As a part of any BES installer, a version of the Java Runtime Environment (JRE) is installed. Sun continually updates the JRE ... bug fixes, patches, etc ... and with their automatic auto-update you'll be sure to see it tell you to update at some point.

The first thing I do on a BES after an install or an upgrade is disable the Java auto-update. RIM released the product with a specific version / component, I'll keep it at that thank you.

For some reason, apparently enough...