Embedded Java

users
#21

Note: This may be off topic for this list as all reports indicate that
the issue only concerns browsers. However LO (and AOO) accomodate http
links in documents; so until LO confirms there is no risk I'd recommend
turning off *all* java & only turn back on for necessary applications.
** No idea if openJDK has been affected yet.

Follow-up: U.S. says Java still risky, even after security update:
<http://www.reuters.com/article/2013/01/14/us-java-oracle-security-idUSBRE90D10P20130114>

Of course Reuters don't bother to provide a cite link, so I have:

<http://www.kb.cert.org/vuls/id/625617>

<quote>
Solution

Update to Java 7u11

Oracle Security Alert CVE-2013-0422 states that Java 7 Update 11
addresses this (CVE-2013-0422) and an equally severe vulnerability
(CVE-2012-3174). Immunity[1] has indicated that only the reflection
vulnerability has been fixed. Java 7u11 sets the default Java security
settings to "High" so that users will be prompted before running
unsigned or self-signed Java applets.

Unless it is absolutely necessary to run Java in web browsers, disable
it as described below, even after updating to 7u11. This will help
mitigate other Java vulnerabilities that may be discovered in the future.
</quote>

Added note: Windows users - if you have javafx installed, you must
either uninstall it, or update it to the latest 2.2.4 version after you
update the Java7U11 in order for Firefox or SeaMonkey to recognize java.
Javafx update link is here:
<https://www.java.com/en/javafx/>

If you absolutely have to run java in FF or SM, I highly recommend
installing Prefbar so that you can easily turn on/off java simply by
checking the Java box.
<https://addons.mozilla.org/en-us/seamonkey/addon/prefbar/>
  <http://prefbar.tuxfamily.org/help/buttons.html#java>

[1]
<http://immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed-one-of-two.html>

#22

Hi :slight_smile:
Hmmm, OpenJDK apparently was affected too.
http://www.kb.cert.org/vuls/id/625617
https://bugzilla.redhat.com/show_bug.cgi?id=894172

Apparently it was posted on the US's "Homeland security" website! Not sure
if this is the link as i got a bit lost
http://www.us-cert.gov/current/#us_cert_releases_oracle_java

Java has been all quiet for about 3 months before Christmas and then
suddenly all this! Grrrr
Regards from
Tom :slight_smile:

#23

It is an OpenJDK problem as well. I've just posted this on the Mozilla
SeaMonkey user support nntp group:

Given the Zero-Day Java 7 vulnerabilities (see Paul B Gallagher's
thread: 'Java 7u10 vulnerability in browsers' and for those using
OpenJDK & Icedtea for Java JRE:

Security releases for OpenJDK and Icedtea were released yesterday (Tues
Jan 17).

<<http://blog.fuseyism.com/index.php/2013/01/15/security-icedtea-2-1-4-2-2-4-2-3-4-released/>>
<http://blog.fuseyism.com/index.php/2013/01/16/security-and-browser-plugins/>

This confirms that OpenJDK7 and IcedTea7 were vulnerable - of course I
reckon that it will take awhile for the builds to get pushed to the
distro's.

Note that "OpenJDK 6 is not affected.". So if you are using OpenJDK7 I'd
recommend installing OpenJDK6 (you can leave OpenJDK7 installed[1]), and
then using update-alternatives to set OpenJDK6 as the system JRE.

For Debian/Ubuntu users:

$ sudo apt-get update && sudo apt-get upgrade
$ sudo apt-get install openjdk-6-jre
$ sudo apt-get install icedtea6-plugin

$ sudo update-alternatives --config java
$ sudo update-alternatives --config mozilla-javaplugin.so

Ensure that you are using OpenJDK6 instead of OpenJDK7. Example:
~$ java -version
java version "1.6.0_24"
OpenJDK Runtime Environment (IcedTea6 1.11.5) (6b24-1.11.5-0ubuntu1~12.04.1)
OpenJDK 64-Bit Server VM (build 20.0-b12, mixed mode)

If you enable Java in SeaMonkey (I recommend using Prefbar to turn Java
on/off), the IcedTead plugin (Ubuntu in this example) in about:config
will show:

IcedTea-Web Plugin (using IcedTea-Web 1.2 (1.2-2ubuntu1.3))

    File: /usr/lib/jvm/java-6-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so
    Version:
    The IcedTea-Web Plugin executes Java applets.

I'd also check your LibreOffice/ApacheOO installs & select OpenJDK6:
Tools>Options>Java> select 'Sun Microsystems, Inc. 1.6.0_24
Note: I do not know of the current zero-day vulnerablity affecting
LibreOffice/ApacheOO - but to be cautious I revert to OpenJDK6.

[1] I keep openJDK7 installed so that it will be updated when the distro
packagers issue the security update.

#24

of course I
reckon that it will take awhile for the builds to get pushed to the
distro's.

Arrived in the Fedora (16) repository just now!

Mark