Avne Lite

Apple has rushed out a Java for Mac update to fix multiple security vulnerabilities, including a critical flaw discussed three months ago at Summerc0n by researcher Dino Dai Zovi. The Java for Mac update rolls up fixes for extremely critical security holes in Java 1.6.0_20. The most serious flaws allows an untrusted Java applet to execute arbitrary code outside the Java sandbox. These could be exploited to launch drive-by download attacks. Apple also fixed two additional remote code exection issues, including one that was publicly released by Dai Zovi in June (see slides - PDF). Continue reading

According to data from Microsoft’s malware protection center, there has been an “unprecedented wave” of exploits against vulnerabilities in Oracle Sun’s Java software in 2010. Microsoft’s Holly Stewart notes that there has been a dramatic spike in Java attacks in the third quarter this year, mostly against these three vulnerabilities: Continue reading

Oracle has issued a massive Java SE and Java for Business update to fix 29 security vulnerabilities that could be exploited to take complete control of vulnerable computers. According to Oracle, 28 of these vulnerabilities could be remotely exploitable without authentication (over a network without the need for a username and password). The patches are available for Windows, Linux and Solaris users. Apple’s Mac OS X is also vulnerable but security updates for that operating system is usually delayed for several months. According to Oracle’s advisory, 15 of the 29 vulnerabilities carry the maximum 10.0 CVSS severity rating. Continue reading