Oracle Critical Patch Updates, Security Alerts & Third Party Bulletins

ronjor · Oct 18, 2017

Oracle Critical Patch Update Advisory - October 2017

Description

A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to: Critical Patch Updates and Security Alerts for information about Oracle Security Advisories.
Click to expand...

ronjor · Oct 30, 2017

Oracle Security Alert Advisory - CVE-2017-10151

Description
This Security Alert addresses CVE-2017-10151, a vulnerability affecting Oracle Identity Manager. This vulnerability has a CVSS v3 base score of 10.0, and can result in complete compromise of Oracle Identity Manager via an unauthenticated network attack. The Patch Availability Document referenced below provides a full workaround for this vulnerability, and will be updated when patches in addition to the workaround are available.
Click to expand...

ronjor · Nov 15, 2017

Oracle Security Alert Advisory - CVE-2017-10269

Description

This Security Alert addresses CVE-2017-10269 and four other vulnerabilities affecting the Jolt server within Oracle Tuxedo. These vulnerabilities have a maximum CVSS score of 10.0 and may be exploited over a network without the need for a valid username and password. The Oracle Jolt client is not impacted.
Click to expand...

ronjor · Jan 16, 2018

Oracle Critical Patch Update Advisory - January 2018

Description
A Critical Patch Update is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to:

Critical Patch Updates and Security Alerts for information about Oracle Security Advisories.
Click to expand...

mirimir · Jan 26, 2018

Oracle has released patches for ten vulnerabilities in VirtualBox which allow attackers to break out of guest operating systems and attack the host operating system that VirtualBox runs on.
Click to expand...

https://www.techrepublic.com/article/10-new-vm-escape-vulnerabilities-discovered-in-virtualbox/

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixOVIR

Update to version 5.2.6

Minimalist · Jan 27, 2018

Thanks for sharing. Specially this:

Because vulnerabilities affect both the VirtualBox hypervisor and guest additions, updating the guest additions inside your virtual machines is also required.
Click to expand...

deBoetie · Jan 27, 2018

Yes thanks, guest additions have always increased risk, and in the era of Spectre, they would be an obvious choice for those wanting to break guest isolation (granted that it would need cross-process attack).

I think we have to get used to being more aware and proactive in updating hypervisor and tools in the current environment.

I'm also concerned at the delay in updating some distributions in this respect, so I've taken to applying updates direct from source.

ronjor · Apr 17, 2018

Oracle Critical Patch Update Advisory - April 2018

Description
This Critical Patch Update contains 254 new security fixes across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2018 Critical Patch Update: Executive Summary and Analysis.
Click to expand...

mirimir · Apr 17, 2018

FYI: This doesn't include VirtualBox, but does include MySQL.

ronjor · Jul 17, 2018

Oracle Critical Patch Update Advisory - July 2018

This Critical Patch Update contains 334 new security fixes across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2018 Critical Patch Update: Executive Summary and Analysis.
Click to expand...

guest · Aug 13, 2018

Oracle Security Alert Advisory - CVE-2018-3110 (August 10, 2018)

This Security Alert addresses an Oracle Database vulnerability in versions 11.2.0.4 and 12.2.0.1 on Windows. CVE-2018-3110 has a CVSS v3 base score of 9.9, and can result in complete compromise of the Oracle Database and shell access to the underlying server. CVE-2018-3110 also affects Oracle Database version 12.1.0.2 on Windows as well as Oracle Database on Linux and Unix, however patches for those versions and platforms were included in the July 2018 CPU.

If you are running Oracle Database versions 11.2.0.4 and 12.2.0.1 on Windows, please apply the patches indicated below. If you are running version 12.1.0.2 on Windows or any version of the database on Linux or Unix and have not yet applied the July 2018 CPU, please do so.
Click to expand...

