Oracle issues 21 critical Java patches

Oracle has issued 21 critical security fixes for its widely used Java SE and Java for Business.

The patches, which may take some enterprise operations time to apply, fixed serious Java security flaws for Windows, Solaris and Linux operating systems.

"Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible," the company warned.

The majority of the flaws pertained to the Java Runtime Environment and could be exploited over a network without authentication.

Eight of the vulnerabilities were given a 10 base score under the Common Vulnerability Scoring System, according to Oracle.

"Out of these 21 vulnerabilities, 13 affect Java client deployments. Twelve of these 13 vulnerabilities can be exploited through untrusted Java web  start applications and untrusted Java applets, which run in the Java sandbox with limited privileges. One of these 13 vulnerabilities can be exploited by running a standalone application," Oracle security blogger Eric Maurice said.

Two workarounds Oracle proposed were restricting network protocols that could be used in an attack, and restricting unprivileged access for attacks that require privileges.

But Oracle warned customers to test the workarounds first since both risked breaking an application's functionality.