'However, there is a dangerous tradeoff: now millions of Java 7 applications will have to defend themselves against code level vulnerabilities without the benefit of future fixes. 'Oracle's rapid end of life schedule for Java versions is great for innovation and language evolution,' Holt said via email. Holt said it will cause 'enormous headaches and disruption to millions of application owners around the world.' The end of free Java 7 security patches is 'huge news,' according to John Matthew Holt, chief technology officer at application security firm Waratek. Users who have automatic updates enabled in Java 7 have been prompted to upgrade to Java 8 since January. With this latest release, Java 7 has also reached end of life for public updates, so future security patches for this version of Java will also be available only to customers with special support contracts. The Java 6 and 5 updates are only available to customers with long-term Java support contracts. To project Safari users, Apple has blocked Java 6 versions below update 51, and Java 7 versions below update 25.In order to address these vulnerabilities, Oracle released Java 8 update 45 (Java 8u45), Java 7u79, Java 6u95 and Java 5u85. The issue could allow a hacker to input malicious code into a user’s web browser, and it has been rated as a flaw of “extreme importance.” Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to “Incorrect image attribute verification” in 2D. NOTE: the previous information is from the June 2013 CPU. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Java continues to be a required technology. Not only is Java widely installed in most enterprises, it is also highly vulnerable and it is arguably the most pressing security concern today. Recently, however, there has been a significant rise in Java-related vulnerabilities and attacks. The latest issue is described on the National Vulnerability Database: Java has been a trending security concern for several years.

In recent days, a new Java vulnerability was discovered. Apple has informed AppleCare representatives and Apple Retail that it has updated the Safari web browser’s built-in plugin blocker to disable older versions of Oracle’s Java 6 and 7 software.

Java 7 update 45 vulnerability