News Vulnerability & Threats
2 More Java Zero-Day Vulnerabilities Emerge
While Oracle investigates reports that two bugs in Java 7 could allow attackers to remotely bypass the sandbox and compromise a system, security experts reiterate: If you don't need Java, turn it off
Cue yet another Java security warning: A security researcher said he's spotted two new zero-day vulnerabilities in Java 7.
More Security Insights
- Accelerating Economic Growth and Vitality through Smarter Public Safety Management
- Digital Transformation: Creating new business models where digital meets physical
- Get Actionable Insight with Security Intelligence for Mainframe Environments
- Technical Debt: Asset or Liability
"We had yet another look into Oracle's Java SE 7 software that was released by the company on Feb. 19, 2013," said veteran Java bug hunter Adam Gowdiak, CEO and founder of Poland-based Security Explorations, in an email to the Bugtraq mailing list. "We have discovered two new security issues (numbered 54 and 55), which when combined together can be successfully used to gain a complete Java security sandbox bypass in the environment of Java SE 7 Update 15."
In other words, the most recently released version of Java has flaws that could be remotely exploited by attackers to bypass the built-in sandbox and compromise not only the Java software, but the system on which it's running.
Read the full article here.
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.