Oracle releases Java mega patch
 

Oracle has just fixed 25 vulnerabilities in its aging Java platform, including one that's already being exploited in attacks.


Out of the 25 vulnerabilities fixed in Java, 23 can be exploited remotely without authentication. Sixteen flaws affect only the client deployment and five affect both client and server deployments.
The most high-risk vulnerability fixed in this Java update is known as CVE-2015-2590 and had zero-day status until this update. This means attackers were already exploiting it while no fix was available. An exploit for this was uncovered by researchers from Trend Micro in attacks that targeted at the armed forces of an unnamed NATO country and a US defence organization.

The attacks were launched by Pawn Storm which is tied to Russia's intelligence services. The group has been active since 2007 and typically targets military, government and media organizations.

http://fudzilla.com/news/38241-oracl...ava-mega-patch