Three vulnerabilities have been reported in Oracle Java, which can be exploited by malicious people to compromise a user's system.

1) An error in how the "setSecurityManager()" function can be called can be exploited by an applet to set its own privileges to e.g. allow downloading and executing arbitrary programs.

NOTE: This is currently being actively exploited in targeted attacks.

2) An error when handling reflections within the java.beans.Expression class can be exploited to compromise a user's system.

3) An unspecified error in the Beans sub-component can be exploited to compromise a user's system.

Successful exploitation of the vulnerabilities allows execution of arbitrary code, but applies to client deployment only as the vulnerabilities are exploited through untrusted Java Web Start applications and untrusted Java applets.

Solution
Update to version 7 Update 7.
Further details available to Secunia VIM customers

Provided and/or discovered by
2) James Forshaw (tyranid) via ZDI

Reported as a 0-day.

The vendor also credits Adam Gowdiak, Security Explorations.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Oracle:
http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
https://blogs.oracle.com/security/entry/security_alert_for_cve_20121

FireEye:
http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html

ZDI:
http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0214.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers