Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I want to utilize the Java supported functions of LibreOffice (database/Macros), but I know Java is known to be insecure (notably the latest, cross-platform, zero-day exploit).

What is the best version of JRE to install that is the most compatible, but also secure?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Use OpenJDK because it do not contain the closed-source Oracle browser plugin that have been the attack vector for all the latest zero-day exploits.

If you want a JRE with included security updates install: openjdk-7-jre

OpenJDK builds in Ubuntu are based on IcedTea, this is good because the IcedTea team apply the latest security updates, that fix issues inside the core java libraries, on top of OpenJDK 6 and 7. You can find all IcedTea security announcements in gnu_andrew's blog who maintains the IcedTea security releases. http://blog.fuseyism.com/index.php/category/security/

If you want a secure java browser plugin and webstart then use the IcedTea-web plugin and javaws. You install IcedTea-web by installing: icedtea-plugin

IcedTea-web implements a more strict security policy compared to Oracles closed-source plugin: http://icedtea.classpath.org/wiki/IcedTea-Web#Security_Notes http://icedtea.classpath.org/wiki/IcedTea-Web

By using the above mentioned IcedTea-OpenJDK packages you get all new security updates when performing regular Ubuntu updates. If you manually install Oracles closed source releases you have to update manually.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.