837240 - update PFS for java to 7u13

Status: RESOLVED FIXED

(Websites :: plugins.mozilla.org, defect)

Description

[Roger]

Java SE 7u13 was released Feb 1, 2013
Please update the PFS to reflect this new release. 

Java 7u13
URL: http://java.com/firefoxjre_exe
File: xpiinstall.exe 
MD5 (xpiinstall.exe) = 5de7c30ac4c214340d00ce1630d90e78
SHA1(xpiinstall.exe)= 04c1518f632142ef488374566518228e3b245cf7



7u13 contains fixes for security vulnerabilities:
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html 
http://www.oracle.com/technetwork/java/javase/7u13-relnotes-1902884.html

Comment 1

[Carsten Book [:Tomcat]]

Attachment: patch

Security Update, Wil can we do a push for that? Thanks

Comment 2

[Carsten Book [:Tomcat]]

also plugincheck bug is here: https://bugzilla.mozilla.org/show_bug.cgi?id=837626

Comment 3

[Wil Clouser [:clouserw]]

https://github.com/mozilla/zamboni/commit/c84d0b7f208edbe3683cb22d9811b6e763c8639a

The entire team is at an offsite right now so pushes will be awkward.  Hope to do Thursday at 2 still.

Comment 4

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Wil Clouser [:clouserw] from comment #3)
> The entire team is at an offsite right now so pushes will be awkward.  Hope
> to do Thursday at 2 still.

I think we should find a way to do these pushes with a lot more expediency--i.e. the same day that Oracle releases the update. In particular, IIRC, the difference between u11 and u13 is something like 50 now-zero-day exploits, so it doesn't seem reasonable to wait an extra three days. (FWIW, I know that there's a proposal to disable the plugin finder service, but that hasn't happened yet.)

Comment 5

[Carsten Book [:Tomcat]]

(In reply to Brian Smith (:bsmith) from comment #4)
> 
> I think we should find a way to do these pushes with a lot more
> expediency--i.e. the same day that Oracle releases the update. In
> particular, IIRC, the difference between u11 and u13 is something like 50
> now-zero-day exploits, so it doesn't seem reasonable to wait an extra three
> days. (FWIW, I know that there's a proposal to disable the plugin finder
> service, but that hasn't happened yet.)

The Security impact is fairly minimal (in terms of the exploit). PFS never did plugin updates, so its for new users who want to use a site with java but don't have and so they get the infobar.

Then they will get the infobar with the "you need to install additional plugins" text. Because the version has changed the install will fail (because the new installer and the changes that get fixed in the patch) and guide them to the manual install. This manual install link is (as example in a German firefox) http://java.com/de/download/index.jsp and so they get 7u13.

So its not that when they use PFS they get the old version or so.

More important is to keep Plugincheck updated in case a user checks, also maybe at a later time to inform users proactive of vulnerable plugins, but thats a different bug/story/feature who would be nice to have