don't use java, flash.

[mmix]

http://thenextweb.com/microsoft/2012...bilities-list/

it is really serious security threat to normal user.

Oracle Java Multiple Vulnerabilities: DoS-attack (Gain access to a system and execute arbitrary code with local user privileges) and Cross-Site Scripting (Gain access to sensitive data). Highly Critical.
Oracle Java Three Vulnerabilities: Gain access to a system and execute arbitrary code with local user privileges. Extremely Critical.
Adobe Flash Player Multiple Vulnerabilities: Gain access to a system and execute arbitrary code with local user privileges. Gain access to sensitive data. Highly Critical.
Adobe Flash Player Multiple Vulnerabilities: Gain access to a system and execute arbitrary code with local user privileges. Bypass security systems. Highly Critical.
Adobe Reader/Acrobat Multiple Vulnerabilities: Gain access to a system and execute arbitrary code with local user privileges. Extremely Critical.
Apple QuickTime Multiple Vulnerabilities: Gain access to a system and execute arbitrary code with local user privileges. Highly Critical.
Apple iTunes Multiple Vulnerabilities: Gain access to a system and execute arbitrary code with local user privileges. Highly Critical.
Winamp AVI / IT File Processing Vulnerabilities: Gain access to a system and execute arbitrary code with local user privileges. Highly Critical.
Adobe Shockwave Player Multiple Vulnerabilities: Gain access to a system and execute arbitrary code with local user privileges. Highly Critical.
Adobe Flash Player Multiple Vulnerabilities: Gain access to a system and execute arbitrary code with local user privileges. Bypass security systems. Gain access to sensitive data. Extremely Critical.

[Penguinclaw]

I've just checked the report at Kaspersky and as far as I can see the solution is to patch from the vendor. So my question is, if you are fully patched, surely you are reasonably safe from these exploits that Kaspersky list? I realise that Flash and Java are evil but to some they are useful and until we have a web that doesn't require Flash to, for instance view video, we're a bit stuck

I tend to use security addons with Firefox such as noscript, WOT and Better privacy and surf with restraint.

[Fenrin]

Originally Posted by Penguinclaw

I've just checked the report at Kaspersky and as far as I can see the solution is to patch from the vendor. [...]

Oracle is sometimes very late with patching known security vulnerabilities from Java.

A security researcher fixed such a security hole with just 25 characters change of code. Oracle didn't intend to provide a fix until 19 February 2013. I'm not sure if Oracle changed their mind about this issue.

h-online: Security researcher experiments with patching Java

Originally Posted by Penguinclaw

[...]but to some they are useful and until we have a web that doesn't require Flash to, , for instance view video[...]

websites which require Flash seem to me to be a bit old-fashioned. YouTube and Vimeo for example doesn't require Flash (except if less featurerich browsers like Epiphany is used).

[Pitfall]

@Fenrin: YouTube still requires Flash for the majority of videos because they have ads. Videos with no ads can be wachted in HTML5.
Sadly, my bank (still) uses Flash for the administration panel. Foolish me, foolish bank.

Are the java vulnerabilities only for Oracle Java, or does openJDK also suffer from it? I never liked Java and this encourages me more to seek alternatives for my Java applications.