Oracle releases Java mega patch

Stefan Mileschin · 16th July 2015, 08:34

Oracle has just fixed 25 vulnerabilities in its aging Java platform, including one that's already being exploited in attacks.

Out of the 25 vulnerabilities fixed in Java, 23 can be exploited remotely without authentication. Sixteen flaws affect only the client deployment and five affect both client and server deployments.
The most high-risk vulnerability fixed in this Java update is known as CVE-2015-2590 and had zero-day status until this update. This means attackers were already exploiting it while no fix was available. An exploit for this was uncovered by researchers from Trend Micro in attacks that targeted at the armed forces of an unnamed NATO country and a US defence organization.

The attacks were launched by Pawn Storm which is tied to Russia's intelligence services. The group has been active since 2007 and typically targets military, government and media organizations.

http://fudzilla.com/news/38241-oracl...ava-mega-patch

16th July 2015, 08:34	#1
Stefan Mileschin [M] Reviewer Join Date: May 2010 Location: Romania Posts: 148,597	Oracle releases Java mega patch Oracle has just fixed 25 vulnerabilities in its aging Java platform, including one that's already being exploited in attacks. Out of the 25 vulnerabilities fixed in Java, 23 can be exploited remotely without authentication. Sixteen flaws affect only the client deployment and five affect both client and server deployments. The most high-risk vulnerability fixed in this Java update is known as CVE-2015-2590 and had zero-day status until this update. This means attackers were already exploiting it while no fix was available. An exploit for this was uncovered by researchers from Trend Micro in attacks that targeted at the armed forces of an unnamed NATO country and a US defence organization. The attacks were launched by Pawn Storm which is tied to Russia's intelligence services. The group has been active since 2007 and typically targets military, government and media organizations. http://fudzilla.com/news/38241-oracl...ava-mega-patch

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Oracle: Java’s security problems are limited to the browser	Stefan Mileschin	WebNews	0	20th November 2013 07:58
Oracle Reveals Plans for Java Security Improvements	Stefan Mileschin	WebNews	0	3rd June 2013 10:57
CloudBee boss fears Oracle Java stranglehold	Stefan Mileschin	WebNews	0	2nd April 2013 07:00
Oracle's Java exploit may take years to fix	Stefan Mileschin	WebNews	0	18th January 2013 07:56
Oracle patches major Java 7 security vulnerability	Stefan Mileschin	WebNews	0	15th January 2013 07:29
Oracle Says Java Update Scheduled for Tuesday	Stefan Mileschin	WebNews	0	14th January 2013 11:30
AMD and Oracle to Explore Heterogeneous Computing for Java	Stefan Mileschin	WebNews	0	2nd October 2012 07:33
Oracle patches Java vulnerability	Stefan Mileschin	WebNews	0	3rd September 2012 07:41
Oracle to Issue 14 Patches for Java SE	Stefan Mileschin	WebNews	0	11th June 2012 07:47
Oracle to kick off at Google in Java spat on Monday	Stefan Mileschin	WebNews	0	16th April 2012 06:51