Java vulnerability

Sorry if this has been posted (or even fixed) before, but my mom just
about got infected with something if it weren't for her anti-virus.
http://laryju.info/cgi-bin/qw will download and execute a trojan using
some sort of java-based vulnerability. AFAIK she's up-to-date on her
patches, so perhaps somebody would like to check it out. I did a
little bit of research and can't see where the problem lies.

Thanks,
Paul