ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev
Home / News & Blogs / Zero Day

Oracle planning Patch Tuesday whopper

By | January 9, 2009, 3:43pm PST

Summary: Microsoft may be offering a Patch Tuesday respite this month but, if you’re an Oracle database administrator, January 13 will be a very busy day. The database server giant announced plans for a monster Patch Day next Tuesday with fixes for 41 security vulnerabilities in “across hundreds of  Oracle products.” The first CPU (Critical Patch Update) for [...]

Oracle plans monster patch dayMicrosoft may be offering a Patch Tuesday respite this month but, if you’re an Oracle database administrator, January 13 will be a very busy day.

The database server giant announced plans for a monster Patch Day next Tuesday with fixes for 41 security vulnerabilities in “across hundreds of  Oracle products.”

The first CPU (Critical Patch Update) for 2009 includes patches for flaws that affect multiple products, the company said.  “Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible.”

The following products are affected:

[ SEE: Microsoft planning quiet Patch Tuesday (1 critical) ]

  • Oracle Database 11g, version 11.1.0.6
  • Oracle Database 10g Release 2, versions 10.2.0.2, 10.2.0.3, 10.2.0.4
  • Oracle Database 10g, version 10.1.0.5
  • Oracle Database 9i Release 2, versions 9.2.0.8, 9.2.0.8DV
  • Oracle Secure Backup version 10.2.0.2, 10.2.0.3
  • Oracle Secure Backup version 10.1.0.1, 10.1.0.2, 10.1.0.3
  • Oracle TimesTen In-Memory Database version 7.0.5.1.0, 7.0.5.2.0, 7.0.5.3.0, 7.0.5.4.0
  • Oracle Application Server 10g Release 3 (10.1.3), version 10.1.3.3.0
  • Oracle Application Server 10g Release 2 (10.1.2), versions 10.1.2.2.0, 10.1.2.3.0
  • Oracle Collaboration Suite 10g, version 10.1.2
  • Oracle E-Business Suite Release 12, version 12.0.6
  • Oracle E-Business Suite Release 11i, version 11.5.10.2
  • Oracle Enterprise Manager Grid Control 10g Release 4, version 10.2.0.4
  • PeopleSoft Enterprise HRMS versions 8.9, 9.0 and 9.1
  • JD Edwards Tools version 8.97
  • Oracle WebLogic Server (formerly BEA WebLogic Server) 10.0 released through MP1, 10.3 GA
  • Oracle WebLogic Server (formerly BEA WebLogic Server) 9.0 GA, 9.1 GA, 9.2 released through MP3
  • Oracle WebLogic Server (formerly BEA WebLogic Server) 8.1 released through SP6
  • Oracle WebLogic Server (formerly BEA WebLogic Server) 7.0 released through SP7
  • Oracle WebLogic Portal (formerly BEA WebLogic Portal) 10.0 released through MP1, 10.2 GA, 10.3 GA
  • Oracle WebLogic Portal (formerly BEA WebLogic Portal) 9.2 released through MP3
  • Oracle WebLogic Portal (formerly BEA WebLogic Portal) 8.1 released through SP6

Additional details, including CVSS scores and affected components can be found in Oracle’s advance notice.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Zero Day”

Topics

BEA WebLogic, BEA Systems Inc., Oracle Corp., Portals, Application Servers, Enterprise Software, Middleware, Databases, Internet, Software, Data Management, Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

8
Comments
Add Your Opinion

Join the conversation!

Just In

RE: Oracle planning Patch Tuesday whopper
lovedong 13th Sep
thank you very much replica watches
View in thread
0 Votes
+ -
Contributr
Is that all?
dahowlett 9th Jan 2009
Any idea of the bug count in 11i? Runs 000's.
0 Votes
+ -
Security patch bug fix
ejhonda 12th Jan 2009
Bug fixes don't necessarily correlate to security patches, and vice versa.
0 Votes
+ -
That depends entirely...
masonwheeler 12th Jan 2009
...on how you define "bug". To me, security patches are a subset of the full set of bugfixes.
0 Votes
+ -
Security and bug fixes.
phatkat 12th Jan 2009
IMHO, security fixes are for issues that deal with preventing wrong people from accessing to your data on your system. Bug fixes are functional issues that prevent proper operation of your system. However some bugs are mix of these two issues so you can't really discern either category distinctly.
You would need to read into the the details in each of those patches to see what is what is the problem and what was fixed.
0 Votes
+ -
RE: Oracle planning Patch Tuesday whopper
lovedong 13th Sep
thank you very much replica watches
0 Votes
+ -
Oracle...
pgit 12th Jan 2009
You mean that drunk hag in the cave that's always talking crazy?
0 Votes
+ -
Let's be more specific
flyingbuick Updated - 12th Jan 2009
Another sensation seeking title. C'mon, if it's 41 security bugs for just one product, that's a really big deal. 41 across about 2 dozen products? Some didn't even have anything to do with Oracle until they got acquired so it is likely they're running indepent of any other Oracle products (e.g. PSFT, JDE can be running with DB2 or SQL Server).

Like similar stories about MSFT releasing a bunch of fixes, unless it's all for a single product, it really is misleading and creates unnecesary, though temporary, alarm. Sure, lots of admins have to deal with multiple products but few do everything.

Btw, my Oracle security alert mail hasn't arrived yet. Am I the only one?
0 Votes
+ -
RE: Oracle planning Patch Tuesday whopper
birumut Updated - 4th May 2011
Well done! Thank you very much for professional templates and community edition
seslisohbet seslichat

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix