News - Critical zero-day Java vulnerability discovered

[HEXUS]

Attacker could “view, change, or delete data with the privileges of a logged-on user”.

Read more.

[MrNeil]

i have just updated last night !!!

[brasco]

Another so soon? There was one last month! -.- Get it together chaps
Also if we don't visit dodgey sites as a rule, we'll be fine?

[Agent]

We should have a news article when there isn't a daily Java exploit. Feels like it needs patching every day.

[scaryjim]

Feels like it tries to update every day as well

AFAICT from the story you need to run a maliciously crafted java application (I don't think there are applets any more, since that part of the api got deprecated when I was learning java in 2005!) to be vulnerable, so as long as you've got sensible restrictions in place about what websites can run java and the sites you use are reasonably secure you should be alright. Not great though.

[Mblaster]

Feels like it tries to update every day as well

AFAICT from the story you need to run a maliciously crafted java application (I don't think there are applets any more, since that part of the api got deprecated when I was learning java in 2005!) to be vulnerable, so as long as you've got sensible restrictions in place about what websites can run java and the sites you use are reasonably secure you should be alright. Not great though.

Java applets are not deprecated still in the API and supported by all the browsers, although they are rarely actually used these days.

docs.oracle.com/javase/7/docs/api/java/applet/Applet.html