Oracle releases 42 fixes for Java bugs as part of wider security update

Share this article:

Oracle's quarterly security update contains 42 fixes for bugs in Java and an improved notification system to help users determine the trustworthiness of Java programs before executing them.

In a Tuesday announcement released before the update, Oracle said that the patches address 39 Java flaws that could be remotely exploited by an attacker without a user's login credentials.

Some of the vulnerabilities earned a score of 10, the most severe ranking under Oracle's Common Vulnerability Scoring System (CVSS).

Version 7u21 of Java also brings changes to the security notifications users see while running Java applets and applications. For the last several years, vulnerabilities in Java have presented some of the most prolific threats facing enterprises.

According to a security message on Java's site, the update will encourage developers and vendors to have their applications deemed legitimate by using digital certificates issued by a trusted certificate authority (CA).

"Low-risk scenarios present very minimal messages," the post said. "They include a checkbox to prevent the display of similar messages for applications provided by the same vendor in the future. Higher-risk scenarios, such as running unsigned applications, require further interaction."

The Java release came as part of Oracle's larger security update featuring 128 patches to remediate bugs in hundreds of its products.

The update includes four patches for vulnerabilities in Oracle's popular Database Server; the bugs are all able to be remotely exploited by an attacker without authentication.

Twenty-two holes plugged in Oracle's Fusion Middleware product could also be remotely exploited.

Share this article:

Sign up to our newsletters

More in News

Latest Citadel trick allows RDP access after malware's removal

Latest Citadel trick allows RDP access after malware's ...

Trusteer, an IBM company, said the new Citadel configuration was detected this month.

Cryptoblocker variant emerges, encryption differs from CryptoLocker

Trend Micro has detected a variant of CryptoLocker in the wild that relies on the advanced encryption standard.

Jimmy John's sandwich chain investigating possible breach

Some financial institutions have indicated that credit cards recently used at Jimmy John's locations have been used to make fraudulent purchases.