Hypothetically, let's presume Java version X (an old version) has a known security vulnerability. If I've been using this version of Java, and say hosting webservers with that version, it's "unsafe". (Right?)
One thing Java allows is updating the JVM, and specifying an older language version, for backwards compatibility. If I update to the latest version of the JVM, and continue to specify version X, does that resolve security concerns?
If so, how does that work. Does that mean that each version of the JVM holds all the old versions (or do they maintain shims to update to the new versions?)
When something is deprecated, does that mean it won't be available in later versions of the JVM, or does it continue to be available and they fix it in later versions of the JVM, or does the security vulnerability exist, and it's the dev/ops teams responsibility to upgrade to the latest Java language version in addition to updating the JVM?
Is my terminology off here? I'm just trying to understand how JVM security models work with backwards compatibility.
Does using the OracleJVM vs OpenJVM change the answer?