Java Security Update Released

Oracle has just released an update for their Java platform, that bumps the version of the Java Runtime Environment (JRE) and the Java Development Kit (JDK) to 1.6 Update 22.

The Update release notes list the full external version as 1.6.0_22-b04, and the external version as 6u22. It lists a total of 16 different bugs that have been fixed in the update.

• 6897143 – hotspot – garbage_collector – Stress test crashes during HeapInspection using ParallelGC
• 6919638 – hotspot – garbage_collector – CMS: ExplicitGCInvokesConcurrent misinteracts with gc locker
  6837842 hotspot jni JNI_CreateJavaVM crashes under impersonation
• 6948223 – idl – orb – Corba issue, fail to reload object
• 6969236 – java build – Regression: JRE identification fails due to Oracle rebranding in java.exe
• 6893325 – java – classes_awt – JComboBox and dragging to an item outside the bounds of the containing JFrame is not selecting that
• 6974093 – java – classes_lang – Thread.clone should NOT invoke addUnstarted on started threads
• 6959911 – java – classes_security -Update Entrust.net CA (2048) root and add new Entrust Root CA-G2
• 6725789 – java – classes_util_concurrent – ScheduledExecutorService does not work as expected in jdk7/6/5
• 6547241 – java – imageio – JPEGImageReader.readImage crash
• 6557086 – java – imageio – Attempt to dispose jpeg reader form another thread may cause crash
• 6944981 – java_deployment – general – Name field missing in mix code security warning dialog for Java Webstart application
• 6869937 – java_plugin – plugin2 – New Plugin – Vista&XP Focus never returned to browser
• 6846148 – jaxb-xsd – runtime – Namespace gets lost for null scope while using RetQName
• 6946312 – jaxp – sax – XML parser omits characters callback to ContentHandler since 6u18
• 6957378 – jmx – classes – JMX memory leak

Users who have Java installed should download it as soon as possible from the official website. A script on the site will detect the installed Java version, and display a download link if the installed version is not the latest. The release notes are accessible here.

Related Articles:

Author: Martin Brinkmann, Tuesday October 12, 2010 -
Tags:java, java runtime environment, java security, java update, jdk, jre

Responses so far:

1. gummybear says:

   October 13, 2010 at 3:05 pm

   Thanks for the news ,had auto update disabled…now under firefox addons there are 2 java console addons 6.0.21 & 6.0.22.Should i uninstall the old one?I’m not paranoid but can it pose a security risk if still there?

   Reply
   • Martin says:

     October 13, 2010 at 4:27 pm

     Gummybear, good question. Depends on which is used to execute Java code I’d say. You are probably best of uninstalling the old Java version.

     Reply