JPCERT-AT-2016-0018 JPCERT/CC 2016-04-20 <<< JPCERT/CC Alert 2016-04-20 >>> Critical Patch Update for Oracle Java SE, April 2016 https://www.jpcert.or.jp/english/at/2016/at160018.html I. Overview Java SE JDK and JRE provided by Oracle contain multiple vulnerabilities. A remote attacker may cause Java to crash or execute arbitrary code by leveraging these vulnerabilities. For more information on the vulnerabilities, please refer to the information provided by Oracle: It is recommended to update to the latest version of the software provided by Oracle: Oracle Critical Patch Update Advisory - April 2016 http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html II. Affected Products The following products and versions are affected by these vulnerabilities: - Java SE JDK/JRE 8 Update 77 and earlier * According to Oracle, Java SE JDK / JRE 6 and 7, which are no longer supported, are also affected by these vulnerabilities. * PCs provided by some certain manufacturers may have JRE pre-installed. Please check the PC that you are using for any installed versions of JRE. III. Solution Oracle has released an update. Please update to the latest version of the software. - Java SE JDK/JRE 8 Update 91 * A patch-set update Oracle Java SE 8u92, including all of 8u91 plus additional features is available for developers and users. Please consider updating to 8u92. Java SE Downloads http://www.oracle.com/technetwork/java/javase/downloads/index.html Free Java Download https://java.com/en/download/ Users of 64-bit Windows may have 32-bit and/or 64-bit versions of JDK/JRE installed. Please check the versions installed on your system and apply the appropriate updates. Users can check the version of Java that they are using at the page below. If both 32-bit and 64-bit versions of Java are installed, please check the versions installed, using a 32-bit and 64-bit browser respectively. (In environments where Java is not installed, there may be a request to install Java. If you do not require Java, please do not install.) Verify Java and Find Out-of-Date Versions https://www.java.com/en/download/installed.jsp * Some applications that use Java may not run properly after updating Java to the latest version. Please update to the latest version after considering any possible impacts to applications that you may use. IV. References Oracle Oracle Critical Patch Update Advisory - April 2016 http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html Oracle Release Notes for JDK 8 and JDK 8 Update Releases http://www.oracle.com/technetwork/java/javase/8all-relnotes-2226344.html Oracle April 2016 Critical Patch Update Released https://blogs.oracle.com/security/entry/april_2016_critical_patch_update Oracle Oracle Java SE Support Roadmap http://www.oracle.com/technetwork/jp/java/eol-135779.html US-CERT Oracle Releases Security Bulletin https://www.us-cert.gov/ncas/current-activity/2016/04/19/Oracle-Releases-Security-Bulletin If you have any information regarding this alert, please contact JPCERT/CC. ====================================================================== JPCERT Coordination Center (JPCERT/CC) MAIL: info@jpcert.or.jp TEL: +81-3-3518-4600 FAX: +81-3-3518-4602 https://www.jpcert.or.jp/english/