Currently I have these installed on my Scientific Linux 6.3: [root@localhost ~]# rpm -qa | egrep -i 'java|jre'java-1.7.0-openjdk-1.7.0.9-2.3.7.1.el6_3.x86_64java-1.6.0-openjdk-1.6.0.0-1.56.1.11.8.el6_3.x86_64tzdata-java-2012j-1.el6.noarch[root@localhost ~]# Do I need to remove then to be safe from the recent Java vulnerabilities? (If I try to remove the java-1.6.0-openjdk.. then it wants to remove libreoffice too..)Or the vulnerabilities are just related to java webbrowser plugins?
Do I need to remove all java|jre packages from my system to be secure from java vulnerabilities?
security;java
Yes, most vulnerabilities are related to the webbrowser-plugin. In most (all?) cases you must (actively) execute malicious java-code that exploits these weaknesses.From the perspective of an attacker this is most easily done by putting that code into the web and luring you onto it, so you execute that code.A more subtle approach might be to upload some java code into your application and have it execute that code (by exploiting other weaknesses like code-injections).So if you have neither a running, externally exposed application that can execute code, nor have a browser installed, you should be pretty safe.