DOWNLOAD

Java™ SE Development Kit 8, Update 71 (JDK 8u71)

The full version string for this update release is 1.8.0_71-b15 (where "b" means "build"). The version number is 8u71.

This update release contains several enhancements and changes including the following.

IANA Data 2015g

JDK 8u71 contains IANA time zone data version 2015g. For more information, refer to Timezone Data Versions in the JRE Software.

Security Baselines

The security baselines for the Java Runtime Environment (JRE) at the  time of the release of JDK 8u71 are specified in the following table:

For more information about security baselines, see Deploying Java  Applets With Family JRE Versions in Java Plug-in for Internet Explorer.

JRE Expiration Date

The JRE expires whenever a new release with security vulnerability  fixes becomes available. Critical patch updates, which contain security  vulnerability fixes, are announced one year in advance on Critical Patch Updates, Security Alerts and Third Party Bulletin. This JRE (version 8u71) will expire with the release of the next critical patch update scheduled for April 19, 2016.

For systems unable to reach the Oracle Servers, a secondary mechanism  expires this JRE (version 8u71) on May 19, 2016. After either  condition is met (new release becoming available or expiration date  reached), the JRE will provide additional warnings and reminders to  users to update to the newer version. For more information, see JRE Expiration Date.  

New Features and Changes

The following are some of the notable new features and changes in this release:

*MD5 now disabled for X509 Certificate validating*
MD5 must not be used for digital signatures where collision resistance is required. To prevent the use of X.509 certificates that include an MD5-based digital signature algorithm, MD5 has been added to the jdk.certpath.disabledAlgorithms security property. Applications should upgrade or replace certificates that include an MD5-based digital signature. Reversing this change is possible by removing MD5 from the jdk.certpath.disabledAlgorithms security property in the java.security file. This is not recommended.

JDK-8141287 (not public)

Bug Fixes

This release contains fixes for security vulnerabilities. For more information, see  Oracle Java SE Critical Patch Update Advisory. For a list of bug fixes included in this release, see JDK 8u71 Bug Fixes page. The following are some of the notable bug fixes included in this release:

Running jps as root does not show all information After the fix of JDK-8050807   (fixed in 8u31, 7u75 and 6u91), running jps as root did not show all  the information from Java processes started by other users on some  systems. This has now been fixed.

See JDK-8075773.

Installers appearing stalled on ESC configurations
Users running Internet Explorer Enhance Security Configuration (ESC) on   Windows Server 2008 R2 may have experienced issues installing Java in interactive mode. This issue has been resolved in the 8u71 release.  Installers executed in interactive mode will no longer appear to be  stalled on ESC configurations.

See JDK-8140197.

Problem with PBE algorithms using AES crypto corrected
An  error was corrected for PBE using 256-bit AES ciphers such that the derived key may be different and not equivalent to keys previously  derived from the same password.

JDK-8138589 (not public)

Default limit added for XML maximum entity size A default limit for maximum entity size has been added. For more about XML processing limits, please see The Java Tutorials, Processing Limits.

JDK-8133962 (not public)

Problem with Enterprise MSI switch 'REMOVEOLDERJRES' documentation corrected The Enterprise MSI documentation lists configuration options: https://docs.oracle.com/javacomponents/msi-jre8/install-guide/config_msi.htm#msi_config_file_options The REMOVEOLDERJRES option used to uninstall old JREs was missing. Added this option, with the description: If set to 1, removes older releases of the JRE installed on the system. Default: 0 does not remove any old JREs

JDK-8081237 (not public)