The full internal version number for this update release is 1.6.0_13-b03 (where "b" means "build").
The external version number is 6u13.
Java Naming and Directory Interface (JNDI) API Change
The behavior of the JNDI feature to store and retrieve Java objects in an LDAP directory
has been slightly modified.
When storing a Java object in an LDAP directory, the location of the object's class file
(its codebase) may be specified. Later, when restoring the original object,
its codebase along with additional object data is retrieved from the directory
and used by the class loader.
An object's codebase is no longer implicitly trusted. Instead, a new system property
called com.sun.jndi.ldap.object.trustURLCodebase must explicitly be set
to the string value true in order for a codebase to be used.
Otherwise, the codebase will be ignored by the class loader when restoring a Java object,
and only those class files that appear on the classpath will be recognized.
Bug Fixes
This release contains fixes for one or more security vulnerabilities.
For more information, please see Sun Alerts
254569,
254570,
254571,
254608,
254609,
254610,
and
254611.
Bug fixes are listed in the following table.