Good news!
Oracle decided not to wait another 3 weeks to fix this issue – which is probably a really good move considering it looks like they already knew about it.
Anyway – get over to http://java.com and download the latest JRE (version 7 update 7)
I’ll try to get the old chatroom back up tonight or tomorrow.
FYI – JRE 7 is x64 and will not work with Chrome browser for Mac OS X as it is not x64-bit browser (if that made no sense to you, just move on). If you are a Chrome user on a Mac, you’ll have to use Firefox or Safari for Java based chat.
Oracle has just released Security Alert CVE-2012-4681 to address 3 distinct but related vulnerabilities and one security-in-depth issue affecting Java running in desktop browsers. These vulnerabilities are: CVE-2012-4681, CVE-2012-1682, CVE-2012-3136, and CVE-2012-0547. These vulnerabilities are not applicable to standalone Java desktop applications or Java running on servers, i.e. these vulnerabilities do not affect any Oracle server based software.
Vulnerabilities CVE-2012-4681, CVE-2012-1682, and CVE-2012-3136 have each received a CVSS Base Score of 10.0. This score assumes that the affected users have administrative privileges, as is typical in Windows XP. Vulnerability CVE-20120-0547 has received a CVSS Base Score of 0.0 because this vulnerability is not directly exploitable in typical user deployments, but Oracle has issued a security-in-depth fix for this issue as it can be used in conjunction with other vulnerabilities to significantly increase the overall impact of a successful exploit.
If successfully exploited, these vulnerabilities can provide a malicious attacker the ability to plant discretionary binaries onto the compromised system, e.g. the vulnerabilities can be exploited to install malware, including Trojans, onto the targeted system. Note that this malware may in some instances be detected by current antivirus signatures upon its installation.
Due to the high severity of these vulnerabilities, Oracle recommends that customers apply this Security Alert as soon as possible. Furthermore, note that the technical details of these vulnerabilities are widely available on the Internet and Oracle has received external reports that these vulnerabilities are being actively exploited in the wild.
Developers should download the latest release at http://www.oracle.com/technetwork/java/javase/downloads/index.html
Java users should download the latest release of JRE at http://java.com, and of course
Windows users can take advantage of the Java Automatic Update to get the latest release.
via Security Alert for CVE-2012-4681 Released (The Oracle Software Security Assurance Blog).
