Java 6 update 14 released
Last Updated: 2009-06-11 08:25:06 UTC
by Swa Frantzen (Version: 2)
Sun has updated Java to 6u14. Details can be found here:
Do note that while the list of bugs fixes is impressive, they also state: "This feature release does not contain any new fixes for security vulnerabilities to its previous release".
Many thanks to Roseman for providing the link to the details.
Jerry sent in the observation that there are is despite there being no security bug fixes, interesting security news in the release notes:
Blocklist Jar Feature
Support for blocklisting signed jar files has been added to 6u14. A blocklist is a list of signed jars that contain serious security vulnerabilities that can be exploited by untrusted applets or applications. A system-wide blocklist will be distributed with each JRE release. Java Plugin and Web Start will consult this blocklist and refuse to load any class or resource contained in a jar file that's on the blocklist. By default, blocklist checking is enabled. The deployment.security.blocklist.check deployment configuration property can be used to toggle this behavior.
The blocklist entries are the union of the blocklist files pointed to by the deployment.system.security.blocklist and deployment.user.security.blocklist properties. By default, deployment.system.security.blocklist points to the blocklist file in the jre/lib/security directory, and deployment.user.security.blocklist points to a blocklist file that contains additional entries added by a user.
Swa Frantzen -- Section 66