If you're still among the users who haven't disabled Java in their browsers or on their computer, be advised that Oracle has released a critical patch update for Java SE (Java 7 Update 13) on Friday.

According to the blog post released alongside the update, the company has decided to release it more that two weeks in advance because of the active exploitation “in the wild” of one of the vulnerabilities affecting the Java Runtime Environment in desktop browsers.

"Oracle felt that, releasing this Critical Patch Update two weeks ahead of our intended schedule, instead of releasing a one-off fix through a Security Alert, would be more effective in helping preserve the security posture of Java customers. The size of this Critical Patch Update, as well as its early publication, demonstrate Oracle’s intention to accelerate the release of Java fixes, particularly to help address the security worthiness of the Java Runtime Environment (JRE) in desktop browsers," explained Eric Maurice, Software Security Assurance Director at Oracle.

This February Patch Update contains fixes for 50 security vulnerabilities - 44 of which only affect client deployment of Java (for example, Java in browsers).

"3 of the vulnerabilities fixed in this Critical Patch Update apply to client and server deployment of Java; that means that these vulnerabilities can be exploited on desktops through Java Web Start and Java applets in Browser, or in servers, by supplying malicious input to APIs in the vulnerable server components," Maurice noted.

"In some instances, the exploitation scenario of this kind of bugs on servers is very improbable; for example, one of these vulnerabilities can only be exploited against a server in the unlikely scenario that the server was allowed to process image files from an untrusted source."

One of the remaining flaws affects the installation process of client deployment of Java, and two more apply to server deployment of the Java Secure Socket Extension.

He also reminded users that Oracle has switched the Java security settings to “high” by default, preventing suspicious applets to execute "silently".

Oracle advises customers to apply the patch as soon as possible.



Follow @zeljkazorz