
 

:ph34r: :ph34r:


Edited by AplusWebMaster, 20 January 2014 - 08:44 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#63 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 30 January 2014 - 02:04 PM

FYI...

IBM Java multiple vulns
- https://secunia.com/advisories/56594/
Release Date: 2014-01-30
Criticality: Highly Critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access...
For more information: https://secunia.com/SA56485/
... vulnerabilities are reported in versions prior to 5.0 SR16-FP5, 6 SR15-FP1, 6.0.1 SR7-FP1, 7 SR6-FP1, and 7R1 SR1.
Solution: Update to version 5.0 SR16 FP5, 6 SR15-FP1, 6.0.1 SR7-FP1, 7 SR6-FP1, or 7R1 SR1.
Original Advisory:
- http://www.ibm.com/d...ava/jdk/alerts/
- http://www.ibm.com/s...uid=swg21662968
 

:ph34r: :ph34r:


.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#64 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 19 March 2014 - 05:29 AM

FYI...

Java SE 8
- http://www.oracle.co...oads/index.html
Mar 18, 2014

Java SE 8 Now Available
- https://blogs.oracle...a_se_embedded_8

JRE 8
- http://www.oracle.co...ds-2133155.html

JDK 8 Release Notes
- http://www.oracle.co...st-2153846.html
"The Java Platform, Standard Edition 8 Development Kit (JDK 8 ) is a feature release of the Java SE platform. It contains new features and enhancements in many functional areas... links to release information about enhancements, changes, bugs, installation, runtime deployment, and documentation. Release Notes files are located on our website only and are not in the documentation download bundle, unless otherwise noted..."

Known Issues for JDK 8
- http://www.oracle.co...es-2157115.html
___

Recommended Version 7 Update 51
- https://www.java.com...load/manual.jsp
 

:ph34r:


.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#65 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 15 April 2014 - 08:43 PM

FYI...

Java SE 8u5
- http://www.oracle.co...oads/index.html
Apr 15, 2014

Release Notes
- http://www.oracle.co...st-2153846.html

Oracle Java SE Risk Matrix
- http://www.oracle.co...ml#AppendixJAVA
___

Recommended Version 7 Update 55
- https://www.java.com...load/manual.jsp

Release Notes - 7u55
- http://www.oracle.co...es-2177812.html
"...  This JRE (version 7u55) will expire with the release of the next critical patch update scheduled for July 15, 2014..."
___

- https://secunia.com/advisories/57932/
Release Date: 2014-04-16
Criticality: Highly Critical
Where: From remote
Impact: Manipulation of data, Exposure of sensitive information, DoS, System access
CVE Reference(s): CVE-2013-6629, CVE-2013-6954, CVE-2014-0429, CVE-2014-0432, CVE-2014-0446, CVE-2014-0448, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0454, CVE-2014-0455, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458, CVE-2014-0459, CVE-2014-0460, CVE-2014-0461, CVE-2014-0463, CVE-2014-0464, CVE-2014-1876, CVE-2014-2397, CVE-2014-2398, CVE-2014-2401, CVE-2014-2402, CVE-2014-2403, CVE-2014-2409, CVE-2014-2410, CVE-2014-2412, CVE-2014-2413, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2422, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428
... vulnerabilities are reported in the following products:
* JDK and JRE 7 Update 51 and prior
* JDK and JRE 6 Update 71 and prior
* JDK and JRE 5 Update 61 and prior
* JDK and JRE 8
Solution: Apply updates...
Original Advisory:
- http://www.oracle.co...ml#AppendixJAVA
 

:ph34r:


Edited by AplusWebMaster, 16 April 2014 - 06:47 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#66 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 28 May 2014 - 06:02 PM

FYI...

Java JRE 7u60 released
- http://www.oracle.co...ds-1880261.html
May 28, 2014

Release Notes
- http://www.oracle.co...es-2200106.html
... notable bug fixes in this release:
Area: security-libs/java.security
Synopsis: Realm.getRealmsList returns realms list in wrong order...

Bug fixes included in JDK 7u60 release
- http://www.oracle.co...es-2202029.html
___

Recommended Version 7 Update 60
- https://www.java.com...load/manual.jsp
 

:ph34r:


Edited by AplusWebMaster, 31 May 2014 - 08:53 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#67 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 15 July 2014 - 02:23 PM

FYI...

