Security → Java Runtime Environment (JRE) 6 Update 10 - October 16, 200

Java Runtime Environment (JRE) 6 Update 10
The Java SE Runtime Environment (JRE) allows end-users to run Java applications.
Installation Instructions | ReadMe | ReleaseNotes | Sun License | Third Party Licenses
»java.sun.com/javase/6/we ··· tes.html

download
»cds.sun.com/is-bin/INTER ··· eveloper

Than You Nick, got it.

More info, posted yesterday:
»[Update] Java 6u10

Thanks, Nick.

Thanks Nick!

This is something of a watershed Java update for Sun. To many users who have complained about a Java update leaving older, security-vulnerable versions in place and accessible (unless manually uninstalled), Sun appears to have been listening! From a Sun website regarding JRE 1.6.10 :
»java.sun.com/javase/6/do ··· reUpdate

The JRE can now be installed in two configurations: patch-in-place and static. JRE updates may be configured to patch a pre-existing installation or do a brand new installation.
...

Patch-in-place configuration

The patch-in-place mode implies that when a version of the JRE exists on a machine, any updates belonging to the same JRE family will be done in place, meaning, the existing JRE will be patched with changes. A JRE is installed in patch-in-place mode by default. The default installation directory is c:/Program Files/Java/jre where n is the Java SE minor version number (for example, n = 6 for version 1.6.0_10).

For example, if a user has previously installed JRE 6u10 in the c:/Program Files/Java/jre6 directory, and now attempts to install JRE 6u14, the version 6u14 installer does not create a new directory. Instead, it updates the pre-existing c:/Program Files/Java/jre6 directory with the new 6u14 content. The user is left with the 6u14 JRE only. The 6u10 JRE no longer exists.

Static configuration

When a JRE is installed in the static mode, it will not be updated in place by newer versions. A later version of the same JRE family will be installed in a separate directory. This mode ensures that vendors, who require a specific version of the JRE for their product, can be certain that the JRE will not be overwritten by a newer version.

This seems to indicate that for version 1.6.10 and all subsequent versions, the installation option will exist at each update to automatically replace earlier versions back to and including 1.6.10. This still will leave anything older than 1.6.10 in place, but over time, the uninstalled old-version Java problem that has led a number of users to experience malware penetrations should now start to diminish.

edited to add:
I just discovered chachazz has already noted this over in the Software Forum thread "Help » Java 6.0.40.12" thread (»Re: [Update] Java 6u10). Apparently great minds run in the same direction... chachazz's just runs a bit faster than mine.

How come update says I have the latest version (ver 6 update 7)?

Thanks Nick

You can search this forum but I am willing to bet you will find past posts on java update checker reporting that the user has an up to date version when they do not.

If you had read the post just above yours you would of seen and i quote;

"For example, if a user has previously installed JRE 6u10 in the c:/Program Files/Java/jre6 directory, and now attempts to install JRE 6u14, the version 6u14 installer does not create a new directory. Instead, it updates the pre-existing c:/Program Files/Java/jre6 directory with the new 6u14 content. The user is left with the 6u14 JRE only. The 6u10 JRE no longer exists."

this will only now happen with this new JRE 6u10, in other words when Java comes out with a new update to this version you can update it with out having to remove the old one first.

I did read that post. But I didn't understand it. And I don't understand your reply. Why is there an INTERNAL updater if it doesn't work? Doesn't the internal updater remove the earlier version? What is the internal updater for? Is it only there to tell you there is a new version available and to tell you to remove the old version (which usually is impossible to do) or what? It says I have the latest version. Supposedly, if I had allowed it it would fetch the new version and install it all silently. So, you have me totally confused.

I only have Java for MySpeed. Otherwise, I would not install it. I used Microsoft JVM until the first of this year. I find SunJava confusing, irritating and worthless (for me) except for certain speed tests. I have never needed any form of Java except for Java speedtests. So, if it is well known that the internal updater doesn't work, I wouldn't know that probably.

I agree that the install/uninstall stuff with SunJava has always been a mystery.
I have found my own workaround -
a. I don't have updates scheduled to check or download or install automatically [via the java control panel]
b. I donwload the newest version to my computer to install later [offline]
c. ONLY the latest version seems to uninstall the OLDer versions entirely
d. Even with C above I had the cleanest install on the older XP where I completely uninstalled ALL Java versions completely before I did the OFFLINE install.

Just sharing what I've noted thru the years.

Over the years people have been complaining that the java internal updater doesn't work which was right it doesn't work, but with this new JRE 6u10 update SunJava the makers of your "confusing, irritating and worthless" as you put it, claim that as of this update java will update via the internal updater and will remove and install any and all updates from now on. Now i hope that was clear enough for you to understand.

Just for note: On XP I still had to remove old java versions add-ons from within the Java console set up before it ran corectly using ONLY the new dll's for speed testing for example

Thank you. Now I understand. As I said I used MSJVM all these years with one exception so I wasn't aware that the updater doesn't work but will from ver 6 update 10 on.

I had to do all that as well, but from what i gather that will not be from now on if you have this update installed it will do all of that for you if and when Java does another up date.

Side note: Just didn't want everyone thinking that IN GENERAL the new JRE did it for older versions automatically
Until I removed the old add-ons the speed test applet was unable to load and java reported older versions confusing the 2 older versions and reporting them each 3 different times.
Best bet for now - clean up the old unless it's the 9 release before doing 10 and expecting no leftovers
My 9 updated cleanly with Vista - not so with any XP updated with old remnants...

Thank you Amy for your tips. I will try to follow them now that I understand about the installer.

The only time I used Sun Java in all the years I've had computers (until this year) was one year when I was using 98SE as my host OS. I was unable to fully uninstall previous Sun Java versions and could not get the current one to install. I'll never forget how Eric Howes (I can't recall his handle here) and R2 went to great lengths to help me. It was quite a battle to get those earlier versions removed from my machine. They were partially removed already and that was the problem when trying to remove what was left. After that experience, I just used MSJVM. I was so against Sun Java that when I bought a new computer with XP Pro SP1a on it, and Dell had installed Sun Java, that I was mad at Dell and removed it immediately and installed MSJVM.

So, this new version that supposedly will not allow old versions to partially stick around sounds great. But why all these years before Sun fixed this?

Now I've found that in VISTA there were lots of remnants of the older JAVA still on this computer including in ADD/REMOVE so I went and removed all of them and started over offline install.
I now think this new install STILL needs to be done AFTER removing the older versions first in order to be complete.
I am going to try another 2 setups to see what happens as well.
It more and more seems like a NEW install requires an UNINSTALL first of all versions and the NEW install OFFLINE for best results and cleanest install to prevent conflicts.

Ill let you know what I find happens.

Now I have found some glitches.

SEE: »Re: Java Runtime Environment (JRE) 6 Update 10 - October 16, 200

Best bet so far - remove all before new install - including folders etc throughout computer referencing JAVA
Sorry

Yeah but in my case i used JavaRa to remove all that was left over first before i installed this new version and all is fine on my end.

»Re: [Update] Java 6u10

For now I am going to recommend uninstall of all old versions again before Update 10 install. Hopefully that will make the FUTURE updates work as they should.
If older versions are still installed on computers they are STILL vulnerable to malware as we have found in many cleanups. Best to get all the old OFF

TO ALL:

Please note that in the past older versions of Sun JAVA have been full of serious security flaws and I strongly recommend UNINSTALLING ALL PRIOR versions of SunJava thru add/Remove as well as OLD install folders PRIOR to this updated version - JUST AS A PRECAUTION -

UNLESS all the older versions are removed THERE STILL REMAINS THIS RISK.

We used to have a FAQ as well as a very long topic regarding the security implications of NOT INSTALLING all previous versions of SunJAVA before installing the most up to date versions.

I have asked CalamityJane and lilhurricane to help me find that information so it can be included in an updated FAQ regarding SunJava and updating and the harm that has been proven to be dangerous to anyone who does not update their SunJava properly.

We did have a FAQ entry about this at some time either in the Security section of the Security Cleanup section FAQ's.

I will let you all know when we get this info all together for linking for all of your questions.

Thanks for your patience & understanding.

