Oracle releases Critical Patch Update
Posted on 17 July 2013.
Relatively quiet Critical Patch Update (CPU) from Oracle this quarter. Relative is of course subjective to Oracle, since this gigantic pile of unrelated code fixes includes 89 distinct CVEs and touches 20+ distinct products.

The highest risk issue is scored with a CVSS of 9 because it’s remotely exploitable without authentication. This vulnerability in the XML Parser in Oracle’s Database Server is part of a mixed bag of other vulnerabilities ranging from mild to serious.

Oracle Fusion middleware is seeing a lot of attention this quarter with 21 fixes, but nothing super critical. The highest CVSS score is 7.5.

Solaris is hit with two remote DoS attacks, plus a couple of local elevation of privilege issues.

With such a diverse range of products in this quarter’s patch, it's hard to tackle these from top to bottom with recommendations. I recommend patching any vulnerable Oracle Database Server instances ASAP and don’t neglect the stability or integrity of the Solaris deployment.


Ross Barrett, senior manager of security engineering at Rapid7.





Spotlight

Cloned, booby-trapped Dark Web sites steal bitcoins, login credentials

Apart from being a way for dissidents and journalists to do their business without being spotted and identified by "the powers that be", the Dark Web is also a place where criminals sell and buy illegal wares and services and, apparently, where they also get robbed by scammers.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Fri, Jul 3rd
    COPYRIGHT 1998-2015 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //