Oracle releases 42 fixes for Java bugs as part of wider security update

Share this article:

Oracle's quarterly security update contains 42 fixes for bugs in Java and an improved notification system to help users determine the trustworthiness of Java programs before executing them.

In a Tuesday announcement released before the update, Oracle said that the patches address 39 Java flaws that could be remotely exploited by an attacker without a user's login credentials.

Some of the vulnerabilities earned a score of 10, the most severe ranking under Oracle's Common Vulnerability Scoring System (CVSS).

Version 7u21 of Java also brings changes to the security notifications users see while running Java applets and applications. For the last several years, vulnerabilities in Java have presented some of the most prolific threats facing enterprises.

According to a security message on Java's site, the update will encourage developers and vendors to have their applications deemed legitimate by using digital certificates issued by a trusted certificate authority (CA).

"Low-risk scenarios present very minimal messages," the post said. "They include a checkbox to prevent the display of similar messages for applications provided by the same vendor in the future. Higher-risk scenarios, such as running unsigned applications, require further interaction."

The Java release came as part of Oracle's larger security update featuring 128 patches to remediate bugs in hundreds of its products.

The update includes four patches for vulnerabilities in Oracle's popular Database Server; the bugs are all able to be remotely exploited by an attacker without authentication.

Twenty-two holes plugged in Oracle's Fusion Middleware product could also be remotely exploited.

Share this article:

Sign up to our newsletters

More in News

Cyber Command tests gov't collaboration in wake of attacks

The two-week exercise, "Cyber Guard 14-1," was completed this month.

Text message spammer settles charges filed by FTC

Text message spammer settles charges filed by FTC

Rishab Verma and his company agreed to settle charges filed by the FTC that Verma sent millions of spam text messages that deceitfully promised free merchandise.

Rhode Island hospital to pay $150K for past data breach

More than 12,000 patients' personal and health information was compromised in a breach at The Women & Infants Hospital of Rhode Island.