A security researcher said he's spotted two new zero-day vulnerabilities in Java 7.
"We had yet another look into Oracle's Java SE 7 software that was released by the company on February 19th, 2013," said veteran Java bug hunter Adam Gowdiak, CEO and founder of Poland-based Security Explorations, in an email to the Bugtraq mailing list. "We have discovered two new security issues (numbered 54 and 55), which when combined together can be successfully used to gain a complete Java security sandbox bypass in the environment of Java SE 7 Update 15."
In other words, the most recently released version of Java has flaws that could be remotely exploited by attackers to bypass the built-in sandbox and compromise not only the Java software, but the system on which it's running. Source: InformationWeek