Oracle Patches Java 7 Vulnerability 58
First time accepted submitter JavaBear writes "Oracle have just released the u7 release of their Java 7. From the article: 'In response to the findings of a recent vulnerability in Java 7 that was being exploited by malware developers, Oracle has released an official patch that takes care of the problem.
In the past week, a new vulnerability was unveiled in Oracle's Java 7 runtime, which has been used by hackers in targeted attacks on Windows-based systems. Similar to the recent Flashback malware in OS X, this vulnerability allows criminals to create a drive-by hack where the only action needed to compromise a system is to visit a rogue Web page that hosts a malicious Java applet."
Was That So Hard? (Score:5, Informative)
Most Mac users are SOL (Score:1, Informative)
Fact: Most Mac users are at this point still running Snow Leopard.
Fact: Snow Leopard can only run Java 6 and Apple has stopped releasing security updates for it and the OS in general.
Fact: Most Mac users are SOL.
Sorry to be a bit trollish here but Apple, you know the richest company in history with money to burn, refuses to spend money to support an OS that is only 3 years old and that pisses me off.
Re:Most Mac users are SOL (Score:4, Informative)
Fact: Java 6 isn't vulnerable to this attack.
There are other problems that they are exposed to, but this isn't one of them.
Re:Most Mac users are SOL (Score:1, Informative)
From what I understand of the situation Java6 is not affected (only changes made for Java 7).
Yes you apple users should seriously make a stand on that forced upgrade or no support for you policy.
Re:Link? (Score:4, Informative)
Re:Link? (Score:4, Informative)
The default in Java is to check for an update every month.
Yet the java updater keeps on running in the background at all times, instead of using the OS scheduler.
Re:Most Mac users are SOL (Score:4, Informative)
Fact: Java 6 isn't vulnerable to this attack.
Wrong, Java 6 is affected. From the "Security Alert" [oracle.com]:
Affected product releases and versions:
JDK and JRE 7 Update 6 and before
JDK and JRE 6 Update 34 and before
But it appears Oracle did not provide a patch for Java 6 yesterday.