Let me answer your concerns point-wise assuming the Server you have is Internet-facing.
- Running outdated JRE version is not recommended as many of the vulnerabilities can be remotely exploited both on client and server deployment and are having lower access complexity. Refer to Critical Patch Update listings for Oct'15 here http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA
2)You should patch them all you can keeping the constraints which you have in mind. While I recommend you start working on porting of your application in meanwhile to higher versions. The defenses at Network Perimeter like Firewall, IPS and WAF appliances can deter most of the risk till you are in process to port.
3)No, that responsibility lies with Oracle and they do release patches time to time. However many commercial Load-Balancers come with security component built-in to some extent. You can also think of Hardening your Tomcat if not already done. My point is fixing security holes at source is better than at next level.
2)You should patch all you can, keeping the constraints you mentioned above in mind. While I recommend you start working on porting of your application in meanwhile to higher versions. The defenses at Network Perimeter like Firewall, IPS and WAF appliances can deter most of the risk till you are in process to port.
3)No, that responsibility lies with Oracle and they do release patches time to time. However many commercial Load-Balancers come with security component built-in to some extent. You can also think of Hardening your Tomcat if not already done. My point is fixing security holes at source is better than at next level.