Microsoft admits to second JVM flaw

Microsoft has admitted to a second vulnerability in software that allows Windows users to run programs written in Java.

More usually seen battling in the courtroom these days, Microsoft and Sun Microsystems have released joint bulletins about the vulnerabilities affecting the Java Virtual Machine (JVM) code.

A Microsoft spokesman said that, while there have been no known attempts to exploit the vulnerabilities, they were considered critical because of the harm they could cause.

The company has released a JVM update to fix both vulnerabilities.

The first flaw allows a malicious Java applet on a website to monitor a visitor's web surfing, while the second could allow a Java program to run outside a restricted area on the user's computer.

The main users at risk are those using a proxy server to access websites. Proxy servers are commonly used to cache content on frequently accessed sites, housing it on a server closer to the end user so that downloading is faster.