Critical vulnerability in Oracle Database, patch without delay!
August 13, 2018
https://www.helpnetsecurity.com/2018/08/13/cve-2018-3110/

Oracle is urging users to patch their Oracle Database installations to plug a critical security issue that can result in complete compromise of the Oracle Database and shell access to the underlying server.

The vulnerability (CVE-2018-3110) affects Oracle Database versions 11.2.0.4 and 12.2.0.1 on Windows and is apparently easy to exploit, but can only be exploited remotely by an authenticated attacker. [...]
Click to expand...

ronjor · Oct 16, 2018

Oracle Critical Patch Update Advisory - October 2018

Description

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes.
Click to expand...

ronjor · Jan 15, 2019

Oracle Critical Patch Update Advisory - January 2019

Description
A Critical Patch Update is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to:
Click to expand...

ronjor · Apr 16, 2019

Oracle Critical Patch Update Advisory - April 2019

Description
This Critical Patch Update contains 297 new security fixes across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2019 Critical Patch Update: Executive Summary and Analysis.
Click to expand...

ronjor · Apr 27, 2019

Oracle Security Alert Advisory - CVE-2019-2725

Description
This Security Alert addresses CVE-2019-2725, a deserialization vulnerability in Oracle WebLogic Server. This remote code execution vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.
Click to expand...

ronjor · Jun 19, 2019

Oracle Security Alert Advisory - CVE-2019-2729 18 June 2019

Description
This Security Alert addresses CVE-2019-2729, a deserialization vulnerability via XMLDecoder in Oracle WebLogic Server Web Services. This remote code execution vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.
Due to the severity of this vulnerability, Oracle strongly recommends that customers apply the updates provided by this Security Alert as soon as possible.
Click to expand...

ronjor · Jul 16, 2019

Oracle Critical Patch Update Advisory - July 2019

Description
A Critical Patch Update is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to:
Critical Patch Updates, Security Alerts and Bulletins for information about Oracle Security Advisories.

Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released fixes. In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply Critical Patch Update fixes without delay.

This Critical Patch Update contains 319 new security fixes across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2019 Critical Patch Update: Executive Summary and Analysis.

Please note that since the release of the April 2019 Critical Patch Update, Oracle has released two Security Alerts for Oracle WebLogic Server: CVE-2019-2725 (April 29, 2019) and CVE-2019-2729 (June 18, 2019). WebLogic Server customers are strongly advised to apply the fixes contained in this Critical Patch Update, which provides the fixes for the previously-released Alerts as well as additional fixes.
Affected Products and Patch Information
Click to expand...

ronjor · Oct 15, 2019

Oracle Critical Patch Update Advisory - October 2019

Description
A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security patches. Please refer to:
Critical Patch Updates, Security Alerts and Bulletins for information about Oracle Security Advisories.
Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches. In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply Critical Patch Update security patches without delay.

This Critical Patch Update contains 219 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2019 Critical Patch Update: Executive Summary and Analysis.
Affected Products and Patch Information

Security vulnerabilities addressed by this Critical Patch Update affect the products listed below. The product area is shown in the Patch Availability Document column.
Click to expand...

ronjor · Jan 14, 2020

Oracle Critical Patch Update Advisory - January 2020

Description
A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security patches. Please refer to: Critical Patch Updates, Security Alerts and Bulletins for information about Oracle Security Advisories.
Click to expand...

ronjor · Apr 14, 2020

Oracle Critical Patch Update Advisory - April 2020

Description
A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security patches. Please refer to:Critical Patch Updates, Security Alerts and Bulletins for information about Oracle Security Advisories.
Click to expand...

Log in or Sign up

Oracle Critical Patch Updates, Security Alerts & Third Party Bulletins

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

mirimir Registered Member

Minimalist Registered Member

deBoetie Registered Member

ronjor Global Moderator

mirimir Registered Member

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

Oracle Critical Patch Updates, Security Alerts & Third Party Bulletins

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

mirimir Registered Member

Minimalist Registered Member

deBoetie Registered Member

ronjor Global Moderator

mirimir Registered Member

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches