Content

THREAT OF THE MONTH: Sun/Oracle Java SE

What is it?
A large number of vulnerabilities are reported in Sun/Oracle Java SE, which affect JDK and JRE 6 Update 25 and earlier, JDK 5.0 Update 29 and earlier and SDK 1.4.2_31 and earlier.

How does it work?
The critical vulnerabilities exist in various libraries and are of different classes. These range from a use-after-free error in the JP2IEXP.dll browser plug-in (when cloning the underlying DOM element) to multiple integer overflow errors in cmm.dll (when parsing various structures in color profiles) and a stack-based buffer overflow in jsound.dll within the “XExpandAiffIma()” function (when parsing IMA4 compressed soundbank streams).

Should I be worried?
Anyone with a vulnerable version installed should be very cautious when viewing web pages containing Java content.

How can I prevent it?
Oracle released updated versions in June, which can be installed to address the vulnerabilities.
 

Related

DevSecOps Scanning Challenges & Tips

There are many ways to do DevSecOps, and each organization — each security team, even — uses a different approach. Questions such as how many environments you have and the frequency of deployment of those environments are important in understanding how to integrate a security scanner into your DevSecOps machinery. The ultimate goal is speed […]

It Should Be ‘Cybersecurity Culture Month’

It’s Cybersecurity Awareness Month, but security awareness is about much more than just dedicating a month to a few activities. Security awareness is a journey, requiring motivation along the way. And culture. Especially culture.That’s the point Proofpoint Cybersecurity Evangelist Brian Reed drove home in a recent appearance on Business Security Weekly.“If your security awareness program […]

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy.

You can skip this ad in 5 seconds