Java Updates Required on Windows Server 2008 R2

Question

All,

We have some existing servers that have been neglected due to a merger. We had a System Vulnerabilities report run and we have multiple occurrences of issues such as "JRE and JDK are prone to multiple vulnerabilities that affect various components. Oracle's Java Critical Patch Update for June 2012 contains 14 new security fixes across Java SE products. The vendor released an update to resolve these issues. Refer to vendor advisory Oracle Java CPU June 2012." and so forth for all.

Resolution: Update the following:

• Oracle Java CPU June 2012
• Oracle Java SE CPU October 2012
• Oracle Security Alert
• Oracle Java SE CPU February 2013
• Oracle Security Alert for CVE-2013-1493
• Oracle Java SE CPU April 2013
• Oracle Java SE CPU June 2013
• Oracle Java SE CPU July 2014
• Oracle Java SE CPU October 2014
• Oracle Java SE CPU January 2015
• Oracle Java SE CPU July 2015
• Oracle Security Alert for CVE-2012-4681
• Oracle Java SE CPU February 2013 - Special Update
• Oracle Java SE CPU October 2013
• Oracle Java SE CPU January 2014
• Oracle Java SE CPU April 2014
• Oracle Java SE CPU April 2015

My question is, do I need to install them all individually OR if I install the latest (eg Oracle Java SE CPU July 2015), does that include all patches and fixes required for the rest to be correct?

Thanks!

Answer 1

You don't need to install any versions in between. Just make sure all old versions are removed and then install the current version.

For Java 8 you could use Update 65 or 66, you can read more about Oracles update policy here: http://www.oracle.com/technetwork/java/javase/cpu-psu-explained-2331472.html

One more thing that could be of interest to you: if your servers only need the x64 version of Java, you don't need to install Java. You can simply download the Server JRE and unpack it. Despites its name this archive contains a JRE and a JDK, so you can provide both (some software needs a JDK to run)