Java 7u65 released
- http://www.oracle.co...ds-1880261.html
July 15, 2014

Java 8u11
- http://www.oracle.co...oads/index.html

Java SE Risk Matrix
- http://www.oracle.co...ml#AppendixJAVA
"... contains 20 new security fixes for Oracle Java SE.  All of these vulnerabilities may be remotely exploitable without authentication..."
___

Recommended Version 7 Update 65
- https://www.java.com...load/manual.jsp

Java Uninstall Tool
- https://www.java.com...er_toolinfo.xml
"...  simplifying the process of finding and uninstalling older versions of Java. The Uninstall tool shows you a list of the Java versions on your computer and then removes those that are out of date..."
- https://www.java.com...stallapplet.jsp
___

- http://www.securityt....com/id/1030577
CVE Reference: CVE-2014-2483, CVE-2014-2490, CVE-2014-4208, CVE-2014-4209, CVE-2014-4216, CVE-2014-4218, CVE-2014-4219, CVE-2014-4220, CVE-2014-4221, CVE-2014-4223, CVE-2014-4227, CVE-2014-4244, CVE-2014-4247, CVE-2014-4252, CVE-2014-4262, CVE-2014-4263, CVE-2014-4264, CVE-2014-4265, CVE-2014-4266, CVE-2014-4268
Jul 15 2014
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.0u65, Java SE 6u75, Java SE 7u60, Java SE 8u5; and prior versions...
___

- https://atlas.arbor....dex#-1227693199
High Severity
17 Jul 2014
 

:ph34r:


Edited by AplusWebMaster, 18 July 2014 - 06:10 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#68 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 06 August 2014 - 05:35 AM

FYI...

Java 7u67 patch released
- https://blogs.oracle...update_67_patch
Aug 04, 2014 - "The recent Java 7 update 65 contained an issue that prevents some Applet and Web Start applications from launching. As a result, we have released Java 7 update 67 to restore the functionality for affected users..."

Recommended Version 7 Update 67
- https://www.java.com...load/manual.jsp
 

:ph34r: :ph34r:


.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#69 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 19 August 2014 - 02:53 PM

FYI...

Java 8u20 released
- http://www.oracle.co...oads/index.html
Aug 19, 2014

Release Notes
- http://www.oracle.co...es-2257729.html

Java JRE 8u20 download
- http://www.oracle.co...ds-2133155.html

(-still-) Recommended Version 7 Update 67
- https://www.java.com...load/manual.jsp
 

:ph34r:


.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#70 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 14 October 2014 - 02:18 PM

FYI...

Java 8u25 released
- http://www.oracle.co...oads/index.html
Oct 14, 2014 - "This release includes important security fixes. Oracle strongly recommends that all Java SE 8 users upgrade to this release."

Release Notes
- http://www.oracle.co...es-2296185.html

Java JRE 8u25 downloads
- http://www.oracle.co...ds-2133155.html

Java JDK 8u25 downloads
- http://www.oracle.co...ds-2133151.html

Recommended Version 8 Update 25
- https://www.java.com...load/manual.jsp

... if you still need to use Java at all. If not - uninstall it!
___

- http://www.securityt....com/id/1031035
CVE Reference: CVE-2014-0050, CVE-2014-2478, CVE-2014-4289, CVE-2014-4290, CVE-2014-4291, CVE-2014-4292, CVE-2014-4293, CVE-2014-4294, CVE-2014-4295, CVE-2014-4296, CVE-2014-4297, CVE-2014-4298, CVE-2014-4299, CVE-2014-4300, CVE-2014-4301, CVE-2014-4310, CVE-2014-6452, CVE-2014-6453, CVE-2014-6454, CVE-2014-6455, CVE-2014-6467, CVE-2014-6483, CVE-2014-6537, CVE-2014-6538, CVE-2014-6542, CVE-2014-6544, CVE-2014-6545, CVE-2014-6546, CVE-2014-6547, CVE-2014-6560, CVE-2014-6563, CVE-2014-6513, CVE-2014-6532, CVE-2014-6503, CVE-2014-6456, CVE-2014-6562, CVE-2014-6485, CVE-2014-6492, CVE-2014-6493, CVE-2014-4288, CVE-2014-6466, CVE-2014-6458, CVE-2014-6468, CVE-2014-6506, CVE-2014-6511, CVE-2014-6476, CVE-2014-6515, CVE-2014-6504, CVE-2014-6519, CVE-2014-6517, CVE-2014-6531, CVE-2014-6512, CVE-2014-6457, CVE-2014-6527, CVE-2014-6502, CVE-2014-6558
Oct 15 2014
Impact: Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Description: Multiple vulnerabilities were reported in Oracle Java. A remote or local user can obtain elevated privileges on the target system. A remote user can partially access and modify data...
Solution: The vendor has issued a fix as part of the Oracle Critical Patch Update Advisory - October 2014.
The vendor's advisory is available at:
- http://www.oracle.co...14-1972960.html

>> http://www.oracle.co...72962.html#JAVA
 

:ph34r: :ph34r:


Edited by AplusWebMaster, 15 October 2014 - 06:25 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.

