Oracle java zero-day attack

[Denko]

There has been much 'noise' about Oracle java zero-day attack lately.

Since Mint uses opensource java & icedtea instead - should I be concerned at all?

[xenopeek]

That attacks are on Oracle Java, so you wouldn't be immediately at risk with OpenJDK and IcedTea that you are using. However, Java being Java, probably any implementation has security issues. I'd recommend you disable or remove IcedTea from your web browser (Firefox > Tools > Add-ons > Plugins). Don't run Java in your browser, or if you do use an extension like NoScript so only websites that you have allowed will be able to use Java.

To remove IcedTea from your browser, open a terminal and run the following command to completely remove IcedTea:

Code: Select all

sudo apt-get --purge autoremove icedtea-*

[altair4]

I haven't found a definitive answer to this question since there seems to be so many related questions.

** Does openjdk / icedtea have the same vulnerability?
** Is it specific to only Java7 or is Java6 also affected?

I do not have the answer but if you go to the following site it will check what version Oracle ( and presumably any evil-doer ) thinks you are running:
http://www.java.com/en/download/testjava.jsp

On Mint14 it will come back with:

Java SE 7 Update 09

On Mint13 it will come back with:

Java SE 6 Update 24

You can always disable the plugin in Firefox: Tools > Addons > Plugins > IcedTea > Disable. You can go back to the link above and retest it to see if it gives you a "This Plugin is Disabled" error.

[Denko]

Thank you.
Unfortunately in Denmark we are all forced to use java, since we otherwise could not use on-line banking or log on to government sites.
I do use NoScript though, so I should be OK.