The vulnerability appears in versions of the Java Runtime Environment that Sun has released for servers running Windows, Linux and Sun's Solaris operating systems.