3 ms·
Have they been permitting anyone who isn't oracle affiliated to work on the sandbox? I was under the impression that the core development and compiler work was
by gchpaco 14y ago
Have they been permitting anyone who isn't oracle affiliated to work on the sandbox? I was under the impression that the core development and compiler work was all in house.
- tptacek 14y agoAre you sure these bugs are new? The Java Applet Sandbox doesn't exactly have a spotless security history.
- saurik 14y agoOne of the bugs is fairly old, the other (which is required for the overal exploit) is new-ish (introduced in Java 7), but probably not as new as saosebastiao was implying (as the title of this HN post can be parsed as "the bugs were introduced by the patch attempting to fix the other bugs", which is definitely not the case, AFAICT). > Issue 51 affects both Java SE 6 and 7. Issue 52 is for Java SE 7 only. Since both issues are required for the attack to succeed, we treat it as Java 7 specific only. -- http://seclists.org/fulldisclosure/2013/Jan/195 http://seclists.org/fulldisclosure/2013/Jan/195