Security → Java SE Critical Patch Update Pre-Release Announcement

Oracle Java SE Critical Patch Update Pre-Release Announcement - June 2011

Description

quote:

---

This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Java SE Critical Patch Update for June 2011, which will be released on Tuesday, June 7, 2011. While this Pre-Release Announcement is as accurate as possible at the time of publication, the information it contains may change before publication of the Critical Patch Update Advisory.

This Critical Patch Update is a collection of patches for multiple security vulnerabilities in Oracle Java SE. This Critical Patch Update contains 17 new security vulnerability fixes. Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible.

Vulnerabilities fixed by Critical Patch Updates are scored using the standard CVSS 2.0 scoring (see Oracle's Use of CVSS Scoring). The highest CVSS 2.0 Base Score for vulnerabilities in this Critical Patch Update is 10.0.

---

Affected Products and Components:
Security vulnerabilities addressed by this Critical Patch Update affect the following products:

• JDK and JRE 6 Update 25 and earlier for Windows, Solaris, and Linux
• JDK and JRE 5.0 Update 29 and earlier for Windows, Solaris and Linux
• SDK and JRE 1.4.2_31 and earlier for Windows, Solaris and Linux

Oracle Java SE Executive Summary

quote:

---

This Critical Patch Update contains 17 new security vulnerability fixes for Oracle Java SE. All these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

---

Full Advance Advisory
--
siljaline

Here at Mountain View Chocolate, we’re committed to transparency and choice

Recommended Version 6 Update 26 is Available Found the Changelog

Won't install on windows 7, tried two different machines.

Any error message or the like?

(The actual download, jre-6u26-windows-i586-s.exe, is dated 05/05/2011, fwiw. Being dated earlier is not too strange, but being dated 1 month ago is IMO, though I'm sure it's nothing. Most likely had the fixes in place & were finishing up testing & other ancillary issues.)

Installed ok on Vista Home Premium SP2.

Thanks

Thank you.

No problems on my updated 64-bit W7 HP machine with both 32-bit and 64-bit (IE) offline installers over my previous u25 installations.
--
Ant @ »antfarm.ma.cx and »aqfl.net. Please do not IM/e-mail me for technical support. Use the forum! Disclaimer: The views expressed in this posting are mine, and do not necessarily reflect the views of my employer

quote:

---

Won't install on windows 7, tried two different machines.

---

No problems installing 32 + 64 bit java on Win7 64bit.

Uninstalled the previous versions using CCleaner then ran CCleaner registry cleaner before installing the new versions.
--
"One Good Conspiracy Deserves Another."

Mine too. It did give me the old, "this program may not have installed properly" routine, but when I checked both version on my PC and used Java's verification tool, everything was fine.
--
da Cajun Darn I hate Malware

I have seen this message before with Java. What does it mean? Can it be ignored or do you need to reinstall?

I never had that with Java installs.
--
Ant @ »antfarm.ma.cx and »aqfl.net. Please do not IM/e-mail me for technical support. Use the forum! Disclaimer: The views expressed in this posting are mine, and do not necessarily reflect the views of my employer

I've had issues installing the last few versions myself and it turned out it was because of an issue with EMET. So if you have that installed that might be the problem.

Thanks for the update!

Found the problem. It was indeed EMET 2.1, had to change DEP from always on, to application opt out.

I always get that message i just ignore it since i always use the verification tool to check that all went well.
--
Those who do not archive the past are condemned to retype it.
Never tell people how to do things. Tell them what to do and they will surprise you with their ingenuity.
All our dreams can come true, if we have the courage to pursue them.

Yet another thing that has to be fixed. Thanks for the heads up.

To think I somehow had not updated Jave to version 25 on my own system until quite recently. I had made sure of it on other systems I monitor.

Update: Downloaded the offline installer and it worked fine in XP SP3. The installer is identified as Win 7 and XP, so I've saved it to use on the Win 7 systems when I get there. It will save a little time.

--
Don't let the pluperfect be the enemy of the perfect.

I can't get this damn thing to install,on my XP.

Tried both safe modes ,even under Admin account ,with both options to install and it just sits there.

Closed firewall and Mamutu....and still no?
--
~~Get our troops home...now!!~~

Thank you siljaline. I got it installed.

ZZZZZ - I can't tell how you're installing it, but I always use the offline installer and it works well. I suggest you try that. Just watch in case they try to install a third party thingy. Good luck.

Sincerely, Libra

I always use the offline installer file, however larger, rcdailey

Well, it's not that much larger

About 5 Megs larger

Regards,

What tool?
--
Ant @ »antfarm.ma.cx and »aqfl.net. Please do not IM/e-mail me for technical support. Use the forum! Disclaimer: The views expressed in this posting are mine, and do not necessarily reflect the views of my employer

I uninstalled old version and cleaned registry with CCleaner.
Installed updated version without a problem.

Thanks
--
Timing is everything.

I'd assume a site like: How do I test whether Java is working on my computer? or What Version of Java Are You Using?

quote:

---

this program may not have installed properly

---

I don't know what that message means, but simply because a test site like above says "OK", I would not take that to mean that everything is necessarily honky dory - given the install message.

Ah, I just use »javatester.org
--
Ant @ »antfarm.ma.cx and »aqfl.net. Please do not IM/e-mail me for technical support. Use the forum! Disclaimer: The views expressed in this posting are mine, and do not necessarily reflect the views of my employer

The one at the java web page.
»www.java.com/en/download ··· lled.jsp

Thank you siljaline . This version installs the java console extension into Firefox without asking permission. There is an option to disable the extension, but no option to remove it. However it can be removed manually by deleting the following folder:

C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
 

Also when I updated, an option for a Yahoo toolbar was pre-checked. Those not wanting the toolbar, will want to uncheck that box.

The CLSID is legit jmorlan
»www.systemlookup.com/FF_ ··· ole.html
However, if you don't want - I will advise the nice folks at system lookup that it is a toolbar. Good find and thanks for the note.

No it is not a toolbar. The Yahoo toolbar was offered to me before I did the update and can easily be unchecked. It's a separate issue from the CLSID.

The CLSID is for the Java console extension (not a toolbar). It is a legitimate extension but is installed without permission into Firefox. It can be disabled, but there is no button to remove it. It can be removed manually by deleting the folder. Some (most?) users do not need or want the Java console extension, so removal does no harm.