(Yet another) Critical Java Patch Update Java SE 7u13

[Earth Bound Misfit]

http://www.bleepingcomputer.com/forums/topic483878.html/page__view__findpost__p__2965020

Oracle just released the [url=http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]February 2013 Critical Patch Update for Java SE.[/url] The original Critical Patch Update for Java SE was scheduled on February 19th, but Oracle decided to accelerate the release of this Critical Patch Update because active exploitation “in the wild” of one of the vulnerabilities affecting the Java Runtime Environment (JRE) in desktop browsers, was addressed with this Critical Patch Update.

In addition to a number of security in-depth fixes, the February 2013 Critical Patch Update for Java SE contains fixes for 50 security vulnerabilities. 44 of these vulnerabilities only affect client deployment of Java (e.g., Java in Internet browsers). In other words, these vulnerabilities can only be exploited on desktops through Java Web Start applications or Java applets. In addition, one vulnerability affects the installation process of client deployment of Java (i.e. installation of the Java Runtime Environment on desktops). Note also that this Critical Patch Update includes the fixes that were previously released through Security Alert CVE-2013-0422.

snip-

For more information:

The advisory for the February 2013 Critical Patch Update
[url=http://]http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html[/url]

More information about setting the security level in the Java client
[url=http://]http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/client-security.html[/url]

More information about Oracle Software Security Assurance
[url=http://]http://www.oracle.com/us/support/assurance/index.html[/url]

[Phillip McCleod]

1. thanks this is good info..

i'm a repair tech and we had a firefighter in the shop yesterday with a mac that appeared to have been hacked via a java-based weather applet he said he used a lot. they cleaned out his bank accounts! among other nasty deeds. they appear to have accessed safari password keychain and then just went hog-wild. thankfully f.d.i.c. saved his ass but still it was wicked to hear about it first hand.

he wanted to know a good antivirus program for his mac and i sent him to avast! but had to inform him that it wouldn't protect him from the java exploits. basically as i understand it apple has disabled java for now but it was just too late for this poor fellow.

it's a weird new world for mac/*nix users to be suddenly worrying about malware and security holes. i don't like it.

[ohheckyeah]

2. I removed Java from all 3 of my computers.

Frankly, I haven't missed it. I may eventually find something that can't run without it, but I'll live.

Apple has blocked Java.

http://www.usatoday.com/story/tech/2013/01/31/apple-blocks-java-on-macs-due-to-vulnerabilities/1880783/

[CountAllVotes]

3. I'm afraid to run Java

I went through hell and back getting my computers up and running again. Two of them were infected and what a damn nightmare it has been.

I have Java disabled on them.

One has Java 7 on it and it is looking to install that update.

The other has Java 6 on it and it is not looking to install any updates.

This is a huge mess and we sure aren't hearing much about it!

Thanks for the info. and I think I'll leave it as it is for now with Java disabled!

& recommend!!