Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

according to Oracle, "All these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. " Does this include our Java App that runs with Tomcat that is in production right now and visible to the internet ? (80 and 443). Do I have to update Java JRE on all those server?

Or is this strictly an end-user update? this is the link to the advisory.

share|improve this question… here is the advisory – John Ingles Jun 3 '11 at 17:36

No, it also includes server side fixes, according to the Oracle Technote it says:

This Critical Patch Update contains 17 new security fixes for Oracle Java SE - 5 apply to client and server deployments of Java SE, 11 apply to client deployments of Java SE only, and 1 applies to server deployments of Java SE only

The one that applies to servers only is in NIO (Networking), and the other 5 are in Java 2D and Java Sound Components.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.