Oracle confirmed that it had released a new patch, but did not return a call for comment on the lingering concerns.

 

Security experts estimate that Java is used in 3 billion machines, about 2 billion of which are desktop or laptop computers. The program was a backbone of Web sites in the early days of the Internet.

 

The latest security hole came to light last week after the Department of Homeland Security raised an alarm about the security hole. Even after Oracle released the patch, the agency recommended that users disable Java “unless it is absolutely necessary,” citing continuing problems with the program’s overall security.
 

Oracle updates Java every four months, far less frequently than the monthly or even weekly updates other software gets. Researchers who report Java problems to Oracle often wait months for a fix. That was the case with a security problem the company patched in August — one that security researchers said they identified in April.

The long period of time between updates gives hackers time to take advantage of software problems, experts say..