Apple put out two advisories on August 29th about Java:
Java updates available for OS X on August 28, 2013
OS X: Java Web plug-in blocked 28 August 2013
The latter advisory is especially noteworthy to Mac admins, as that means that Apple’s XProtect was updated to block older versions of Java. That said, XProtect was not updated after the latest round of updates in June 2013, so those versions were not previously set in /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist as the minimum allowed versions. See below the jump for more details.
With the August 29th update, the following versions of the Java browser plug-in are now set as the minimum allowed versions:
For 10.6.x:
com.apple.java.JavaAppletPlugin – 13.9.7
com.apple.java.JavaPlugin2_NPAPI – 13.9.7
Click on the image below for comparisons of /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist from before and after the August 29 XProtect update.
For 10.7.x – 10.8.x
com.apple.java.JavaAppletPlugin – 14.8.0
com.apple.java.JavaPlugin2_NPAPI – 14.8.0
com.oracle.java.JavaAppletPlugin – 1.7.25.15
Click on the image below for comparisons of /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist from before and after the August 29 XProtect update.
These version numbers correspond to the following Java updates:
Java For Mac OSX 10.6 Update 16 – 13.9.7
Java for OS X 2013-004 – 14.8.0
Java 7 Update 25 – 1.7.25.15
If you’ve installed the Java updates above, you should be good. If you haven’t, install the latest Java updates and your Java browser plug-in should no longer be blocked by XProtect.
