New answers tagged


Annoying isn't it? Yes, for safety's sake, with Java you need to assume that a vulnerability not only affects the stated version, but all earlier versions. Oracle used to determine all affected versions, but I think they stopped that practice about the time Java 8 was introduced. It's a lot of work to determine all affected versions so I can understand ...


In the quote you added: Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Added emphasis is mine. You can be pretty safe in assuming that previous updates in there are affected by the ...


I don't know the answer, but my guess is that they've updated the driver in the code that they ship with their products, but not in the downloads. If you have Oracle support I suggest you contact them about getting an up-to-date driver.


It's not clear what the actual vulnerability is in this file, but in general, vulnerable files represent a threat even if the binary (Java) to run it is not installed because the binary might be installed in the future, or a malicious user with access to the system could install it in order to leverage the vulnerability in the file. The likelihood of ...

Top 50 recent answers are included