EDIT TO ADD: Please read this entire topic regarding this past issue here:
»Potential Vulnerability with Sun Java auto update

COMPLETE TOPIC: »Potential Vulnerability with Sun Java auto update
Thanks !!!
-amy-

like mele, i am new to using sun's java.. does anyone have any tips on managing it? is there anything that i need to do?

i tried adjusting some of the settings, in the control panel.. i disabled the "java quick starter", that "hanut" mentioned..

i noticed that two BHO's were added to IE.. do i need to leave those there?

when i installed the program, i saw a message saying "you now have openoffice", which i was not happy about, but, later, i couldn't find any indication that "openoffice" had actually been installed..

Two bugs:

Auto update will not remain UNchecked.

Place icon in taskbar will not remain UNchecked.

Go into control panel uncheck them, ok it, then close the window. Open the Java icon in control panel again and both are checked again.

I removed old version prior to install. Running Vista.

I still have 1.7 and Auto Update will not remain unchecked on it either.

Plus, beware of even 1.7 much less 1.10 if you have nVidia card. Both revert to earlier behavior in that they turn off nVidia transparency of the taskbar and don't want to give back either even after closing anything that was using Sun Java. This was another reason I used MSJVM for so long. I will probably go back to using it. I hate having MySpeed Advanced running in the background for days and taskbar transparency turned off.

I had 1.6 and the current 1.7 in Add/Remove. I removed 1.6 and it appears successfully gone. I have 204 Java files on the computer to look through and while looking through them, I saw that Search had the 1.4 installer package listed in several locations but 1.4 was not in Add/Remove Programs. I removed the install folder from:

C:\Documents and Settings\Administrator\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}

and from C:\Documents and Settings\Default User\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}

and from C:\Documents and Settings\Marilyn\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}

and from C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\ApplicationHistory

Then I found 1.5 also: C:\Documents and Settings\Marilyn\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060} and removed the folder.

I think removing 1.6 is why Sun Java is again taking away the taskbar transparency. 1.6 was the first version that worked properly in this regard. 1.7 was working properly until I removed 1.6. So, quite frankly, I am sorry I saw this thread. Now I am back to MSJVM. I should not have removed anything or even tried to upgrade to 1.10. Java was working correctly until I read this thread.

I directly downloaded the UPDATE 10
Went offline
Uninstalled thru add/remove
Ran windows installer cleanup

Rebooted
Checked for any remnant folders and deleted

Ran the offline install file
*KEEP in mind this was done 2 time -32 bit Vista and XP Pro

I've included some info and links I used.
»cds.sun.com/is-bin/INTER ··· peFilter

Download Java SE Runtime Environment 6u10 First Customer Ship for Windows, Multi-language
Choose Windows Offline Installation
jre-6u10-windows-i586-p.exe
15.52 MB

If the normal uninstallation process (as mentioned above) fails, then please try Microsoft Windows Installer Cleanup Utility. This tool will ensure that all irrelevant Java Runtime Environment Microsoft Installer (msi) registries are removed. Detailed information and download is available at: »support.microsoft.com/de ··· s;290301

OR GO TO:
Java Runtime Environment (JRE) 6 Update 10
»java.sun.com/javase/down ··· ndex.jsp

The home java website still shows a very old release as the most current. I used the link provided by the OP for the most recent version download and chose my OS and offline before proceeding.

I found that old versions weren't removed on my Vista install and ran the installer cleanup utility and reinstalled
For the subsequent installs I followed the steps above I listed and had no problems

The only options in Java that I change are:

Update Tab - Uncheck the box for autoupdates and click "Never Check"

Click the Advanced Tab:

1. Java Console - "Do Not Start Console."

2. Default Java for browsers - "Check both IE & Mozilla" If you do not use Fx or Seamonkey do not check Mozilla.

4.Miscellaneous - (Uncheck) Place java icon in system tray.

-Done-

That is is for my java setup.

The settings are pretty cut and dry and if you have any in depth questions about java or settings you can Google them. There are reams of info available about java.
---------------------------------
I have never seen a message saying I know have OOo. It is just a snapshot of OOo embedded in the install mechanism recommending it. I use OOo anyway but Sun Java did not put it there.

Edit* Added more info.

Yes.
That is, if you'd like the ability to run Java applets thru IE.Open Office will bring along a Java install if it detects that you don't already have it.
Can't say that I've seen it work vice-versa.

The Java installer might offer Open Office as an 'additional download for your option and convenience', however, as so many software installers do nowadays.
It would be up to you to decide whether to decline it or install it.