Despite this, Java 6 is still widely used, especially in enterprise environments. Oracle ended its public support for Java 6 in April and will no longer release security updates for it to all users. That's because CVE-2013-2465 affects both Java 7 and Java 6 installations, while CVE-2013-2460 only affects Java 7, he said. Java update 7 is also available at which will detect your operating system and offer you the correct version.Two days after its release, the CVE-2013-2465 exploit was already integrated into so-called exploit kits, attack tools that infect computers with malware by exploiting vulnerabilities in outdated software when users visit compromised websites.Īn independent malware researcher who uses the online alias Kafeine found a live installation of the Styx exploit kit, previously known as Kein, that is using the exploit.įrom an attacker's perspective the exploit for CVE-2013-2465 is better than the exploit for CVE-2013-2460, another Java vulnerability also patched in June, that was recently integrated into a different attack toolkit called the Private Exploit Pack, Kafeine said Thursday in a blog post. Java update 6 is available at which gives you the options of downloading Java SE fixes in this Security Alert are cumulative this latest update includes all fixes from previous Critical Patch Updates and Security Alerts. Oracle recommends everyone update ASAP if you are running Java 7 update 15 or older and Java 6, update 41 and older. Successful exploits can impact the availability, integrity, and confidentiality of the user's system. For an exploit to be successful, an unsuspecting user running an affected release in a browser must visit a malicious web page that leverages these vulnerabilities. I am running JDK 1.5 and 1.6 at work (like many organizations, were not on the latest of technologies), so no problems there. I found an article the JRE 1.7 vulnerability recommending disabling Java.

These vulnerabilities may be remotely exploitable without authentication, i.e., they may be exploited over a network without the need for a username and password. Today, our Enterprise Architect mentioned that a recent vulnerability was discovered in the JRE 1.7. These vulnerabilities are not applicable to Java running on servers, standalone Java desktop applications or embedded Java applications, in other words they affect the end user.

Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java Runtime Environment accessible data as well as. Easily exploitable vulnerability requiring logon to Operating System. Java update 17 is now available and includes security fixes again. Supported versions that are affected are 7 Update 21 and before, 6 Update 45 and before and 5.0 Update 45 and before.

Java 7 update 45 vulnerability