Oracle Issues 136 Patches In Latest Security Update

Oracle’s quarterly update promises to be a mammoth task for system administrators. delivering 136 patches for flaws across the entire spectrum of Oracle packages.

The usual suspects are being patched in the critical patch update, including Java. But patches are also available for the Oracle database, JD Edwards, PeopleSoft, Siebel and Sun Microsystems (Oracle has acquired a lot of companies of the years).

It should be noted that Oracle has a history of delivering large patch updates. Indeed, its last quarter update was in January, which addressed a staggering 248 vulnerabilities according to security firm ERPScan.

Patch Breakdown

At least five of the vulnerabilities in the latest update have been given the highest severity rating.

“This Critical Patch Update provides fixes for a wide range of product families including: Oracle Database Server, Oracle E-Business Suite, Oracle Fusion Middleware, Oracle Sun Products, Oracle Java SE, and Oracle MySQL,” said Oracle in a blog post on the matter. “Oracle recommends this Critical Patch Update be applied as soon as possible.”

The patches cover a wide range of Oracle products, with the largest amount of patches (31) for Oracle MySQL. Oracle Fusion Middleware meanwhile gets 22 patches; Oracle Sun System Product gets 18; Oracle PeopleSoft gets 15; and Oracle Java SE gets 9.

Tightening Security

Oracle has been busy on the security front recently. Last month it issued an emergency patch for Java to prevent hackers from remotely executing code without the need for user credentials.

It also recently added Leon Panetta, former US secretary of defence and former director of the Central Intelligence Agency (CIA), to its board of directors in an effort to improve its security credentials.

In January Australian security researcher David Litchfield revealed that he had uncovered a “major” backdoor with versions of Oracle’s E-Business Suite.

The backdoor could be used by attackers to gain complete control of a database, and was as a result of a misconfiguration flaw.

Oracle patched that flaw in its January patch update.

Are you a security pro? Try our quiz!