Critical Java Update Plugs 37 Security Holes
Summary: Oracle released a critical patch update for Java SE fixing at least 37 security vulnerabilities, bringing Java 7 to Update 55 and Java 8 to Update 5. At least four of the 37 flaws earned a CVSS rating of 10.0, the most severe possible, meaning they can be exploited remotely without authentication and result in complete compromise of the host operating system.
Bottom line: Krebs reports that exploit kit panels he has examined show Java powering about 90 percent of successful infections, and that some exploit kit developers now have nearly million-dollar budgets to buy zero days - with Java among the most prized.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2014-0457
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026