Java Update Plugs 42 Security Holes
Summary: Oracle released Java 7 Update 21, fixing 42 security flaws in Java SE and its browser plugin, with 39 of those vulnerabilities remotely exploitable without authentication. The update also adds risk-based warning prompts for users running Java in a browser, though Ars Technica notes Java still does not check certificate revocation lists, a gap that let a malicious app signed with a revoked certificate through last month.
Bottom line: Thirty-nine flaws that an attacker can reach over a network without a username or password is the exposure profile of a browser plugin sitting on nearly every desktop - and the new yellow-triangle warnings do not validate certificates, so a stolen or revoked certificate still gets the green light.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026