Oracle says Java flaw will be fixed 'shortly'