Java update 7u11 has made some news lately for a couple reasons. Firstly, it was an out-of-band patch to resolve vulnerabilities being exploited in the wild. Then it came back up because it is now being found that the patch is incomplete. News I'm reading now seems to indicate one or more of a few things are happening.
- A vulnerability that was supposed to be patched in 7u11 was not really fixed at all.
- New vulnerabilities have been found in 7u11.
- It is not clear whether these are new to 7u11, or pre-existing vulnerabilities newly discovered.
- Though there was some mitigating effort put into 7u11, new exploit methods (possibly coupled with new vulnerabilities) are allowing the vulnerability that was supposedly patched to be compromised.
The release notes for Java 7u11 point to only one vulnerability, CVE-2013-0422. This vulnerability appears to be exclusive to Java 7. Java 6 is still receiving updates until February 2013, though.
If removing Java entirely is not an option, would switching to the latest version of Java 6 be safer for now? Or, are there enough vulnerabilities left un-patched in Java 6 that are resolved in 7 such that the newer version is still the lesser of the two evils?