Java update

Oracle has released an Update 4 to the Java Runtime Environment 7.

Java SE 7u4 Downloads

Oracle has released an Update 5 to the Java Runtime Environment 7.

Oracle has released an Update 6 to the Java Runtime Environment 7.

Oracle has released an Update 7 to the Java Runtime Environment 7.

Apparently the new Java 7 Update 7 has some just discovered bugs that still need to be worked out.......

If your using Java please read:

Only hours after Oracle released its latest Java 7 update to address active exploits, security researchers found yet another vulnerability that can be exploited to run arbitrary code on systems that have the runtime installed.

Oracle's latest release of its Java 7 runtime has come under scrutiny in the past few weeks after it was found being actively exploited in malware attacks that target Windows systems. While so far the vulnerability has only been found being used against Windows, other platforms such as the Mac OS could potentially be targeted through the same exploit.

In response to these findings, Oracle broke its quarterly update schedule for Java and released update 7 for the runtime; however, even after this update, yet more vulnerabilities have been found. According to MacWorld, the Polish security firm Security Explorations is claiming to have discovered two new vulnerabilities in Java 7, which so far are proof-of-concept exploits that can be used to break the Java 7 sandbox and execute code. However, as with any vulnerability this opens new avenues for malware attacks.

Security Explorations is keeping the details about these latest vulnerabilities secret until Oracle addresses the problem, and has only stated that when exploited they allow rogue Java applets to break the Java sandbox and execute arbitrary code on the system.

Being only proof-of-concept attacks means that for now they should not pose much of a threat to Java users, and Oracle should address them in future updates. However, Oracle has recently met some criticism for its lackadaisical approach to addressing some known exploits. According to PCWorld, Oracle has known about these and other exploits since April of this year, and has not taken steps to close them.

These latest developments serve as a warning against using Java when not needed and also prematurely updating Java. Java 7 is still very early in its development, being only the seventh release so far, whereas prior runtimes have received over 30 updates to patch and manage vulnerabilities. As a result, if you need Java then you might consider installing a prior runtime version that has been well-tested, but if you do not need Java then you might consider avoiding installing it or removing it from your system if it is already installed.

Java 7 is an optional third-party installation for its supported operating systems, so only those who have installed it should be cautious of these vulnerabilities.

Reference:

New vulnerabilities found in latest Java update | MacFixIt - CNET Reviews

Thanks for the info, kemical!

As of yesterday, I've began the complete removal of Java from all of my computers, & installs within. Too large of a security risk for those who seldom uses it, many users doesn't even need it installed.

If it is needed for an app to run, the user will be advised so. So far, only one online security scanner (F-Secure) have requested that I have it. There are other scanners that doesn't require it, or it can be uninstalled after the scan.

We have enough to be concerned with, security wise, no need to carry an app around to be a magnet for malware.

Cat

Respect for Elitefx as he was the one who first brought it to my attention..

Oracle has released an Update 9 to the Java Runtime Environment 7.

Oracle has released an Update 10 to the Java Runtime Environment 7.