full-disclosure

Open Source and information security mailing list archives

Date: Sat, 7 Mar 2015 07:47:47 +1000
From: James Hodgkinson <yaleman@...etek.net>
To: fulldisclosure@...lists.org
Subject: Re: [FD] Java 8u40 released: why?

Maybe the major change is that they’re including the Ask toolbar in all releases now, not just the windows one? :)

The unwelcome Ask extension shows up as part of the installer if a Mac user downloads Java 8 Update 40 for the Mac. In my tests on a Mac running that latest release of OS X, the installer added an app to the current browser, Chrome version 41 …
James

On 7 March 2015 at 7:39:32 am, Guy Dawson (g.dawson@...ssflight.com) wrote:

My reading of the first WWW page is that only Java SE 7 u75/76 contains  
security fixes and that there are no security fixes in Java SE 8 u40.  

On 4 March 2015 at 01:23, <paul.szabo@...ney.edu.au> wrote:  

> I notice that Java (JDK, JRE) update 8u40 has been released.  
> Though  
> http://www.oracle.com/technetwork/java/javase/downloads/index.html  
> says "this release includes important security fixes", the release notes  
> http://www.oracle.com/technetwork/java/javase/8u40-relnotes-2389089.html  
> says the "security baseline" is 1.8.0_31 (unchanged).  
> I do not notice any major "useability" issues fixed.  
> So: why this out-of-band release?  
>  
> Thanks, Paul  
>  
> Paul Szabo psz@...hs.usyd.edu.au http://www.maths.usyd.edu.au/u/psz/  
> School of Mathematics and Statistics University of Sydney Australia  
>  
> _______________________________________________  
> Sent through the Full Disclosure mailing list  
> https://nmap.org/mailman/listinfo/fulldisclosure  
> Web Archives & RSS: http://seclists.org/fulldisclosure/  
>  

--  

*Guy Dawson*  
IT Operations Manager  

Crossflight Limited, Calder Way, Colnbrook, SL3 0BQ  
*T* +44 (0) 1753 776104 | *W* crossflight.com  

[Terms and Conditions]  
<http://www.crossflight.co.uk/Crossflight/aboutUs/legal.html>  

--  
All business is conducted according to Crossflight Limited's Standard  
Trading Conditions,  

copies of which are available on request or via our website at  
www.crossflight.com  

_______________________________________________  
Sent through the Full Disclosure mailing list  
https://nmap.org/mailman/listinfo/fulldisclosure  
Web Archives & RSS: http://seclists.org/fulldisclosure/  

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives