Oracle patch day: Updates for less than a thousand vulnerabilities

Oracle released software patches on Wednesday night that close 943 vulnerabilities in the company’s various products. This is an “interim patch day” that Oracle calls “Critical Security Patch Update”.

The Oracle patch day overview lists the affected products and vulnerabilities. Oracle reports critical security vulnerabilities that require particularly rapid action due to their risk classification in: Portable Clusterware, Essbase, Oracle Application Testing Suite, Oracle Commerce Guided and Oracle Commerce Experience Manager, Oracle Commerce Platform, Management Cloud Engine, Oracle Payments, Oracle Workflow, Oracle Enterprise Manager Base Platform, Oracle Financial Services Behavior Detection Platform, Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition, Oracle Hospitality Simphony, Oracle Internet Directory, Helidon, Oracle Identity Manager, Oracle Identity Manager Connector, Oracle Managed File Transfer, Oracle Reports Developer, Oracle WebCenter Enterprise Capture, Oracle WebCenter Portal, Oracle WebCenter Sites, Oracle WebLogic Server, Oracle Access Manager, Oracle Web Services Manager, Oracle WebCenter Content, Service Delivery Platform, Oracle BI Publisher, Oracle Hyperion Data Relationship Management, Oracle Hyperion Financial Management, Oracle Hyperion Calculation Manager, Oracle Hyperion Financial Management, Oracle Hyperion Financial Reporting, Oracle Hyperion Infrastructure Technology, Oracle Hyperion Profitability and Cost Management, JD Edwards EnterpriseOne Tools, PeopleSoft Enterprise PeopleTools, Siebel CRM Cloud Applications, Siebel CRM Integration, Siebel CRM Administration, Siebel Apps - Self Service, Siebel Apps - Marketing, Oracle Agile PLM, Oracle Agile PLM MCAD Connector, and Oracle Demand Planning.

Oracle does not mention that any of the vulnerabilities are already being exploited. Various software products also have highly risky security holes; here too, admins should quickly apply the updates. One of the products that is not only used in business environments is the virtualization software VirtualBox. Here, the developers have released version 7.2.16 , which closes 21 security vulnerabilities. Of these, attackers can exploit two from the network without prior authentication, the authors of the patch day overview explain.

Since May of this year, Oracle has been releasing so-called “Critical Security Patch Updates” (CSPU) in the months between the quarterly “Critical Patch Update” patch days. The company wants to close vulnerabilities faster that appear in the periods between the CPUs. The huge number of security holes now addressed shows that Oracle is on the right track. In July, the CPU took place, where Oracle patched as many as 1449 security holes .

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.