Oracle Updates Java 7 to Address Security Vulnerability

[AdeFowler]

Originally Posted by clukas

could someone please clarify this for me.

I dont have java in system preferences. I know I am running java as I am using Adobe CS6. I have disabled java in safari.

Am I still at risk, how should I update?

This sums up my situation exactly. I don't have Java in system preferences and there is nothing in the utilities folder. I'm running CS6 without a problem

[BarryDuffman]

Originally Posted by canyelles

I'm confused

I have done the update and Java in System Preferences tells me I am using the latest version 7.

However when I type 'java -version' in terminal I get

java version "1.6.0_37"
Java(TM) SE Runtime Environment (build 1.6.0_37-b06-434-11M3909)
Java HotSpot(TM) 64-Bit Server VM (build 20.12-b01-434, mixed mode)

Can anyone explain?

Thanks

Same here. Strange.

[codefuns]

I installed java 1.6 from apple's website, is this version affected? if yes, who is responsible for its update? apple or oracle?

[AnonMac50]

Is it just me or does this not work on Snow Leopard?

[mdmacfan]

Originally Posted by BarryDuffman

But I found that for some reason suddenly Java required the use of the discrete graphics on my MBP.

I have to wait until I'm home to double check (maybe somebody else knows for certain), but as I recall, Oracle started bundling "Java FX" into their Java installation package. Java FX is a graphical component... perhaps that is why your discrete graphics are kicking in - this component was leftover after your uninstall, something along those lines.

[rmwebs]

Originally Posted by codefuns

I installed java 1.6 from apple's website, is this version affected? if yes, who is responsible for its update? apple or oracle?

Apple dont maintain Java anymore - you're better off getting 1.7 from Oracle as it'll be updated - 1.6 wont be.

[HiRez]

When are they just going to kill this pig once and for all? Java on personal or mobile computers is simply not needed today, there are better alternatives. If they want to keep it running for enterprise, fine, but stop subjecting us to this bloated, archaic, insecure monstrosity.

[Thunderhawks]

Originally Posted by AdeFowler

This sums up my situation exactly. I don't have Java in system preferences and there is nothing in the utilities folder. I'm running CS6 without a problem

No Java in Mountain Lion and everything works.

Plug=in for Safari disabled after the first few alerts.

A few messages depending on websites "not reachable MySQL addresses"

[SLFGNR8]

Why am I experiencing the below:

1. I have Mountain Lion 10.8.2.
2. There is no Java in my System Preferences.
3. There is no Java app in my Utilities.
4. Only references to Java I can find are in my CS6 Suite app folders, allowing custom javascripts.
5. Yet when I uncheck "enable java" and "enable java-script" in Safari, there are some websites, like cloud based email services that won't work until I turn them on. When java is enabled via the browsers those sites work fine.
6. Even when enabled the http://javatester.org/version.html website says I have a missing plug-in when checking via Safari or with Firefox.
7. My Terminal says: java version "1.6.0_37" Java(TM) SE Runtime Environment (build 1.6.0_37-b06-434-11M3909) Java HotSpot(TM) 64-Bit Server VM (build 20.12-b01-434, mixed mode)

It appears that the Oracle "fix" installs the full version of Java, which I currently don't have or need.

WHAT SHOULD MY COURSE OF ACTION BE?

[Nermal]

Originally Posted by SLFGNR8

1. Only references to Java I can find are in my CS6 Suite app folders, allowing custom javascripts.
2. Yet when I uncheck "enable java" and "enable java-script" in Safari, there are some websites, like cloud based email services that won't work until I turn them on. When java is enabled via the browsers those sites work fine.

I'm not familiar with CS6 but I can tell you that JavaScript has nothing to do with Java. Your email will probably work with Java disabled and JavaScript enabled.

[Rodimus Prime]

Originally Posted by Shrink

Sorry for the dumb question...I have "Enable Java" UNCHECKED in Safari Preferences, and intend to leave it that way.

Should I download the Java Update anyway?

Thanks...

Yes not updating is stupid and is how worms tend to live for a long time. MSBlaster back in the day was patch months before hand. The export relayed on the fact that people did not update.

Originally Posted by Lone Deranger

Why is it so often Java that appears to get caught out in these security vulnerabilities?

A lot of users are on it. It makes for easy targets. Apple has plenty of holes in their stuff that go unpatch for months and years and they only patch it after it makes the news.

Originally Posted by HiRez

When are they just going to kill this pig once and for all? Java on personal or mobile computers is simply not needed today, there are better alternatives. If they want to keep it running for enterprise, fine, but stop subjecting us to this bloated, archaic, insecure monstrosity.

Ah the joys of someone who does not know what they are talking about and just repeating FUD. You really do not understand Java when you start ranting like that.

[SLFGNR8]

Originally Posted by Nermal

I'm not familiar with CS6 but I can tell you that JavaScript has nothing to do with Java. Your email will probably work with Java disabled and JavaScript enabled.

Thank you so much for this distinction between Java and Javascript. The CS6 references are actually to Javascript, not Java.

Yes you are correct the cloud email does only require javascript, which I didn't realize either.

