If the vulnerability exists in Java 5, 6 and 7, it seems likely that the underlying problem is pretty old and not a recent development. Version 1.5.0_22 seems to have been released some time around 2009, and that was the end-of-life release for "Java 5" - it's earlier versions were years before this.