Oracle Issues 36 Patches

April 18, 2007

The Critical Patch Update is among the smallest since Oracle began quarterly updates.

Oracle Corp. Tuesday issued its second critical patch update for the year, this time patching 36 security holes in its products – including several that can be exploited remotely by an attacker without authentication.

The most serious of the flaws affects Oracle relational database management system running on Windows, that received a Common Vulnerability Scoring System rating of 7.0 out of 10. This flaw can be exploited remotely by attacker sans a password or user name for authentication.

The CVSS standard, which was created by the Homeland Security Department's National Infrastructure Advisory Council, was adopted by Oracle in October. None of the other vulnerabilities addressed by the Oracle release – besides the flaw affecting the relational database management system - rated higher than 4.2.

There are 13 security fixes for the Oracle Database. In addition, 11 security fixes were issued for Oracle E-Business Suite and Applications, five for Oracle Application Server, one each for Oracle Enterprise Manager, Oracle Secure Enterprise and the Oracle Collaboration Suite. There are also four fixes for JD Edwards EnterpriseOne and Oracle PeopleSoft Enterprise.

The release is among the smallest patch loads in several months. In January, Oracle's critical patch update addressed 51 flaws, while the company's critical patch update last October contained more than 100 security fixes. The next Critical Patch Update is scheduled for July 17.

Eric Maurice, manager of security in Oracle's Global Technology Business Unit, wrote on the company's security blog today that the company's decision to release quarterly updates has improved product maintenance for customers.

"The predictability provided by the - Critical Patch Update - mechanism is very important to Oracle customers," he wrote. "It results in enabling customers to plan for the CPUs and install them in their normal maintenance windows, to avoid undue interruptions in their business-critical systems."

Rate this story - not rated yet

rank
1
2
3
4
5

view popular

Other News

Newspaper circulation may be worse than it looks

Technology / Internet

7 hours ago | not rated yet | 0

(AP) -- While U.S. newspapers are losing subscribers at a staggering rate, a few dailies stand out because their circulation is rising. But they aren't necessarily selling more copies.

Canadian woman loses benefits over Facebook photo

Technology / Internet

7 hours ago | 5 / 5 (1) | 0

(AP) -- A Canadian woman on long-term sick leave for depression says she lost her benefits because her insurance agent found photos of her on Facebook in which she appeared to be having fun.

China is the world's largest emitter of the greenhouse gases blamed for global warming

China harnesses mountain wind power

Technology / Energy

17 hours ago | 4.1 / 5 (7) | 0

In the mountains above the southwestern Chinese town of Dali, dozens of new wind turbines dot the landscape -- a symbol of the country's sky-high ambitions for clean, green energy.

Analysts say AmEx is most interested in the so-called peer-to-peer services of Revolution

American Express takes aim at PayPal with Revolution

Technology / Internet

14 hours ago | 4.5 / 5 (2) | 0

With its deal to buy Revolution Money, American Express is taking aim at the growing market for online and alternative payments, in a challenge to recognized leader PayPal, analysts say.

Hackers leak e-mails, stoke climate debate

Technology / Internet

Nov 21, 2009 | 4.4 / 5 (31) | 27

(AP) -- Computer hackers have broken into a server at a well-respected climate change research center in Britain and posted hundreds of private e-mails and documents online - stoking debate over whether some scientists have ...