Out-of-Band Oracle Java Critical Security Update Released

 The advice of the U.S. Department of Homeland Security, US-CERT, security software vendors and others advising that Java be uninstalled appears to have spurred the early release of an out-of-band security update for Java SE.

Ahead of the Critical Patch Update Pre-Release Announcement which had the update scheduled for Tuesday, January 15, 2013, the update for Java version 7 update 11 has been released.

Edit Note:  Additional vulnerabilities have been found in the latest Java update, which did little other than adjust the settings to the Java Control Panel.  See Java, The Never-Ending Saga for additional information on removing or disabling Java.

If you uninstalled Java, consider that you really may not need it on your computer.  On the other hand, if there are programs you use or websites that you visit that require Java, it is strongly advised that the update be applied as soon as possible.  

Java Security Recommendations

1)  In the Java Control Panel, set the security to high.
2)  Keep Java disabled until needed.  Uncheck the box "Enable Java content in the browser" in the Java Control Panel.

(Image via Sophos Naked Security Blog)

3)  If you use Firefox, install NoScript and only allow Java on those sites where it is required.

Instructions on removing older (and less secure) versions of Java can be found at http://java.com/en/download/faq/remove_olderversions.xml

Download Information

Download link:  Java Version 7 Update 11

Verify your version:  http://www.java.com/en/download/testjava.jsp

Note: UNcheck any pre-checked toolbar and/or software options presented with the update. They are not part of the software update and are completely optional.

Critical Patch Updates

For Oracle Java SE Critical Patch Updates, the next scheduled dates are:

• 19 February 2013
• 18 June 2013
• 15 October 2013

References

• Java SE 7 Update Release Notes
• Critical Patch Updates, Security Alerts and Third Party Bulletin 
• Oracle Critical Patch Update Pre-Release Announcement - January 2013
• Oracle Security Alert CVE-2013-0422

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...