Looking through the CVE page it doesn't appear to affect 1.6.036+. However, all versions of 1.7 are. Can we confirm this? I didn't update to 1.7 because there were known vulnerabilities in it when it asked me to update but couldn't find anything in 1.6.035(that I was on at the time). It's worth looking at if they or people individually could just re-mediate to 1.6.037 and still maintain full functionality of Java.