Two separate researchers released information on the vulnerability on Friday, saying that it has been present in Java for years. The problem lies in the Java Web Start framework, a technology that Sun Microsystems developed to enable the simplified deployment of Java applications. In essence, the JavaWS technology fails to validate parameters passed to it from the command line, and attackers can control those parameters using specific HTML tags on a Web page. Browsers running on Apple s Mac OS X are not vulnerable.
Source: https://threatpost.com/serious-new-java-flaw-affects-all-current-versions-windows-040910/73804/