Oracle announced a critical update for a number of products including Java. According to Oracle, “Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible.”
We recommend patching Java as soon as possible. Many organizations do not patch Java due to business application constraints. Serious consideration should be given to the risks of Java vulnerabilities in light of these situations. Updates can be optained from the Java website or using the Java Control Panel.
37 of these vulnerabilities affect Java SE. 35 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password, and 4 of the vulnerabilities have a CVSS rating of 10.0 (If a user is not running with administrative rights, the CVSS base score becomes a 7.5). For more information see the Java SE Risk matrix and an explanation of the of CVEs.
Fixes for the following CVEs are included in this patch:
- CVE-2013-6629
- CVE-2013-6954
- CVE-2014-0429
- CVE-2014-0432
- CVE-2014-0446
- CVE-2014-0448
- CVE-2014-0449
- CVE-2014-0451
- CVE-2014-0452
- CVE-2014-0453
- CVE-2014-0454
- CVE-2014-0455
- CVE-2014-0456
- CVE-2014-0457
- CVE-2014-0458
- CVE-2014-0459
- CVE-2014-0460
- CVE-2014-0461
- CVE-2014-0463
- CVE-2014-0464
- CVE-2014-1876
- CVE-2014-2397
- CVE-2014-2398
- CVE-2014-2401
- CVE-2014-2402
- CVE-2014-2403
- CVE-2014-2409
- CVE-2014-2410
- CVE-2014-2412
- CVE-2014-2413
- CVE-2014-2414
- CVE-2014-2420
- CVE-2014-2421
- CVE-2014-2422
- CVE-2014-2423
- CVE-2014-2427
- CVE-2014-2428
