Oracle JRE CVE-2013-2460

Upgrade Oracle JRE to version 7 Update 25 or later, released in Oracle's June 2013 Critical Patch Update (CPU) available at http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html. For OpenJDK 7 users, apply the upstream fix from commit 160cde99bb1a available at http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/160cde99bb1a or update to distribution-provided patched packages per vendor advisories (Red Hat RHSA-2013-0963 for immediate remediation). As compensating controls if immediate patching is not feasible: disable Java browser plugins entirely via browser settings or the Java Control Panel's 'Enable Java content in the browser' option, which eliminates the remote attack vector but prevents all browser-based Java applets from running; implement application whitelisting to restrict Java execution to only trusted, business-essential applications; or deploy Java with the 'deployment.security.level' set to 'VERY_HIGH' and maintain a strict whitelist of approved application URLs in the exception site list, though this provides limited protection against sophisticated exploits. Note that disabling browser plugins does not protect standalone Java applications from exploitation via malicious JAR files. Organizations should prioritize complete upgrade to supported Java versions (Java 8 or later as of 2024) rather than prolonged reliance on mitigations for this end-of-life Java 7 branch.