Note: The installer for Java 1.6.0_20 may not correctly update all instances of the Java Deployment Toolkit plugin. I don't see any evidence that the 1.6.0_20 version is problematic. This note seems to say a problem is caused by the Java update process, rather than the 1.6.0_20 version of the plugin. I see no need to disable Java Deployment Toolkit 6.0.200.2, manually or otherwise. That said, I don't see any evidence that the current version should be blocked anyhow: Oracle says it's fixed, US-Cert says it's fixed, and the report in may be just be a warning about the incomplete Java update process, not the updated plugin. Java 6U20 installed Java Deployment Toolkit 6.0.200.2, which is newer than 6.0.200.0.

If so that's probably cross-platform (except for mac which doesn't have the deployment kit). Note that comments in the PoC also claim the deployment kit can be used to downgrade users (silently!) to a vulnerable version of the JVM. If this can be confirmed for WinXP this needs to be blocked ASAP as the exploit is fully developed and will easily be copied. The advisory itself says Windows XP so this needs to be tested there (qawanted). I tried the PoC on Windows 7 and it didn't seem to do anything, but maybe UAC defeated it. It's not clear whether it affects Linux (Tavis Ormandy, the reporter, didn't think so but others have said yes). I suggest softblocking (severity=1) so those who need it can re-enable it (Firefox 3.5 and later, FF3.0 is EOL). This is not java itself, it's hard to say how much legitimate use it has. New exploit released for all versions of the Java Deployment Toolkit.

Java plugin mozilla firefox download