Security → Java Platform, Standard Edition Java SE 6 Update 24

Java Platform, Standard Edition
Java SE 6 Update 24
This release includes security enhancements and bug fixes.

»www.oracle.com/technetwo ··· 697.html

»java.com/en/download/index.jsp

Thank You Nick!!

your welcome ronnie i did find a fault with build 23 on ie9 which has now been fixed

Great!!

Time to update mine and my clients'.

Is it me or did u24 remove the updater feature from its control panel options? I do not see it in my updated 64-bit W7 HP machine. I did have to remove it from my Startup in registry again.

Well spotted. Not on my machine either

Cudni

Thanks!

The updater is still there... they've just hidden it.
Start -> Run -> "C:\Program Files (x86)\Java\jre6\bin\javacpl.exe"
See it now?
EDIT: You have to run it with admin priveledges to change and save options.

I see it now. Why did they do that? Sheesh. Why doesn't its CPL ask for administrator access? Grr! I noticed 64-bit doesn't have the update option even if I run as admin.

I guess there is only an updater for the 32-bit client as it's more popular? Makes sense to only have one updater running if you've got BOTH installed though right? I was coming back to mention that any changes made have to be done an an admin. Or right-click javacpl.exe and click "run as admin" to make and save changes. I disable the update service... and that annoying startup service. WinPatrol catches and disables them in realtime.

I wonder why Sun and Oracle didn't combine both 32-bit and 64-bit in its JRE.

One installer would be very convenient. That way you could install the 32-bit or the 64-bit, or both.

Agreed. It should detect if the OS is 64-bit and install both for IE. Sheesh!

It does if you use the 64 bit IE browser.

Uh, doesn't it require to have two different downloads and instalaltion? The x86 one is only for 32-bit web browsers. 64-bit is for 64-bit IE. Or did I do this wrong?

if you are using both 64 32 bit browsers then you will need to download both

We have detected you may be viewing this page in a 32-bit browser.If you use 32-bit and 64-bit browsers interchangeably, you will need to install both 32-bit and 64-bit Java in order to have the Java plug-in for both browsers.

»www.java.com/en/download ··· nual.jsp

I can't get the 32-bit version installed no matter what I do on Win7 Pro x64. The 64-bit version looks like it installs fine. The installer at least starts up. I had this same problem with update 23.

EDIT

I figured it out. EMET with maximum security settings enabled (DEP, ASLR, etc) was the issue.

Not sure what anon is talking about. I was talking about the installer itself. It should be combined into one x86/x64 installer. Anyways, if you use both IE32 and IE64 with Java... you NEED to download and install both for Java to function correctly. Period.

I downloaded it with Chrome (default browser), and got an error message that it did not install correctly due to something with the Settings. Windows 7 gave me an option to install it with the correct Settings, and then it installed fine. Sorry, didn't save the error message.

Thanks Nick! Here is the link for 64bit and you have to use 64bit browser to download! »java.com/en/download/win ··· java.com

TH

I'm going to express a contrary view.

Software that has to be updated SO often is inherently defective and/or outrageously insecure.

This applies not only to Java, but also to Apple's Quick Time, to Microsoft Windows, and so forth.

These frequent and perpetual updates have other issues:

a) Hassle factor. Every time Java or QuickTime is updated, garbage entries are re-inserted into the startup sequence, that have to removed. Every time.

b) UBB factor. As people start PAYING for each gigabyte, these frequent updates from Java, QT, Windows, etc., will start to cost people MONEY! And as a result, they will revolt against all these so-called "updates".

-------------------------------------------

Again, companies should be ASHAMED of software that needs to be updated so often. It is an admission of incompetence or defeat.

This is NOT the way it was supposed to be, and there is nothing normal about it, despite those who would brainwash us.

Thanks, Nick - updated.

As always, Java re-introduces jusched.exe to MSCONFIG.
This is deemed as not necessary and can be disabled via MSCONFIG and via the Java Applet in your Control Panel.

Your thinking is flawed.
Every thing involving humanity is inherently flawed.
Try thinking of the process as evolving, instead of defective.
Most software engineers are defective inherently, have you ever met any ? They are weird.

Married to one, although she now is retired from that field.

But I did read all of the publications from SIGSOFT (ACM Special Interest Group on Software Engineering) and from the IEEE Technical Council on Software Engineering (TCSE).

So I do know at least some of what I speak....

-------------------------------------------

My point is, many people seem to fawn on these companies like Sun (Java), just as the tween girls fawn on Justin Bieber.

They practically have orgasms when software updates are required.

Rather than be thrilled, we consumers should be pissed.

They suggest this is the reason for the current update...

»www.oracle.com/technetwo ··· 811.html

Oracle Security Alert for CVE-2010-4476

Description
This Security Alert addresses security issue CVE-2010-4476 (Java Runtime Environment hangs when converting "2.2250738585072012e-308" to a binary floating-point number), which is a vulnerability in the Java Runtime Environment component of the Oracle Java SE and Java for Business products. This vulnerability allows unauthenticated network attacks ( i.e. it may be exploited over a network without the need for a username and password). Successful attack of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete Denial of Service) of the Java Runtime Environment. Java based application and web servers are especially at risk from this vulnerability.

Some suggest they should be doing more updates at this time frame...

»www.ecoustics.com/pcw/ne ··· s/219105

When reported on 8 feb 2011 and confirmed by others..
»blogs.oracle.com/securit ··· -44.html

They immediately came out with a fix tool some could use right away..
»www.exploringbinary.com/ ··· 308-bug/

Note that the impact of this vulnerability on desktops is minimal: the affected applications or applets running in Internet browsers for example, might stop responding and may need to be restarted; however the desktop itself will not be compromised (i.e. no compromise at the desktop OS level). Oracle therefore recommends that consumers use the Java auto-update mechanism to get this fix.

Thanks, Nick. Installed without a problem and cleared up any old stuff with JavaRa.