Update Release Notes

Update Release Notes Index

Changes in 1.6.0_14 (6u14)

OlsonData 2009g

Security Baseline

6u14 specifies the following security baselines for use with Java Plug-in technology:

Additional Supported System Configurations

For 6u14, support has been added for the following system configurations:

• Windows Server 2008 SP2
• Windows Vista with SP2

Service Tag Support

Service Tag support on Solaris and Linux was added in version 1.6.0_04. JRE 1.6.0_14 extends Service Tag support to Windows. If Service Tag software has been installed on a system where JRE 1.6.0_14 is being installed, a unique service tag is automatically created for that particular JRE instance. There is no change in the JDK/JRE installation instruction, and there is no change in the Java runtime.

Blacklist Jar Feature

Support for blacklisting signed jar files has been added to 6u14. A blacklist is a list of signed jars that contain serious security vulnerabilities that can be exploited by untrusted applets or applications. A system-wide blacklist will be distributed with each JRE release. Java Plugin and Web Start will consult this blacklist and refuse to load any class or resource contained in a jar file that's on the blacklist. By default, blacklist checking is enabled. The deployment.security.blacklist.check deployment configuration property can be used to toggle this behavior.

The blacklist entries are the union of the blacklist files pointed to by the deployment.system.security.blacklist and deployment.user.security.blacklist properties. By default, deployment.system.security.blacklist points to the blacklist file in the jre/lib/security directory, and deployment.user.security.blacklist points to a blacklist file that contains additional entries added by a user.

The blacklist is a text file with the following format:

attribute : value

Each jar file on the blacklist is identified by the x-Digest-Manifest attribute where x is the name of the MessageDigest algorithm, and the value is the base64 encoded hash value of the Manifest. Comments are denoted by lines starting with the # (number) symbol.

Here is an example:

# Buggy Utilities, version 1.0
SHA1-Digest-Manifest : QONXbQg+EtNOguIOAgpUUOadhv8=
# Malware Inc., version 99.99
SHA-256-Digest-Manifest : SewaudBCZ3iXt1KX0BeFHpQiiM1xYLtvLw3Ow2RJfcs=

6u14 includes version 14.0 of the Java HotSpot Virtual Machine, which provides improved reliability, serviceability and performance.

Contributing to increased performance in this release are numerous enhancements to HotSpot's optimizing compiler, more efficient SoftReference processing and improvements to Parallel Compacting garbage collection. Optionally available are two new features - escape analysis and compressed object pointers. A preliminary version of the new Garbage First (G1) garbage collector is also included.

Improvement TreeMap Iteration

6u14 includes an experimental implementation of java.util.TreeMap that can improve the performance of applications that iterate over TreeMaps very frequently. This implementation is used when running with the -XX:+AggressiveOpts option.

JAX WS 2.1.6 and JAXB 2.1.10

JavaDB 10.4.2.1

6u14 contains the new 10.4.2.1 version of Java DB.

Java VisualVM Updates

6u14 contains the following updates to Java VisualVM:

• CPU usage and GC activity graph in the Monitor tab
• Table view in the Threads tab
• Command line options: --openpid, --openjmx, --openfile
• Compare Memory Snapshots action in the context menu
• Copy To Clipboard / Save To File buttons in the About dialog
• Monitoring IBM JVM via JMX connection
• Based on NetBeans Platform 6.5 and NetBeans Profiler 6.5
• Faster computation of references, and improved readability of path to GC root in HeapWalker
• Improved integration of the Visual GC tool

Debug Issue

Java ™ Virtual Machine Tool Interface (JVM TI) breakpoints are reliable only when either the Parallel Scavenge garbage collector (-XX:+UseParallelGC) or the Parallel Compacting garbage collector (-XX:+UseParallelOldGC) is used.

When other collectors are used, breakpoints may stop functioning, and JVM TI object tags may become unusable after a full GC operation is performed. Java ™ Debug Interface (JDI) ThreadReferences have an embedded thread ID that depends on JVM TI object tags, thus the embedded thread ID may change unexpectedly. This may cause confusion in thread based JDI events.

Note that the Serial garbage collector (-XX:+UseSerialGC) is vulnerable to this problem and is selected by default on some platforms. The work around is to explicitly select the Parallel Scavenge collector using the command line option -XX:+UseParallelGC.

Issue with JDK Silent Installation

Prior to 6u14, the JDK installer was never fully supported silently. One of the side effects of silent JDK installation is that it does not install the public JRE. It used to cache/install a jre.msi file. Apparently some users have been using the jre.msi without our documentation or approval. As of 6u14, we no longer cache the file.

Possible Issue for Java Web Start Applications

In 6u14 Java Web Start, if you specify an insecure Java system property in a sandbox JNLP file, Java Web Start fails to launch and notifies that JARs in the sandbox JNLP file are not signed.

This feature release does not contain any new fixes for security vulnerabilities to its previous release, Java SE 6 Update 13. Users who have Java SE 6 Update 13 have the latest security fixes and do not need to upgrade to this release to be current on security fixes.

Bug fixes are listed in the following table.