On 8/31/2012 11:02 AM, Tony Anecito wrote:
Hi All,
I looked at the release notes and there was nearly nothing there. So
justification to update was impossible. Oracle needs to realize that releases
with just one security and one time clock change makes it impossible to explain
to anyone why we need to update an Enterprise.
To me, a rapidly-spreading exploit that affects all major operating
systems (both linux and windows) and browsers is a good-enough reason.
Just my inital reaction. Used to be you got actual release notes when Sun owned
Java.
Regards,
-Tony
--- On Fri, 8/31/12, Konstantin Kolinko<knst.koli...@gmail.com> wrote:
From: Konstantin Kolinko<knst.koli...@gmail.com>
Subject: Java 6u35, 7u07 are available
To: "Tomcat Users List"<users@tomcat.apache.org>
Date: Friday, August 31, 2012, 8:54 AM
Hi!
Just noting that Java 6u35, 7u07 were released by Oracle a day ago
http://www.oracle.com/technetwork/java/javase/downloads/
Those contain security fixes for issues exploitable when running Java
from within a web browser. (Those running it on server or standalone
are said to be unaffected).
http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
BTW, some media wrote that CVE-2012-4681 affects only Java 7, but not Java 6.
Oracle page, linked above, says the update includes fixes for two
other vulnerabilities and affects both Java 6 and Java 7.
Best regards,
Konstantin Kolinko
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
