Java update plugs 27 critical security holes

Oracle has shipped a Critical Patch Update for Java SE and Java for Business to fix 27 security flaws that could expose users to malicious hacker attacks.

The update, available for Windows, Solaris and Linux, addresses issues that could be remotely exploitable without authentication.

"Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible," the company said in an advisory.

Affected products include:

• Java SE: JDK and JRE 6 Update 18 and earlier for Windows, Solaris, and Linux;  JDK 5.0 Update 23 and earlier for Solaris; and SDK 1.4.2_25 and earlier for Solaris
• Java for Business:JDK and JRE 6 Update 18 and earlier for Windows, Solaris and Linux, JDK and JRE 5.0 Update 23 and earlier for Windows, Solaris and Linux; and SDK and JRE 1.4.2_25 and earlier for Windows, Solaris and Linux

Vulnerabilities in Java also affect Apple's Mac OS X but Apple's patches are usually delayed for a very long time.