[Stella]

Originally Posted by HiRez

When are they just going to kill this pig once and for all? Java on personal or mobile computers is simply not needed today, there are better alternatives. If they want to keep it running for enterprise, fine, but stop subjecting us to this bloated, archaic, insecure monstrosity.

No one is forcing you to use Java, just simply uninstall it and you'll not miss it.

In the mean time, I and others will quite happily using Java for desktop applications.

Please inform us of these 'better' alternatives for multiple O/S development, for desktop applications?

BTW - Java is the most used language for mobile development...

[Idefix]

I got a real kick out of running the installer: Here's what it says in the splash screen...

"Java provides safe and secure access to the world of amazing Java content. From business solutions to helpful utilities and entertainment, Java makes your internet experience come to life."

Just love the "safe and secure" quote!

[tywebb13]

Originally Posted by AnonMac50

Is it just me or does this not work on Snow Leopard?

As I said in the other thread at http://forums.macrumors.com/showpost...&postcount=227 the minimum system requirement on a mac is Mac OS X Lion 10.7.3

So no. It won't work in Snow Leopard.

[iapplelove]

When i try to run java preferences it says I need a java se 6 runtime?

[benthewraith]

Originally Posted by Philscbx

I have the same set up - apparently there are some of us on 10.6.8 where JAVA is not shown in System Pref -
so the answers are going to be vague where it is.

A quick scan found mine in Utilities - It is titled Java Preferences.

The version on file shown is Java SE6 -ver 13.8.5. / and was last opened Oct 21,12.
The system must have messed with it - because I never do.

I scanned the 4 tabs - there is no specific labeled 'update tab' -
so I don't know where some are seeing this for fact.

We'll leave it at that.

You're still using Java SE6. Apple stopped distributing Java updates because they always lagged and security vulnerabilities were never patched as quickly. You can get the new Java here.

[jstnlzr]

Java FTW! But seriously, you have vulernabilities with about eveything is a bug can find a backdoor...no biggie

[Philscbx]

Java 6 was pre-installed on Snow Leopard. Java 7 is not available.

http://javatester.org/version.html

[munkery]

Originally Posted by Rodimus Prime

Apple has plenty of holes in their stuff that go unpatch for months and years and they only patch it after it makes the news.

Windows has far more public and/or unpatched vulnerabilities than OS X.

http://m.prnewswire.com/news-release...110606584.html -> article about 18 year old UAC bypass vulnerability.

[Solomani]

Originally Posted by Shrink

Should I download the Java Update anyway?

Can we expect Apple to automatically provide the Updated Java to us via the Software Update control panel (sometime soon)? Or do ALL Mac users have to download it manually?

I'm a bit confused on Apple's Modus Operandi when it comes to Java now. As I understand it, they leave the updating/fixing to Oracle. So does that mean Apple is no longer allowed to distribute the updates themselves? And where do we go to Update, on Apple servers or at Oracle download servers?

[AlabamaSlammer]

Any advice on what i need to do?

[munkery]

Originally Posted by Solomani

Can we expect Apple to automatically provide the Updated Java to us via the Software Update control panel (sometime soon)? Or do ALL Mac users have to download it manually?

I'm a bit confused on Apple's Modus Operandi when it comes to Java now. As I understand it, they leave the updating/fixing to Oracle. So does that mean Apple is no longer allowed to distribute the updates themselves? And where do we go to Update, on Apple servers or at Oracle download servers?

Java is no longer provided by Apple. Download Java 7 from Oracle.

In the Java preferences that are located in System preferences, go to the "Update" pane and select "Automatically check for updates".

Then select "Automatically download and install updates" in the update window while updating Java for the fist time after the initial installation.

[StudioGuy]

I agree this update correctly updates the Internet Plugin, used in Safari, for example, when you load a page with a java applet.

UPDATED:

I think I see that the VM is actually inside the Contents folder of the Plugin.

So, my question is how to make the desktop applications aware of this, so that they launch in the java 7 VM, and not the old java 6 VM.

Seems like there is an environment variable, framework, or something that needs to be updated.
And, for sure, /user/libexec/java_home still points to the java 6 jdk.

But, still the /System/Library/Frameworks/JavaVM.framework/Versions directory still only has up to java 6. No install there of java 7, as I would have expected.

OK, that's about the extent of my java knowledge - if even this much has been accurate! Hope a java geek can help...

[Solomani]

Originally Posted by munkery

Java is no longer provided by Apple. Download Java 7 from Oracle.

In the Java preferences that are located in System preferences, go to the "Update" pane and select "Automatically check for updates".

Then select "Automatically download and install updates" in the update window while updating Java for the fist time after the initial installation.

Ahh... I do not see any Java icon/panel in System Preferences. Stock OSX Mountain Lion 10.8.2 pre-installed in my iMac December 2012. I suppose this means I do not see the Java control panel because I never manually installed a full version from Oracle to begin with?


P.S. -- and I'm sure that as far as the Safari Java plug-in, Apple will likely just update that in the next incremental OSX Update (Mountain Lion 10.8.3?)