Dangerous vulnerability in latest Java version Java 7 Update 10 [Oracle released Java Update 11]

[enoskype]

Hi all,

 

Please be aware of the following issue:

 

Dangerous vulnerability in latest Java version

Java 7 Update 10

 

Users should therefore deactivate the Java plugin in their browsers without delay. Instructions for doing so can be found on the following web pages:

 

- Deactivating the Java plugin in Firefox

 

- Deactivating the Java plugin in Chrome

 

- Deactivating the Java plugin in Safari

 

- In Opera, the plugin manager can be accessed by entering opera plugins in the address bar.

 

- Disabling Java under Internet Explorer is not straightforward.

Tests carried out by our associates at heise Security found that Microsoft's flagship browser was still able to access the Java plugin even after it had been explicitly disabled. Users running IE are therefore advised to uninstall Java completely using the Add or Remove Programs option in Windows' Control Panel.

 

- How do I disable Java in my web browser?

 

Users can check whether Java has been successfully deactivated using the Java test page.

 

 

NOTE: Java 6 Update 38 is not vulnerable for the same exploits.

 

Cheers.

[scanreg]

can IMF detect this?

 

thanks

[enoskype]

Hi scanreg,

 

No, I don't think so, the vulnerability is in Java plugins, so IMF would not detect the malicious codes using them. (IMO, non of the other security softwares detects those too.)

 

You have to deactivate the Java plugins in the browsers until Oracle patches the Java.

 

BTW, Windows 8 with IE10 is safe if extra Java is not installed.

 

Cheers.

[Immaculens]

I didn't understand the Chrome link above as how to disable Java - but perhaps this link from Java will assist many:

 

https://java.com/en/download/help/disable_browser.xml

 

EDIT: The link is already there in the first post Immaculens. How do I disable Java in my web browser?

[Immaculens]

its interesting - I've read various pages of how to disable Java (using Java Control Panel) in Windows 8 - and I do not appear to have the "Java Control Panel" available, as in its not installed...

 

So I then alternately go to my individual browsers to disable Java - and again I cannot find a Java plugin (in Chrome) to disable, despite following directions where and how to disable it. The only thing found was a means of disabling javascript in Chrome - but this was never listed in the directions of how to disable "Java"

 

My Firefox does not show the Java plugin either... bizarre

[enoskype]

BTW, Windows 8 with IE10 is safe if extra Java is not installed.

 

Hi Immaculens,

 

Have you installed it manually by yourself? Otherwise, it could never has been installed!

 

Did you check in the Java Test Page from the link in the first post?

 

Cheers.

[Immaculens]

That's what I'm thinking because I never installed it on purpose and the pc is only two weeks old.

 

...its not installed, because the test page offers to install the plugin on the top of the page and in the main page says:

 

"The Test Java feature will only work in Desktop mode on Windows 8.

See the Java on Windows 8 FAQ for more detailed information."

 

I still find win 8 confusing to get around lol - I miss my Win 7!

 

I installed Start8 so it helps.

[enoskype]

That's it than. :grin:

 

I feel the same for W8 and W7. My next laptop will have W7 on it.

I have never ever used Metro except when I first installed it.

CES 2013: Industry Source -- More Than 3 Out of 4 Enthusiasts Reject Windows 8

 

StartMenu8 is really useful if you don't want to use Win8 in Metro form.

 

BTW, UAC settings is a great headacke in W8 too. You have to play with registry to really turn it off. (And it kills Metro function. :-P )

 

Cheers.

[enoskype]

Firefox disables Java plugins!

 

To protect Firefox users they have enabled Click To Play for recent versions of Java on all platforms (Java 7u9, 7u10, 6u37, 6u38).

The Click To Play feature ensures that the Java plugin will not load unless a user specifically clicks to enable the plugin.

Firefox users with older versions of Java are already protected by existing plugin blocking or Click To Play defences.

 

Firefox disables Java plugins

 

Cheers.

[Immaculens]

That's it than. :grin:

 

I feel the same for W8 and W7. My next laptop will have W7 on it.

I have never ever used Metro except when I first installed it.

StartMenu8 is really useful if you don't want to use Win8 as Metro.

 

BTW, UAC settings is a great headacke in W8 too. You have to play with registry to really turn it off.

 

Cheers.

 

wish I knew of StartMenu8 before installing Start8...

 

sorry - what is UAC?

[enoskype]

UAC=User Account Control (which puts the shield sign to shortcut icons. :wink:)

Settings can be reached at User Accounts in Control Panel.

 

I also use Classic Shell Start Menu that sometimes I prefer.

 

Anyway, I will be waiting for the patch from Oracle to use Java again for any browser.

 

Cheers.

[wozofoz]

That's what I'm thinking because I never installed it on purpose and the pc is only two weeks old.

 

...its not installed, because the test page offers to install the plugin on the top of the page and in the main page says:

 

"The Test Java feature will only work in Desktop mode on Windows 8.

See the Java on Windows 8 FAQ for more detailed information."

 

I still find win 8 confusing to get around lol - I miss my Win 7!

 

I installed Start8 so it helps.

Hi :smile:

If you have been using your computer for 2 weeks without Java then it might be that you don't need it.

I have been Java free for about 2 years, I have come across some websites that want me to install it but I don't really need to go to those websites and none of my software needs Java.

It might be that you must have Java but you can wait until you are sure you need it before installing it :wink:

 

All the best, woz of oz

[Toppack]

I have been Java free for about 2 years, I have come across some websites that want me to install it but I don't really need to go to those websites and none of my software needs Java.

 

Same Here, we do not see a need for it now.

[Immaculens]

lol ~ as if Oracle/Java isn't in enough hot water right now - I just ran a malware scan and their site has two tracking cookies.... yeash

[Immaculens]

Update available... of course I don't think its applicable to anyone in this thread since we don't use it ;-)

 

http://www.filehippo.com/download_jre_32/changelog/14100/

 

 

EDIT: Thanks for the link immaculens, I am closing this thread, as Java 7 is patched.