It's just a lot of code sitting in your Hard Drive.
You can safely have the JRE in your Macintosh, Linux or Windows machine with little danger, since no element of the Java RE or SDK will expose remote vulnerabilities by default. Java on a browser, however, is a different world (and hence why you can go ahead and disable it in most modern browsers), similar to (but not as bad as) what ActiveX was back in the days of Internet Explorer. NET on a Windows machine or Mono.NET on any flavor.
Like every other complex piece of software, Java is no different than, say. The problem relies for the most part in certain ways the JVM (Java Virtual Machine) accesses (and can be fooled to) certain pieces of the operating system. The Java Runtime Environment (JRE) and the Java SDK are not inherently unsafe.
