1

We know that Oracle publishes Java updates due to vulnerabilities / security issues and therefore we should make sure that we have installed the latest version of Java.

Now there exist programs like ExcelsiorJet which compile Java applications to native code. I am using such an application and I can see it uses Java 7 Update 75:

0:000> lm vm java
start    end        module name
716b0000 716d0000   java       (export symbols)       C:\Program Files (x86)\...\bin\java.dll
    Loaded symbol image file: C:\Program Files (x86)\...\bin\java.dll
    ...
    File version:     7.0.750.13
    Product version:  7.0.750.13
    ...
    CompanyName:      Oracle Corporation
    ProductName:      Java(TM) Platform SE 7 U75

Since the current version is Java 7 Update 80, we can assume that this version has some security issues.

However, since this application will only run its own code and not arbitrary code like a browser plugin does, can I safely assume that this application does not open a security hole on my PC?

Improve this question
2
  • Welcome. Have you compiled the code yourself using ExcelsiorJet or the code is not yours and all what you know is that the .class files you got were pre-compiled by someone else?
    – user45139
    Aug 28, 2015 at 8:03
  • @begueradj: It's a 3rd party application. I just install it and use it. I don't have source code. Of course I can only assume it will not execute arbitrary code and not download something from the Internet. However, from what the application does, that case is unlikely and I basically trust the vendor.
    – Thomas Weller
    Aug 28, 2015 at 8:07

1 Answer 1

Reset to default
3

It depends if these are security issues of the JVM or the Java libraries. Since the JVM is not used these problems don't affect compiled applications. But issues in the library might affect your application. If these issues are relevant for your program depends on the kind of issues and what your program does. For example problems affecting the validation of TLS certificates will probably affect your program if it does https connections, even if it does not execute external code like a browser plugin does.

In effect you need to find out what kind of issues are fixed in the updates, which component they affect and if this component is used by your application. Then you know if the application is affected or not.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .