Apple Releases Fix for Critical Java Flaw
Summary: Apple released Java for OS X 2012-005 and Java for Mac OS X 10.6 Update 10 for OS X 10.6, Lion and Mountain Lion, addressing CVE-2012-0547, which Oracle described as a defense-in-depth improvement rather than a vulnerability. The update also configures the Java browser plugin and Java Web Start to deactivate after extended periods of disuse, and Krebs corrected his initial reading that the patch covered CVE-2012-4681, the flaw behind attacks on Java 7 on Windows.
Why it matters: In April, the Flashback Trojan infected more than 650,000 Mac systems through an exploit for a critical Java flaw, and Apple stopped bundling Java by default only with OS X 10.7 - so the population of Macs still carrying a browser plugin they never chose is the one this patch has to reach.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2012-0547CVE-2012-4681
- Related
- CVE-2012-4681: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022Researchers: Java Zero-Day Leveraged Two Flaws Cyber Risks ·CVE-2012-4681: bypassing built-in java security Cyber Risks ·