what is the java threat?

If using Safari, go to Safari menu -> Preferences -> Security -> Uncheck Java. Javascript is different from Java and has nothing to do with this security hazard.

This may make some websites inaccessible. Some other browsers offer a website based enabling/disabling of plugins. Mind you, if visiting a site for the first time without knowledge whether or not they take care not to let their site become infiltrated, it is best to leave those plugins disabled. If only all websites used HTML5 it wouldn't be such a big problem. You can always write web masters and ask them to consider HTML5 instead of Java or Flash or Silverlight. Alas some places can't, because they haven't updated beyond Internet Explorer 8/Windows XP, and are stuck using something older, thus leaving the rest of us insecure.

Not anything that will affect your Snow Leopard installation. Details at http://www.kb.cert.org/vuls/id/625617 among other sites.

baltwo wrote:

Not anything that will affect your Snow Leopard installation.

That's not totally clear yet, according to Brian Krebs: http://krebsonsecurity.com/2013/01/what-you-need-to-know-about-the-java-exploit/.

Apple pushed the same blacklist for all plug-in versions less than v1.7.0.19 (which isn't released yet) out to Snow Leopard users, although it's not clear to me that it will work for them.

FWIW, I'm running SL, received the Xprotect update, and still see this:

Just saw that Oracle's released vers 11 which fixes the exploit.

baltwo wrote:

FWIW, I'm running SL, received the Xprotect update, and still see this:

Try this site http://java.com/en/download/testjava.jsp

baltwo wrote:

Just saw that Oracle's released vers 11 which fixes the exploit.

For Java 7. Now let's see what, if anything, Apple does for Java 6.

I am not sure but the Version of Java that is affected is 7 not 6. I could be wrong as I only heard about this half an hour ago.

This ZDNET article mentions only Java 7, http://www.zdnet.com/homeland-security-warns-to-disable-java-amid-zero-day-flaw- 7000009713/

I am on 10.8.2. My Xprotect.plist was updated in Jan 11 2013 as per the location it can be found under, /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources. I am running Java 7 Update 10 as per Java System Preferences.

When I try to install Java 7 Update 11 I get an error.

"Update Error

An error occurred while downloading the update. Please try again later."

All I can do is click Cancel.

I will download the Java 7 Update 11 manually to see what is up. I cannot restart now as a troubelshooting step.

I installed Java 7 Update 11 manually via the link, http://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1880261.h tml

The manual update installed fine and the Java Control Panel reports I am running the recommended verison of Java.

I don't use Java anyway, I use Safari and have it turned off from Safari Preferences but I know some of you out there depend on it like you depend on water.

I have Chrome, Safari and Firefox Beta. I have disabled Java on all 3. I won't enable until I hear that the problem has been resolved. In fact, I may not enable at all since the only problem I've had was trying to order new checkbooks on line from my bank. The site asked for Java plug-in. I took the order form to the bank instead.

LostAccount wrote:

I am not sure but the Version of Java that is affected is 7 not 6. I could be wrong as I only heard about this half an hour ago.

We aren't sure either, but yesterday it was still under discussion according to http://krebsonsecurity.com/2013/01/what-you-need-to-know-about-the-java-exploit/ and Apple seems to have disable Java 6 for Safari according to some who have tested it.

Brian Krebs has posted an update just now which gives a bit more info http://krebsonsecurity.com/2013/01/oracle-ships-critical-security-update-for-jav a/.