    Advertisements

Register to Remove


#71 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 20 January 2015 - 06:28 PM

FYI...

Java 8u31 released
- http://www.oracle.co...ds-2133151.html
Jan 20, 2015

Release notes
- http://www.oracle.co...es-2389094.html

Bug Fixes
- http://www.oracle.co...es-2389095.html

JRE Downloads
- http://www.oracle.co...ds-2133155.html

Oracle Java SE Risk Matrix
- http://www.oracle.co...ml#AppendixJAVA
Jan 20, 2015

Recommended Version 8 Update 31
- https://www.java.com...load/manual.jsp
Jan 20, 2015

... -if- you still need to use Java at all. If not - uninstall it!

- https://blogs.oracle...al_patch_update
Jan 20, 2015 - "... Organizations should disable the use of all versions of SSL as they can no longer rely on SSL to ensure secure communications between systems. Customers should update their custom code to switch to a more resilient protocol (e.g., TLS 1.2). They should also expect that all versions of SSL be disabled in all Oracle software moving forward. A manual configuration change can allow Java SE clients and server endpoints, which have been updated with this Critical Patch Update, to continue to temporarily use SSL v3.0. However, Oracle strongly recommends organizations to phase out their use of SSL v3.0 as soon as possible..."

>> https://www.ssllabs....ewMyClient.html
___

- http://www.securityt....com/id/1031580
CVE Reference: CVE-2014-6549, CVE-2014-6585, CVE-2014-6587, CVE-2014-6591, CVE-2014-6593, CVE-2014-6601, CVE-2015-0383, CVE-2015-0395, CVE-2015-0400, CVE-2015-0403, CVE-2015-0406, CVE-2015-0407, CVE-2015-0408, CVE-2015-0410, CVE-2015-0412, CVE-2015-0413, CVE-2015-0421, CVE-2015-0437
Jan 20 2015
Impact: Denial of service via local system, Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information, User access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 5.0u75, 6u85, 7u72, 8u25 ...
Solution: The vendor has issued a fix as part of the Oracle Critical Patch Update Advisory - January 2015.
> http://www.oracle.co...ml#AppendixJAVA
 

:ph34r: :ph34r:


Edited by AplusWebMaster, 21 January 2015 - 08:21 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#72 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 04 March 2015 - 04:56 PM

FYI...

Java 8u40 released
- http://www.oracle.co...ds-2133151.html
Mar 4, 2015

Release notes
- http://www.oracle.co...es-2389089.html

Downloads / JRE
- http://www.oracle.co...ds-2133155.html

Recommended Version 8 Update 40
- https://www.java.com...load/manual.jsp
Mar 4, 2015

... -if- you still need to use Java at all. If not - uninstall it!
___

- http://www.engadget....ava-adware-mac/
March 6 2015 - "... For Java 8 Update 40 on Mac, the update instructions now confirm that "Oracle has partnered with companies that offer various products," including Ask .com (McAfee products have also been bundled on the PC)... the parent company of Ask .com - which also owns Tinder, OKCupid, the Daily Beast and others - paid out $883 million to partners like Oracle to distribute its toolbar and other wares..."
> https://www.java.com...ac_sponsors.jpg
 

:ph34r: :ph34r:


Edited by AplusWebMaster, 07 March 2015 - 04:42 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#73 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 14 April 2015 - 02:15 PM

FYI...

Java 8u45 released
- http://www.oracle.co...ds-2133151.html
Apr 14, 2015

Release notes
- http://www.oracle.co...es-2494160.html

Downloads / JRE
- http://www.oracle.co...ds-2133155.html

Recommended Version 8 Update 45
- https://www.java.com...load/manual.jsp
Apr 14, 2015

... -if- you still need to use Java at all. If not - uninstall it!
___

- http://www.securityt....com/id/1032120
CVE Reference: CVE-2015-0458, CVE-2015-0459, CVE-2015-0460, CVE-2015-0469, CVE-2015-0470, CVE-2015-0477, CVE-2015-0478, CVE-2015-0480, CVE-2015-0484, CVE-2015-0486, CVE-2015-0488, CVE-2015-0491, CVE-2015-0492
Apr 14 2015
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Java SE 5.0u81, 6u91, 7u76, 8u40; Java FX 2.2.76...
Solution: The vendor has issued a fix as part of Oracle Critical Patch Update Advisory - April 2015.

> http://www.oracle.co...ml#AppendixJAVA
"... contains 14 new security fixes for Oracle Java...  All of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password..."
> http://www.oracle.co...65613.html#JAVA
 

:ph34r: :ph34r:


Edited by AplusWebMaster, 15 April 2015 - 11:29 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#74 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 14 July 2015 - 04:21 PM

FYI...

Java 8u51 released

Release Notes
- http://www.oracle.co...es-2587590.html

Downloads / JRE
- http://www.oracle.co...ds-2133155.html

Recommended Version 8 Update 51
- https://www.java.com...load/manual.jsp
July 14, 2015

... -if- you still need to use Java at all. If not - uninstall it!
___

Patch Availability Table
- http://www.oracle.co...ml#AppendixJAVA
"... contains 25 new security fixes for Oracle Java SE.  23 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password..."

https://blogs.oracle...al_patch_update
Jul 14, 2015 - "... 25 fixes Oracle Java SE. 23 of these Java SE vulnerabilities are remotely exploitable without authentication. 16 of these Java SE fixes are for Java client-only, including one fix for the client installation of Java SE. 5 of the Java fixes are for client and server deployment. One fix is specific to the Mac platform. And 4 fixes are for JSSE client and server deployments. Please note that this Critical Patch Update also addresses a recently announced 0-day vulnerability (CVE-2015-2590), which was being reported as actively exploited in the wild..."

- https://web.nvd.nist...d=CVE-2015-2590
Last revised: 07/16/2015
10.0 (HIGH)
___

- http://www.securityt....com/id/1032910
CVE Reference: CVE-2015-2590, CVE-2015-2596, CVE-2015-2597, CVE-2015-2601, CVE-2015-2613, CVE-2015-2619, CVE-2015-2621, CVE-2015-2625, CVE-2015-2627, CVE-2015-2628, CVE-2015-2632, CVE-2015-2637, CVE-2015-2638, CVE-2015-2659, CVE-2015-2664, CVE-2015-2808, CVE-2015-4000, CVE-2015-4729, CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4736, CVE-2015-4748, CVE-2015-4749, CVE-2015-4760
Jul 15 2015
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information, User access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes ...
Solution: The vendor has issued a fix as part of Oracle Critical Patch Update Advisory - July 2015.
 

:ph34r: :ph34r:


Edited by AplusWebMaster, 17 July 2015 - 12:56 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#75 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • Authentic Member
  • PipPipPipPipPipPipPip
  • 10,472 posts
  • Interests:... The never-ending battle for Truth, Justice, and the American way.

Posted 20 October 2015 - 02:58 PM

FYI...

Java 8u65 released
Oct 20, 2015

Release Notes
- http://www.oracle.co...es-2687063.html

Downloads / JRE
- http://www.oracle.co...ds-2133155.html

Recommended Version 8 Update 65
- https://www.java.com...load/manual.jsp

... -if- you still need to use Java at all. If not - uninstall it!
___

Patch Availability Table
> http://www.oracle.co...ml#AppendixJAVA

- https://blogs.oracle...al_patch_update
"... Oracle Java SE receives -25- new security fixes, -24- of which are remotely exploitable without authentication. The highest reported CVSS Base Score for these Java SE vulnerabilities is 10.0. -20- of the Java SE vulnerabilities only affect client deployment of Java SE (e.g., Java in the browser). The remaining 5 vulnerabilities affect client and server deployments of Java SE... remove obsolete JAVA SE versions from their desktop if they are not needed..."
___

- http://www.securityt....com/id/1033884
CVE Reference: CVE-2015-4734, CVE-2015-4803, CVE-2015-4805, CVE-2015-4806, CVE-2015-4810, CVE-2015-4835, CVE-2015-4840, CVE-2015-4842, CVE-2015-4843, CVE-2015-4844, CVE-2015-4860, CVE-2015-4868, CVE-2015-4871, CVE-2015-4872, CVE-2015-4881, CVE-2015-4882, CVE-2015-4883, CVE-2015-4893, CVE-2015-4901, CVE-2015-4902, CVE-2015-4903, CVE-2015-4906, CVE-2015-4908, CVE-2015-4911, CVE-2015-4916
Oct 20 2015
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information, User access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6u101, 7u85, 8u60; Embedded 8u51 ...
Solution: The vendor has issued a fix as part of the October 2105 Oracle Critical Patch Update.
 

:ph34r: :ph34r:


Edited by AplusWebMaster, 22 October 2015 - 05:50 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users