# MA-350.062013: MyCERT Alert - Oracle Java SE Critical Patch Update Advisory - June 2013

**Date:** 20 Jun 2013  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-350.062013  
**Advisory ID:** MA-350.062013

---

**1.0 Introduction**
A Critical Patch Update is a collection of patches for multiple security vulnerabilities. Multiple critical vulnerabilities have been identified in Oracle Java SE and a collection of patches has been released this month to address these issues.
**2.0 Impact**
This Critical Patch Update contains 40 new security fixes for Oracle Java SE products. 37 of these vulnerabilities are remotely exploitable without authentication. 34 of the fixes brought with this Critical Patch Update address vulnerabilities that only affect client deployments. 4 of the vulnerabilities fixed in this Critical Patch Update can affect client and server deployments. One of the vulnerabilities fixed in this Critical patch Update affects the Java installer and can only be exploited locally.
Due to possible successful attacks, Administrators are strongly recommended to apply the new security fixes as soon as possible because it includes fixes for a number of severe vulnerabilities.
**3.0 Affected Products**
- JDK and JRE 7 Update 21 and earlier
- JDK and JRE 6 Update 45 and earlier
- JDK and JRE 5.0 Update 45 and earlier
- JavaFX 2.2.21 and earlier
**4.0 Workaround**
Due to the criticality of applying the new security fixes, Administrators are advised to apply the fixes as soon as possible to correct the problems. However, until the fixes are applied, Administrators may consider the below workarounds to reduce possible successful attacks:
- Restrict network protocols required by an attack
- For attacks that require certain previleges or access to certain packages, remove the privileges or the ability to access the packages from unprivileged users
The above workarounds may break application functionality, so Administrators are strongly recommended to test changes on non-production systems first.
Please take note that the above workarounds are only temporary solution measures. Security fixes must be applied to correct the underlying problem permanently.
**5.0 Recommendation**
Oracle has released a security update for these issues. Users are highly encouraged to download the most recent release to address these vulnerabilities. Update can be obtained from:
- Oracle Java SE Critical Patch Update June 2013 [My Oracle Support Note 1560542.1.](https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=1560542.1)
- Developers can download the latest release from [http://www.oracle.com](http://www.oracle.com/technetwork/java/javase/downloads/index.html).
- Users running Java SE with a browser can download the latest release from <http://java.com>. Users on the Windows and Mac OS X platforms can also use [automatic updates](http://www.java.com/en/download/help/java_update.xml) to get the latest release.
- The latest JavaFX release is included with the latest update of JDK and JRE 7.
Generally, MyCERT advises the users of this product to be updated with the latest security announcements by the vendor. MyCERT can be reached through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#e2819b808790dbdbdba2819b80879091878197908b969bcc8f9b) or [[email protected]](/cdn-cgi/l/email-protection#620f1b01071016220f1b010710164c0d10054c0f1b)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: <https://www.mycert.org.my>
**5.0 References**
- [http://www.oracle.com/technetwork/topics/security/](http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html)
- [http://www.us-cert.gov/ncas/current-activity/2013/06/18/](http://www.us-cert.gov/ncas/current-activity/2013/06/18/Oracle-Java-SE-Critical-Patch-Update-Announcement-June-2013)
- <https://blogs.oracle.com/security/entry/june_2013_critical_patch_update>