Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

according to Oracle, "All these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. " Does this include our Java App that runs with Tomcat that is in production right now and visible to the internet ? (80 and 443). Do I have to update Java JRE on all those server?

Or is this strictly an end-user update?

http://www.oracle.com/technetwork/topics/security/javacpujune2011-313339.html this is the link to the advisory.

share|improve this question
    
oracle.com/technetwork/topics/security/… here is the advisory –  John Ingles Jun 3 '11 at 17:36
add comment

1 Answer

No, it also includes server side fixes, according to the Oracle Technote it says:

This Critical Patch Update contains 17 new security fixes for Oracle Java SE - 5 apply to client and server deployments of Java SE, 11 apply to client deployments of Java SE only, and 1 applies to server deployments of Java SE only

The one that applies to servers only is in NIO (Networking), and the other 5 are in Java 2D and Java Sound Components.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.