Oracle releases patch for Java after U.S. government warning
Oracle said Sunday that it has released a patch for its Java software after a bug in the program opened users to malicious hacking.
Security researchers first drew attention to the vulnerability last week, and the U.S. Department of Homeland Security told its employees to disable the software temporarily in Web browsers.
Cybersecurity experts encouraged consumers to download the patch immediately, but some also continued to raise questions about Java’s security since the program has had numerous problems in recent months. And the fixes Oracle released, experts said, may not go deep enough.
“Note that the vulnerabilities Oracle just patched don’t apply to standalone Java applications or server-side Java installs. They apply only to applets, which run inside your browser,” wrote Sophos security researcher Paul Ducklin in a blog post Sunday.
Ideally, he said, users should disable Java altogether if they don’t need it. He also suggested that users could run one browser with Java enabled and one without.
In Safari, Chrome, Firefox and Opera, users can head to their list of plug-ins and uncheck the mark next to Java to disable the program for as long as they want. In Safari, the option is in a users’ “Security” menu. In Firefox, it’s in the “Tools” menu; Chrome users should type “chrome://plugins” into their menu bar to get to the menu.
When it comes to Internet Explorer, users’ easiest option is to head to the Java Control Panel, which you can launch from the Java applet in the Control Panel. Once there, you can disable the program by unchecking a box in the security tab that says “Enable Java content in browser.”
To take the most drastic measures and remove the program altogether on a PC, users can head to the “Add/Remove” programs list menu in the control panels of Windows computers and delete Java from the Program list.