|
|
 | | From: | Kirill V. Marchuk | | Subject: | Re: Opera.jar | | Date: | Fri, 26 Nov 2004 09:15:31 +0600 |
|
|
 |
> I suppose that might explain what lc.jar is ... but I don't actually see
> any plugins either.
>
> There is a feature in Java called "LiveConnect", it allows program control
> over plugins so that, for example, a button in a page can play or pause a
> video. So then, a page which uses plugins might start Java even without
> any applets on the page if the page uses LiveConnect.
Steven, so I will not solve this problem ? Just uninstall J2RE and return to
that one, which came along with Opera ? I'm afraid doing that, cause I did
it for some reason..
(I don't remember it exactly :)
|
|
| | From: | Steven V. Gunhouse | | Subject: | Re: Opera.jar | | Date: | Fri, 26 Nov 2004 12:48:39 GMT |
|
|
| On Fri, 26 Nov 2004 09:15:31 +0600, Kirill V. Marchuk <62mkv@mail.ru>
wrote:
>
>> I suppose that might explain what lc.jar is ... but I don't actually see
>> any plugins either.
>>
>> There is a feature in Java called "LiveConnect", it allows program
>> control
>> over plugins so that, for example, a button in a page can play or pause
>> a
>> video. So then, a page which uses plugins might start Java even without
>> any applets on the page if the page uses LiveConnect.
>
> Steven, so I will not solve this problem ? Just uninstall J2RE and
> return to
> that one, which came along with Opera ? I'm afraid doing that, cause I
> did
> it for some reason..
> (I don't remember it exactly :)
>
There have been security updates to Java, they're now at 1.4.2_06 due to
one in the last week. But as I doubt the opera.jar from 7 is compatible
with 6 ...
--
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/
|
|
| | From: | Josef W. Segur | | Subject: | Re: Opera.jar | | Date: | Fri, 26 Nov 2004 18:03:12 -0500 |
|
|
| On Fri, 26 Nov 2004 12:48:39 GMT, "Steven V. Gunhouse" wrote:
>On Fri, 26 Nov 2004 09:15:31 +0600, Kirill V. Marchuk <62mkv@mail.ru>
>wrote:
>
>>
>>> I suppose that might explain what lc.jar is ... but I don't actually see
>>> any plugins either.
>>>
>>> There is a feature in Java called "LiveConnect", it allows program
>>> control
>>> over plugins so that, for example, a button in a page can play or pause
>>> a
>>> video. So then, a page which uses plugins might start Java even without
>>> any applets on the page if the page uses LiveConnect.
>>
>> Steven, so I will not solve this problem ? Just uninstall J2RE and
>> return to
>> that one, which came along with Opera ? I'm afraid doing that, cause I
>> did
>> it for some reason..
>> (I don't remember it exactly :)
>>
>
>There have been security updates to Java, they're now at 1.4.2_06 due to
>one in the last week. But as I doubt the opera.jar from 7 is compatible
>with 6 ...
Opera 6.0x came with some version 1.3 JRE, and at least one other O6
user who was unable to get 1.4x JRE to work resolved it by going back
to 1.3.
The security fixes in JRE 1.4.2_06 are also in JRE 1.3.1_13, which can
be downloaded from .
--
Joe
|
|
| | From: | Paul McGarry | | Subject: | Re: Opera.jar | | Date: | Sat, 27 Nov 2004 10:59:05 +1100 |
|
|
| On Fri, 26 Nov 2004 18:03:12 -0500, Josef W. Segur
wrote:
> Opera 6.0x came with some version 1.3 JRE, and at least one other O6
> user who was unable to get 1.4x JRE to work resolved it by going back
> to 1.3.
>
> The security fixes in JRE 1.4.2_06 are also in JRE 1.3.1_13, which can
> be downloaded from .
But we still don't know if the update fixes things for Opera....
--
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/
|
|
| | From: | Steven V. Gunhouse | | Subject: | Re: Opera.jar | | Date: | Sat, 27 Nov 2004 01:29:54 GMT |
|
|
| On Sat, 27 Nov 2004 10:59:05 +1100, Paul McGarry
wrote:
> On Fri, 26 Nov 2004 18:03:12 -0500, Josef W. Segur
> wrote:
>
>> Opera 6.0x came with some version 1.3 JRE, and at least one other O6
>> user who was unable to get 1.4x JRE to work resolved it by going back
>> to 1.3.
>>
>> The security fixes in JRE 1.4.2_06 are also in JRE 1.3.1_13, which can
>> be downloaded from .
>
> But we still don't know if the update fixes things for Opera....
>
We don't even know if Opera has a real problem yet. That is, they said you
can access hidden methods, but can you actually do anything with them?
--
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/
|
|
| | From: | Paul McGarry | | Subject: | Re: Opera.jar | | Date: | Sun, 28 Nov 2004 07:46:15 +1100 |
|
|
| On Sat, 27 Nov 2004 01:29:54 GMT, Steven V. Gunhouse
wrote:
>> But we still don't know if the update fixes things for Opera....
>
> We don't even know if Opera has a real problem yet. That is, they said
> you can access hidden methods, but can you actually do anything with
> them?
Indeed, I am a little dissappointed with the lack of definitive security
information from Opera on this issue.
We shouldn't need to be guessing.
How many people have downloaded "Opera with Java" from Opera yet there's
nothing on Opera's home page to help them be safe (and feel safe).
I emailed support too but it's one of those answers where it's not clear
they actually understand the question.
=====
> The recent Java exploit:
> http://jouko.iki.fi/adv/javaplugin.html
> suggests that there is a bug in the java plugin and also whatever Opera
> does
> instead of using the plugin.
>
> There are updates to Java to fix this bug but it is unclear whether the
> update fixes the bug for Opera because Opera doesn't use the (apparently
> now
> fixed) plugin but does it's own thing.
This problem is fixed in Java 1.5, which can be downloaded from
http://javashoplm.sun.com:80/ECom/docs/Welcome.jsp?StoreId=22&PartDetailId=jre-1.5.0-oth-JPR&SiteId=JSC&TransactionId=noreg
It's also fixed in Opera 7.6, which is currently available as preview.
=====
At least if that is correct then both my Windows box running Java 1.5 and
Opera 7.54 and my Linux box running a 1.4 Java and Opera 7.6 should be
safe......
Paul
--
Using Opera's revolutionary e-mail client: http://www.opera.com/m2/
|
|
|
