Updates for Adobe's Shockwave, Sun's Java

Sun Microsystems has issued an update to its Java software that fixes at least one security vulnerability. Separately, Adobe is pushing out a patch to plug four security holes in its Shockwave Player.

The Sun patch brings Java 6 to version 17. If you're not sure whether you have Java or what version you may be running, visit this page and click the "Do I have Java?" link. If you don't have Java, you probably don't need it. If you do have it, make sure you've got this latest version. To update from within Java, open the Windows control panel, click the Java icon, then at the tab marked Update hit the Update Now button (in Windows 7, to get to Java click start, type "Java" in the search box and pick the first result).

To see whether your system has Adobe's Shockwave Player, follow this link: If you see an empty box at the top that says "Click here to download plugin," then you do not have Shockwave installed. For those folks who don't already have it, I say don't download it. If you don't need it, why bother with another program that requires constant updating? Readers who do have Shockwave should update to the latest version, which is 11.5.2.602, and available here. Updates are available for Windows and Mac versions of Shockwave.

In other patch news, Microsoft today said it plans next Tuesday to issue six patches to address at least 15 security vulnerabilities in its different Windows versions and Office software (Windows 7 was noticeably absent from the list of operating systems that will get patches this month).

Have a question about these patches or anything else security- or tech-related? Join me at 11 a.m. Friday for another Security Fix Live online chat. Never joined me for one before, or don't know what to expect? Check out our Security Fix Live archived transcripts.

Comments

The link to the "Security Fix Live online chat" is not working at this moment.

Posted by: Bitter_Bill | November 6, 2009 2:07 AM | Report abuse

@Bitter_Bill

Thanks for the heads-up.

I just did the Ubuntu upgrade to 9.10 and was 0/2 on the Java and Shock. I didn't upgrade the Java, and won't until I give some apps a shakedown cruise. I knew I wouldn't get Shockwave (only for Win & Mac), however Firefox 3.5.4 (from Canonical) did keep asking me to install the new plugin - and then failed to find it, then asked to install it (repeat) ...

By the time I saw the Outlook Express Login Screen I figured I'd finally arrived at the Gates of Hell (no relation to Bill) where Ubuntu users belong. If Ubuntu expects me to cure cancer and end world hunger by Thanksgiving, they better be hoping I get this ap-cray fix by the end of next week.

Posted by: gannon_dick | November 6, 2009 4:20 AM | Report abuse

Thanks for the info.

Posted by: byron11 | November 6, 2009 7:10 AM | Report abuse

@bitter_bill -- Security Fix Live link should be working now. Thanks for your patience.

Posted by: Brian Krebs | November 6, 2009 8:19 AM | Report abuse

My Ubuntu 9.10 experience seems to be going pretty smoothly by comparison. I had a few quirks getting it up and running on the netbook (Wifi in particular), but it is now at a point where I just use it and I am no longer trying to get things configured..

Posted by: jackrussell252521 | November 6, 2009 12:13 PM | Report abuse

10am PST, On WinXP, updating through the Windows control panel to Java Control Panel reports that no updates are available, and it gives the current version as 6-16, not 17. I've seen this happen other times too, where I had to manually go get the update. Does the Control Panel "update now" actually work for anybody?

Posted by: axialinfo | November 6, 2009 12:56 PM | Report abuse

@axialinfo:
The Control Panel update you describe is what happened on one of my machines (XP Pro), and I too have had the same experience with previous updates (like 6.0.16). On the other one (XP Home), I got an auto-update notify popup in the Systray that said the 6.0.17 update was available. Which is how I found out about it even before I read Brian's post.

At work, Control Panel is so locked down by the Borg Collective that the Java icon is not available, so I have to download it manually anyway.

BTW, Brian, what is the difference between the "slim" and the "full" installer for Shockwave? Your link points to the "slim" download.

Posted by: 54Stratocaster | November 6, 2009 4:16 PM | Report abuse

@54: i believe the slim version only installs for that version of the browser. the full will hit all installed browsers (ff/ie/opera, etc) in one go.

Posted by: BTKrebs | November 6, 2009 4:55 PM | Report abuse

Like the others, my Control Panel Java indicated that I had the current version 6 15 [!] when I clicked on update now. Never got an auto-update notification.

What would I do without Brian's reminders? Thank you yet again BK.

Posted by: JBV1 | November 7, 2009 12:21 AM | Report abuse

Sigh. First I go to the Java version test page, knowing that since I have Version 6 Update 16 it should tell me that I have an outdated version. It doesn't. Instead it tells me that I have the latest.

So, I open up the Java control panel on my machine, click up the Update tab and check for updates, and it tells me that, yes indeed, an update is available. I let it do the update, and after it's all done I go back to the version check page. And now it tells me that I do NOT have latest version installed.

Brilliant work, Sun. Truly brilliant.

Posted by: t_joe1 | November 10, 2009 3:10 AM | Report abuse

Brian, You write that "If you don't have Java, you probably don't need it."

I don't think that's correct, and I'll cite one real-world example: The numerous National Weather Service weather radars available on the website noaa.gov.

I imagine there are literally tens of thousands of people who keep a link to this website. Without Java, one can't get a radar image to animate and loop, showing just what direction that big thunder storm is moving in as it heads toward your town, your neighborhood, etc.

I imagine there are other websites that employ Java.

Posted by: JacksonTejas | November 10, 2009 6:11 PM | Report abuse