Hack Forums
[WARNING] Update your Java installation - j8u5 released - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Keyloggers (https://hackforums.net/forumdisplay.php?fid=113)
+---- Thread: [WARNING] Update your Java installation - j8u5 released (/showthread.php?tid=4176757)

[WARNING] Update your Java installation - j8u5 released - Null Byte - Apr 16, 2014

[Image: kxTfXwL.png]


Click here to update to Java 8 Update 5


It’s time to update your Java program as Oracle has released its massive patch package for multiple security vulnerabilities.
The United States software maker Oracle releases its security updates every three months, which it referred to as "Critical Patch Updates" (CPU). Yesterday, Oracle released its second CPU-date of this year providing important updates that include a total of 104 vulnerabilities, the company has announced.

From the overall vulnerabilities, 37 security vulnerabilities impact Java SE and several of these flaws are so serious that it can be remotely exploited by a malicious malware to gain system access and execute arbitrary code with the privileges of a local user.

Successful exploitation also allows an attacker to manipulate certain local data on a system and can cause a DoS attack without the need of authentication credentials, which means the flaws can be exploited over a network without the need for a username and password to crashing an application or an entire system.

In the latest update, the vulnerability has been fixed in the current version of the “Java SE 8 Update 5" and to the newer release "Java SE 7 Update 55".

In addition to the Java SE, vulnerability has been fixed in each affected software product including:
  • Oracle Database

  • Fusion Middleware

  • Access Manager

  • Containers for J2EE

  • Data Integrator

  • Endeca Server

  • Event Processing

  • OpenSSO

  • WebCenter Portal

  • WebLogic Server

  • Hyperion Common Admin

  • E-Business Suite

  • Agile PLM Framework

  • Transportation Management

  • PeopleSoft Enterprise

  • Java SE, MySQL Server and others


Among the security updates, 4 out of 37 Java vulnerabilities are very serious that have been evaluated in the maximum rating of 10.0 in the CVSS (Common Vulnerability Scoring System) base score of common indicators risk, those must be considered as very critical.
CVE-IDs of 37 Serious Java Vulnerabilities:
  • CVE-2013-6629

  • CVE-2013-6954

  • CVE-2014-0429

  • CVE-2014-0432

  • CVE-2014-0446

  • CVE-2014-0448

  • CVE-2014-0449

  • CVE-2014-0451

  • CVE-2014-0452

  • CVE-2014-0453

  • CVE-2014-0454

  • CVE-2014-0455

  • CVE-2014-0456

  • CVE-2014-0457

  • CVE-2014-0458

  • CVE-2014-0459

  • CVE-2014-0460

  • CVE-2014-0461

  • CVE-2014-0463

  • CVE-2014-0464

  • CVE-2014-1876

  • CVE-2014-2397

  • CVE-2014-2398

  • CVE-2014-2401

  • CVE-2014-2402

  • CVE-2014-2403

  • CVE-2014-2409

  • CVE-2014-2410

  • CVE-2014-2412

  • CVE-2014-2413

  • CVE-2014-2414

  • CVE-2014-2420

  • CVE-2014-2421

  • CVE-2014-2422

  • CVE-2014-2423

  • CVE-2014-2427

  • CVE-2014-2428


The users are advised to update their installations as soon as possible from Java website or using the Java Control Panel.

Source: http://thehackernews.com/2014/04/oracle-releases-critical-update-to.html

* - Aura - Apr 16, 2014

I was waiting for the new Java version for a while now. JRE8 was out but not Java 8. Was about god damn time.
Comodo, it's Java 7 Update 55, not Java 8 Update 5. It's the Java SE (JRE) that is at Java 8 Update 5.

* - DpzFAsq4UEK8 - Apr 16, 2014

And OpenJDK is still at 7.xx…
I guess I'll install the proprietary Java.

* - Aura - Apr 17, 2014

(Apr 16, 2014 11:31 PM)Arrhythmia Wrote:  And OpenJDK is still at 7.xx…
I guess I'll install the proprietary Java.

PFFT.
There's nothing wrong with Java, what's up with that ?

* - DpzFAsq4UEK8 - Apr 17, 2014

Eh, nothing wrong with it but I prefer using free software over proprietary ones.

* - Aura - Apr 17, 2014

(Apr 17, 2014 05:02 AM)Arrhythmia Wrote:  Eh, nothing wrong with it but I prefer using free software over proprietary ones.

Don't go all Richard Stallman on me Arr ! I'M TELLING YOU.
Also, Java even if it's not a "free software" is still free to use to everyone. Just decline that stupid Ask toolbar.

* - DpzFAsq4UEK8 - Apr 17, 2014

Iḿ not that kind of a free software freak, I use Skype and Flash Player (binary blobs in the Linux kernel don't count, okaay?). Oh, and no Ask toolbar for me, it's Windows-only 😝

* - Null Byte - Apr 17, 2014

@Arr http://www.oracle.com/technetwork/java/javase/downloads/index-jsp-138363.html#javasejdk

* - DpzFAsq4UEK8 - Apr 17, 2014

Already updated.
Code
$ java -showversion
java version "1.8.0_05"
Java(TM) SE Runtime Environment (build 1.8.0_05-b13)
Java HotSpot(TM) 64-Bit Server VM (build 25.5-b02, mixed mode)


* - Belgian - Apr 18, 2014

I updated my Java version.

Thank you a lot, OP.