It’s about that time of year when Oracle release their quarterly security patches, and this time there are over 250 fixes spanning over 76 products.
In fact, there are a total of 253 patch fixes from which 15 have a Common Vulnerability Scoring System (CVSS) score of 9.0 or over, meaning they are critical updates. Oracle Big Data Discovery, Oracle Web Services, Oracle Commerce or WebLogic are areas that are more likely to be compromised by the worst of bugs according to the verbose patch dump explainer.
Not just that, there are also a pair of Java vulns that allows an unauthenticated attacker whom has network access, to compromise Java SE. Hackers that are most successful flourish when there is human interaction present, other than the attacker themselves. Although the attack is within Java SE, other products/ systems are also vulnerable to attack which could lead into complete takeover the Java SE environment.
The OJVM component with Oracle Database Server is another product that cares a critical bug which is rated at 9.1 on the CVSS. This bug effects Oracle Database versions 220.127.116.11 and 18.104.22.168 and is easily exploited by high level attackers having Create Session and Create Procedure privileges to compromise OJVM. Again these attacks carry the venin to make large disruptions to other products with your suite, which can potentially result in the takedown of OJVM.
Those of you using Oracle Database must know that the Application Express component of your environment is most at risk from attackers that have access to networks via HTTP; and anyone still using the Sun Ray thin client caper, there’s a rather large bug rated at 8.2 to tend to. But fear not as these are all taken care of in this release.
As you can imagine, there is an endless list of bugs that have been found during this process and the 253 patches that have been released are there to ensure that these fixes amend any issues you as an end user might be experiencing.
If you feel that you need help understanding these patches or anything around Oracle’s quarterly release, please get in touch and one of our Oracle Database experts or specialist DBA’s will be able to talk you through it.
For more information or to schedule a demo please contact usContact us
DSP attended the UK Oracle User Group Partner of the Year Awards last week, and we came away with awards for both categories in which we were nominatedRead more
Join us for lunch and to hear some war stories from staff and customers with experience of Oracle Database Cloud Service. We'll also understand more about the Autonomous Database and how Oracle will compete with AWS.Read more