Skip to content

March 9, 2011

Java Security Updates for Leopard and Snow Leopard

Java LogoApple has released Java for Mac OS X 10.6 Update 4 and Java for Mac OS X 10.5 Update 9, patching a number of vulnerabilities in the Java virtual machine. The most serious of these may allow an untrusted Java applet to execute arbitrary code outside of the Java sandbox. Users with Java installed should update soon. Those of you who don’t have Java don’t need to worry. If you’re unsure, just check Software Update.

Apple recently announced that the version of Java ported by Apple for Mac OS X has been deprecated. Starting in Mac OS X 10.7 “Lion”, the Java runtime will no longer be installed by default, instead requiring users to install Oracle’s Java runtime should they require Java support. Apple also recently stopped bundling Flash with Mac OS X by default, with new MacBook Air and MacBook Pros shipping without Flash. The divesting of these two products will not only eliminate Java and Flash vulnerabilities on default installs of Mac OS X, it will allow users who install these apps to get updates quicker directly from Oracle and Adobe, instead of having to wait for Apple to release software updates.

Hit the jump for details of the Java update for 10.6.

Java for Mac OS X 10.6 Update 4

    • Java

Available for: Mac OS X v10.6.6, Mac OS X Server v10.6.6Impact: Multiple vulnerabilities in Java 1.6.0_22

Description: Multiple vulnerabilities exist in Java 1.6.0_22, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues are addressed by updating to Java version 1.6.0_24. Further information is available via the Java website at http://www.oracle.com/technetwork/java/javase/releasenotes-136954.html

CVE-ID

CVE-2010-4422

CVE-2010-4447

CVE-2010-4448

CVE-2010-4450

CVE-2010-4454

CVE-2010-4462

CVE-2010-4463

CVE-2010-4465

CVE-2010-4467

CVE-2010-4468

CVE-2010-4469

CVE-2010-4470

CVE-2010-4471

CVE-2010-4472

CVE-2010-4473

CVE-2010-4476

Share your thoughts, post a comment.

(required)
(required)

Note: HTML is allowed. Your email address will never be published.

Subscribe to comments

css.php