Suppose I need to convince someone to upgrade to the latest SDK version of Java? I have heard there are many security vulnerabilities with old versions of java but can't find anything that concretely convinces me that this is the case? What are some hard consequences or security exploits that exist for old versions of java?

  • Do you mean the latest within a supported major version? Or to the latest major version? Commented Jan 28, 2015 at 9:49
  • Most of the security holes apply only if the java browser plugin is enabled, since it allows an untrusted applet to execute arbitrary code. Commented Jan 28, 2015 at 9:50
  • 2
    Related question and answer
    – RoraΖ
    Commented Jan 28, 2015 at 12:34

1 Answer 1


There are a number of them, including those that allow arbitrary code execution.

From Qualys, on January 20 (last week as of this writing):

Java: 19 vulnerabilities addressed in Java 8 and Java 7, 13 are remotely exploitable with highest score CVSS 10. This should be high on your list for your patching efforts, at least on the desktop where most of the vulnerabilities are aimed at. Only four vulnerabilities also apply to servers.

CVSS 10 means:

they can be used to take control over the targeted machine, working remotely through a network and without requiring credentials

Precisely how these recently-patched vulnerabilities can be exploited, and their official names, isn't mentioned - assuming they have official names, as Qualys suggest they may include 0-day exploits. Oracle isn't giving many specifics.

Another, older vulnerability from 2013 also allows arbitrary code execution, via an Applet:


So, the big risk is complete control of the target machine.
For end users, arbitrary code execution on their machine may result from loading a malicious Applet.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .